Techniques for defining, using and manipulating rights management data structures

• US 6,138,119 A
• Filed: 04/27/1999
• Issued: 10/24/2000
• Est. Priority Date: 02/25/1997
• Status: Expired due to Term

• Current Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Original Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Inventors: Xu, Xuejun, Worsencroft, Kim, Hall, Edwin J., Tomasello, Luke S., Weber, Robert P., Shear, Victor H., Van Wie, David M.
• Primary Examiner(s): AMSBURY, WAYNE P
• Application Number:
  US09/300,778
• Time in Patent Office: 546 Days
• Field of Search: 707/9, 707/4, 707/102
• US Class Current: 1/1
• CPC Class Codes: G06F 21/1062 Editing
• CPC Class Codes: G06F 21/1063 Personalisation
• CPC Class Codes: G06F 21/1073 Conversion
• CPC Class Codes: G06F 21/1078 Logging; Metering
• CPC Class Codes: G06F 21/1086 Superdistribution
• CPC Class Codes: G06F 21/1088 by using transactions with atomicity, consistency, or isolation and durability [ACID] properties
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6236 between heterogeneous systems
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04N 21/2541 Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/4627 Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/835 Generation of protective data, e.g. certificates protecting software against unauthorised usage in a vending or licensing environment G06F21/10
• CPC Class Codes: H04N 21/8355 : involving usage data, e.g. number of copies or viewings allowed
• CPC Class Codes: Y10S 707/99934 : Query formulation, input preparation, or translation
• CPC Class Codes: Y10S 707/99939 : Privileged access
• CPC Class Codes: Y10S 707/99943 : Generating database or data structure, e.g. via user interface

Abstract

A descriptive data structure provides an abstract representation of a rights management data structure such as a secure container. The abstract representation may describe, for example, the layout of the rights management data structure. It can also provide metadata describing or defining other characteristics of rights management data structure use and/or processing. For example, the descriptive data structure can provide integrity constraints that provide a way to state rules about associated information. The abstract representation can be used to create rights management data structures that are interoperable and compatible with one another. This arrangement preserves flexibility and ease of use without compromising security.

Claims

1. A method including:

generating a descriptive data structure in a first data processing device characterized by a first security aspect;

specifying information in the descriptive data structure, including information relating to the first security aspect, a first rule, and a second rule;

associating a third rule with the descriptive data structure, the third rule at least in part controlling use of at least a portion of the descriptive data structure;

transmitting the descriptive data structure to a second data processing device;

at the second environment, retrieving from the descriptive data structure

the information relating to the first security aspect, the retrieval being governed at least in part by the third rule; and

determining whether to use the first rule or the second rule based on the information.

2. The method of claim 1, wherein determining includes determining the level of security present at the first data processing device based on the information related to the first security aspect.

3. The method of claim 2, wherein determining includes determining to use the first rule or the second rule, but not both.

4. The method of claim 1, wherein specifying information in the descriptive data structure includes populating a first target block and a second target block.

5. A descriptive data structure embodied on a computer-readable medium or other logic device, including the following elements:

identification information at least in part identifying a first rights management data structure;

organization information at least in part describing the organization of at least some governed information contained within or referenced by the first rights management data structure;

rule information relating to a first rule used to at least in part govern use of at least a portion of the governed information contained within the first rights management data structure; and

a second rule used to at least in part govern use of at least a portion of the descriptive data structure.

6. The descriptive data structure of claim 5, in which the first rights management data structure is a secure container.

7. The descriptive data structure of claim 6, in which the secure container includes:

the governed information; and

the first rule.

8. The descriptive data structure of claim 6, in which the secure container includes the descriptive data structure.

9. The descriptive data structure of claim 5, in which:

the first rule is stored outside the descriptive data structure; and

the rule information includes information regarding the location at which the first rule is stored.

10. The descriptive data structure of claim 5, in which:

the first rule is a display rule at least in part governing the display of at least a portion of the governed information.

11. The descriptive data structure of claim 5, in which:

the governed information includes source information at least in part identifying an author, creator, publisher and/or owner of at least a portion of the governed information; and

the first rule requires display of the source information under circumstances specified by the rule.

12. The descriptive data structure of claim 5, in which:

the first rule constitutes a creation rule at least in part governing the creation of a specific example of the first rights management data structure.

13. The descriptive data structure of claim 12, in which:

the creation rule at least in part specifies information which must be included with the specific example of the first rights management data structure.

14. The descriptive data structure of claim 5, in which:

the descriptive data structure is stored in a second rights management data structure.

15. The descriptive data structure of claim 5, further including:

information relating to the organization of at least some information contained in a second rights management data structure which differs in at least one respect from the first rights management data structure.

16. The descriptive data structure of claim 5, which:

the organization information includes information relating to the location of at least some of the governed information.

17. The descriptive data structure of claim 5, further including:

a first target data block including information relating to a first target environment in which the descriptive data structure may be used.

18. The descriptive data structure of claim 17, further including:

a second target data block including information relating to a second target environment in which the descriptive data structure may be used.

19. The descriptive data structure of claim 5, further including:

a source message field containing information at least in part identifying at least one source for the descriptive data structure.

20. The descriptive data structure of claim 19, in which:

the source identification information includes environment information relating to at least one aspect of an environment in which the descriptive data structure was at least in part created.

21. The descriptive data structure of claim 20, in which:

the environment information includes information relating to security present at the environment.

22. The descriptive data structure of claim 5 further including a source seal.

23. The descriptive data structure of claim 22, in which:

the source seal includes a hash of at least a portion of the descriptive data structure.

24. The descriptive data structure of claim 22, in which:

the source seal is encrypted based on a private key.

25. The descriptive data structure of claim 24, further including:

key location information related to a location from which a public key corresponding to the private key may be obtained.

26. The descriptive data structure of claim 25, in which:

the key location information is contained within a certificate.

27. The descriptive data structure of claim 26, in which:

the certificate is contained in the descriptive data structure.

28. A distributed data processing arrangement including:

a first data processing apparatus including;

a central processing unit; and

a first memory storing (1) a descriptive data structure, the descriptive data structure including information regarding a first organization of elements within a secure container, and (2) a first rule at least in part governing use of at least a portion of the descriptive data structure; and

a second data processing apparatus including;

a central processing unit; and

a second memory storing a first secure container including;

data elements organized at least in part in accordance with the information contained in the descriptive data structure; and

a rule set made up of at least a second rule, the rule set used to at least in part govern at least one aspect of access to or use of the data elements;

the second rule requiring that information regarding at least one use of at least one of the data elements be at least temporarily recorded.

29. The distributed data processing arrangement of claim 28, in which:

the descriptive data structure is contained in a second secure container, which also includes the second rule.

30. The distributed data processing arrangement of claim 29, further including metadata relating to the contents of the first secure container.

31. The distributed data processing arrangement of claim 30, in which:

the metadata is stored in the second secure container.

32. The distributed data processing arrangement of claim 30, in which:

the metadata is stored in a third secure container.

33. The distributed data processing arrangement of claim 31, further including:

a third data processing apparatus, including;

a central processing unit;

a third memory including;

the third secure container and

a rule used to at least in part govern at least one aspect of

access to or use of the metadata; and

communications means by which the third data processing apparatus may communicate the third secure container, or a copy of the third secure container, to the second data processing apparatus.

34. The distributed data processing arrangement of claim 28, further including:

a computer program designed to use at least a portion of the descriptive data structure in an operation on the first secure container or the contents of the first secure container.

35. The distributed data processing arrangement of claim 34, in which:

the computer program includes means for using a rule from the rule set to govern at least one aspect of the computer program'"'"'s use of the descriptive data structure.

36. The distributed data processing arrangement of claim 34, which the computer program is designed to use the information regarding the organization of elements within the first secure container to identify or locate at least one of the elements.

37. The distributed data processing arrangement of claim 34 in which:

the computer program includes a browser which uses the information regarding the organization of elements within the first secure container to control, at least in part, the display of at least some information from the first secure container.

38. The distributed data processing arrangement of claim 34, in which:

the computer program is integrated into an operating system.

39. The distributed data processing arrangement of claim 38, in which:

the operating system is compatible with at least one version of Microsoft Windows.

40. The distributed data processing arrangement of claim 28, in which:

the rule set includes a rule at least in part controlling at least one aspect of an auditing process.

41. The distributed data processing arrangement of claim 28, in which:

the rule set includes a rule at least in part controlling at least one aspect of a budgeting process.

42. The distributed data processing arrangement of claim 28, in which the second data processing apparatus includes a secure electronic appliance.

43. A method of using a descriptive data structure, at a first data processing arrangement located at a first site, including:

receiving a first secure container including governed information;

receiving a first rule set including at least one rule, the first rule set governing at least one aspect of access to or use of the governed information and containing a first rule at least in part governing at least one aspect of an auditing process involving the governed information;

receiving a second secure container including a descriptive data structure, the descriptive data structure including information at least in part describing or representing at least one aspect of the organization of the first secure container governed information;

receiving a second rule set including at least one rule, the second rule set governing at least one aspect of access to or use of the descriptive data structure;

using the second rule set to gain access to at least a portion of the descriptive data structure; and

using the accessed descriptive data structure portion to make a use of the first secure container governed information.

44. The method of claim 43, in which using the descriptive data structure portion includes:

identifying a first portion of the first secure container governed information using information from the descriptive data structure.

45. The method of claim 44, in which:

the first portion of the first secure container governed information identifies or describes a second portion of the first secure container governed information.

46. The method of claim 45, in which identifying a first portion is followed by displaying information from the first portion of the first secure container governed information.

47. The method of claim 46, in which displaying information from the first portion of the first secure container governed information includes:

displaying a title of a work contained in the second portion of the first secure container governed information.

48. The method of claim 46, in which displaying information from the first portion of the first secure container governed information includes:

displaying a summary of the second portion of the first secure container governed information.

49. The method of claim 43, in which the first data processing arrangement includes a descriptive data structure interpreter;

and

using the accessed descriptive data portion is carried out at least in part through use of the descriptive data structure interpreter.

50. The method of claim 49, in which the descriptive data structure interpreter is integrated with a browser and using the accessed descriptive data structure portion further includes the steps, performed by the browser, of:

using the descriptive data structure to identify and locate a portion of the first secure container governed information, and

causing the display of the located portion.

51. A method of creating a first secure container, including:

accessing a first control, which at least in part governs use of a descriptive data structure;

in compliance with the first rule, accessing the descriptive data structure, which includes or addresses;

organization information at least in part describing a required or desired organization of a content section of the first secure container, and

metadata information at least in part specifying at least one step required or desired in creation of the first secure container;

organizing information contained in the first secure container using the descriptive data structure; and

using the metadata information to at least in part generate or identify a second control designed to govern at least one aspect of access to or use of at least a portion of the information contained in the first secure container.

52. The method of claim 51, in which the descriptive data structure is contained in a second secure container with which the first control is associated and accessing the descriptive data structure includes:

opening the second secure container in compliance with the first control.

53. The method of claim 51, further including:

using the metadata information to at least in part identify or generate a third control to govern an aspect of access to or use of at least a portion of the information contained in the first secure container.

55. The method of claim 51, further including:

receiving the descriptive data structure at a first site from a second site prior to accessing the descriptive data structure; and

creating the first secure container at the first site.

56. The method of claim 55, further including:

receiving the metadata at the first site prior to using the metadata, the metadata being received separately from the descriptive data structure.

57. The method of claim 56, further including:

requesting the metadata by the first site based on information contained in the descriptive data structure.

58. The method of claim 56, wherein receiving the metadata includes:

receiving the metadata at the first site in a second secure container having associated a third control; and

wherein using the metadata in the creation of the first secure container occurs after the first site has complied with a requirement imposed by the third control.

59. The method of claim 51, further including:

storing owner or creator information in the first secure container in compliance with the descriptive data structure.

60. The method of claim 59, further including:

storing copyright ownership information in the first secure container in compliance with the descriptive data structure.

61. The method of claim 60, further including:

storing an advertisement in the first secure container in compliance with the descriptive data structure.

62. The method of claim 61, in which:

the creation of the first secure container includes placing the owner or creator information, the copyright ownership information, and the advertisement in locations specified at least in part by the descriptive data structure.

63. The method of claim 51, in which:

the descriptive data structure includes information specifying fields relating to at least one atomic transaction.

64. The method of claim 63, in which:

the atomic transaction information fields include fields for offer and acceptance information.

54. The method of claims further including:

associating the third control with the first secure container.