Method and apparatus for executing code in accordance with usage rights

• US 6,898,576 B2
• Filed: 12/19/2002
• Issued: 05/24/2005
• Est. Priority Date: 11/23/1994
• Status: Expired due to Fees

• Current Assignee: ContentGuard Holdings, Inc. (Pendrell Corporation)
• Original Assignee: ContentGuard Holdings, Inc. (Pendrell Corporation)
• Inventors: Pirolli, Peter L., Stefik, Mark J.
• Primary Examiner(s): Trammell, James P.
• Assistant Examiner(s): Abdi, Kambiz
• Application Number:
  US10/322,759
• Publication Number:
  US 20030225698A1
• Time in Patent Office: 887 Days
• Field of Search: 705/1, 705/26, 705 50- 59, 707/9, 700/237
• US Class Current: 705/50
• CPC Class Codes: A61B 2017/0046 with a releasable handle; with handle and operating part separable
• CPC Class Codes: A61B 2034/301 for introducing or steering flexible instruments inserted into the body, e.g. catheters or endoscopes
• CPC Class Codes: A61B 2090/031 torque limiting
• CPC Class Codes: A61B 2090/376 using X-rays, e.g. fluoroscopy
• CPC Class Codes: A61B 34/30 Surgical robots
• CPC Class Codes: A61B 34/37 Master-slave robots A61B34/35 takes precedence
• CPC Class Codes: A61M 25/0113 Mechanical advancing means, e.g. catheter dispensers
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: G06Q 10/101 Collaborative creation, e.g. joint development of products or services
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/1235 with control of digital rights management [DRM]
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 30/00 Commerce
• CPC Class Codes: G06Q 30/0185 Product, service or business identity fraud
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising
• CPC Class Codes: G06Q 30/0283 Price estimation or determination
• CPC Class Codes: G06Q 30/04 Billing or invoicing
• CPC Class Codes: G06Q 30/06 : Buying, selling or leasing transactions
• CPC Class Codes: G06Q 30/0601 : Electronic shopping [e-shopping]
• CPC Class Codes: G06Q 50/184 : Intellectual property management
• CPC Class Codes: H04L 12/14 : Charging , metering or billing arrangements for data wireline or wireless communications
• CPC Class Codes: H04L 12/1403 : Architecture for metering, charging or billing
• CPC Class Codes: H04L 12/146 : using digital cash
• CPC Class Codes: H04L 12/1485 : Tariff-related aspects
• CPC Class Codes: H04L 12/1496 : involving discounts
• CPC Class Codes: H04L 2209/56 : Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/603 : Digital right managament [DRM]
• CPC Class Codes: H04L 2463/101 : applying security measures for digital rights management
• CPC Class Codes: H04L 61/00 : Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/45 : Network directories; Name-to-address mapping
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 : wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0464 : using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/0807 : using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0823 : using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 63/104 : Grouping of entities
• CPC Class Codes: H04L 63/105 : Multiple levels of security
• CPC Class Codes: H04L 63/123 : received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/3213 : using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3297 : involving time stamps, e.g. generation of time stamps
• CPC Class Codes: H04L 9/40 : Network security protocols
• CPC Class Codes: H04N 21/23412 : for generating or manipulating the scene composition of objects, e.g. MPEG-4 objects
• CPC Class Codes: H04N 21/2541 : Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/2543 : Billing , e.g. for subscription services payment schemes, architectures or protocols G06Q20/00; e-commerce G06Q30/00; arrangements for billing for the use of broadcast information or broadcast-related information H04H60/21
• CPC Class Codes: H04N 21/26613 : for generating or managing keys in general key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04
• CPC Class Codes: H04N 21/4627 : Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/6332 : directed to client
• CPC Class Codes: H04N 21/6377 : directed to server one-way streaming services wherein the source is controlled by the destination H04L65/613
• CPC Class Codes: H04N 21/835 : Generation of protective data, e.g. certificates protecting software against unauthorised usage in a vending or licensing environment G06F21/10
• CPC Class Codes: H04N 21/8355 : involving usage data, e.g. number of copies or viewings allowed
• CPC Class Codes: H04N 21/83555 : using a structured language for describing usage rules of the content, e.g. REL
• CPC Class Codes: H04N 7/16 : Analogue secrecy systems; Analogue subscription systems
• CPC Class Codes: Y10S 707/99939 : Privileged access
• CPC Class Codes: Y10S 707/99945 : Object-oriented database structure processing

Abstract

A system for controlling the distribution and use of digital works using digital tickets. In the present invention, a “digital ticket” is used to entitle the ticket holder to exercise some usage right with respect to a digital work. Usage rights are used to define how a digital work may be used or distributed. Each usage right may specify a digital ticket which must be present before the right may be exercised. Digital works are stored in repositories which enforce a digital works usage rights. Each repository has a “generic ticket agent” which punches tickets. In some instances only the generic ticket agent is necessary. In other instances, punching by a “special ticket agent” residing on another repository may be needed.

Claims

1. A method for enforcing execution of executable code in accordance with usage rights, said method comprising;

receiving a request to execute the executable code;

determining at a non-centralized repository, based on usage rights associated with the executable code, whether the request should be granted, the usage rights including a manner of indicating a specific instance of how the executable code can be executed; and

executing the executable code on a computing device in accordance with the manner of use if the result of said determining step is that the request should be granted,

wherein said request is generated by a requester device, said executing step is accomplished by a remote server that is remote from said requester device and said determining step is accomplished by a processing server comprising the non-centralized repository,

said requester device and said remote server communicate using a transmission protocol and wherein said executing step comprises executing the executable code in an address space of the remote server and permitting the requester device to access the executable code only through the transmission protocol,

said requesting step and said executing step are accomplished through an external interface of said remote server which provides for network connectivity between the remote server and the requester device using the transmission protocol,

the executable code comprises plural components, each of the components having a usage right associated therewith, said determining step comprising determining based on usage right associated with at least one component, whether the request should be granted, and said executing step comprising executing the component if the result of said determining step is that the request should be granted,

said determining step comprises accomplishing one or more transactions with respect to the executable code, and

said transactions in said accomplishing step comprise copy, transfer, loan, play, print, backup, restore, delete, directory, folder, extract, embed, edit, authorization, install, and uninstall transactions.

2. A method as recited in claim 1, wherein the request specifies a manner of use indicating a specific instance of how the executable code is to be executed and said determining step comprises determining whether the manner of use specified in the request corresponds to a manner of use included in the usage rights.

3. A method as recited in claim 1, wherein one or more of said requester device, said remote servers, and said processing server are the same device.

4. A method as recited in claim 1, wherein one or more of said requester device, said remote server, and said processing server are separate devices.

5. A method as recited in claim 1, wherein the usage rights includes at least one condition that must be satisfied to exercise the manner of use.

6. A method as recited in claim 5, wherein said determining step comprises determining if the at least one condition is satisfied.

7. A method as recited in claim 1, wherein the executable code is a database search program and wherein said executing step comprises searching a database.

8. A method as recited in claim 1, wherein said executing step comprises executing at least a portion of the executable code on an execution device and further comprising removing the contents of the executable code from the memory of the execution device after said executing step.

9. A method as recited in claim 1, wherein the executable code is a software program.

10. A method as recited in claim 1, wherein the executable code is binary code.

11. A method as recited in claim 1, wherein said executable code comprises plural distinguishable parts.

12. A method as recited in claim 11, wherein said distinguishable parts are stored in different memory locations.

13. A method as recited in claim 12, wherein said distinguishable parts are stored in different devices.

14. A method as recited in claim 11, wherein at least some of said distinguishable parts have distinct usage rights associated therewith.

15. A method as recited in claim 1, further comprising creating the usage rights using a usage rights language.

16. A method as recited in claim 1, wherein the usage rights are expressed by a grammar.

17. A method as recited in claim 1, wherein the usage rights are stored in one or more non-centralized repositories.

18. A method as recited in claim 1, wherein said determining step comprises accomplishing a session initiation transaction.

19. A method as recited in claim 18, wherein said determining step further comprises establishing a secure and trusted communication link.

20. A method as recited in claim 1, wherein the usage rights are stored on a removable storage device.

21. A method as recited in claim 1, wherein digital content comprises the executable code is stored on a removable storage device.

22. A method as recited in claim 17, wherein one or more of the non-centralized repositories are parts or a same repository.

23. A method as recited in claim 17, wherein one or more of the non-centralized repositories are parts of different repositories.

24. A computer program product including one or more computer-readable instructions embedded in a computer-readable medium for causing one or more computer processors to perform the steps recited in claim 1.

25. A system for enforcing execution of executable code in accordance with usage rights, said method comprising;

means for receiving a request to execute the executable code;

means for determining at a non-centralized repository, based on usage rights associated with the executable code, whether the request should be granted, the usage rights including a manner of indicating a specific instance of how the executable code can be executed; and

means for executing the executable code on a computing device in accordance with the manner of use if the result of said means for determining is that the request should be granted,

wherein said request is generated by a requester device, said means for executing is accomplished by a remote server that is remote from said requester device and said means for determining is accomplished by a processing server comprising the non-centralized repository,

said requester device and said remote server communicate using a transmission protocol and wherein said means for executing comprises means for executing the executable code in an address space of the remote server and permitting the requester device to access the executable code only through the transmission protocol,

said means for requesting and said means for executing are accomplished through an external interface of said remote server which provides for network connectivity between the remote server and the requester device using the transmission protocol,

the executable code comprises plural components, each of the components having a usage right associated therewith, said means for determining comprising means for determining based on usage right associated with at least one component, whether the request should be granted, and said means for executing comprising means for executing the component if the result of said means for determining is that the request should be granted,

said means for determining includes means for accomplishing one or more transactions with respect to the executable code, and

said transactions in said means for accomplishing comprise copy, transfer, loan, play, print, backup, restore, delete, directory, folder, extract, embed, edit, authorization, install, and uninstall transactions.

26. The system as recited in claim 25, wherein the request specifies a manner of use indicating a specific instance of how the executable code is to be executed and said means for determining comprises means for determining whether the manner of use specified in the request corresponds to a manner of use included in the usage rights.

27. The system as recited in claim 25, wherein one or more of said requester device, said remote server, and said processing server are the same device.

28. The system as recited in claim 25, wherein one or more of said requester device, said remote server, and said processing server are separate devices.

29. The system as recited in claim 25, wherein the usage rights includes at least one condition that must be satisfied to exercise the manner of use.

30. The system as recited in claim 29, wherein said means for determining comprises means for determining if the at least one condition is satisfied.

31. The system as recited in claim 25, wherein the executable code is a database search program and wherein said means for executing comprises means for searching a database.

32. The system as recited in claim 25, wherein said means for executing comprises means for executing at least a portion of the executable code on an execution device, and the system further comprises means for removing the contents of the executable code from the memory of the execution device after said means for executing executes the portion of the executable code.

33. The system as recited in claim 25, wherein the executable code is a software program.

34. The system as recited in claim 25, wherein the executable code is binary code.

35. The system as recited in claim 25, wherein said executable code comprises plural distinguishable parts.

36. The system as recited in claim 35, wherein said distinguishable parts are stored in different memory locations.

37. The system as recited in claim 36, wherein said distinguishable parts are stored in different devices.

38. The system as recited in claim 35, wherein at least some of said distinguishable parts have distinct usage rights associated therewith.

39. The system as recited in claim 25, further comprising means for creating the usage rights using a usage rights language.

40. The system as recited in claim 25, wherein the usage rights are expressed by a grammar.

41. The system as recited in claim 25, wherein the usage rights are stored in one or more non-centralized repositories.

42. The system as recited in claim 25, wherein said means for determining comprises means for accomplishing a session initiation transaction.

43. The system as recited in claim 42, wherein said means for determining further comprises means for establishing a secure and trusted communication link.

44. The system as recited in claim 25, wherein the usage rights are stored on a removable storage device.

45. The system as recited in claim 25, wherein digital content comprises the executable code is stored on a removable storage device.

46. The system as recited in claim 41, wherein one or more of the non-centralized repositories are parts of a same repository.

47. The system as recited in claim 41, wherein one or more of the non-centralized repositories are parts of different repositories.