Binding digital content to a portable storage device or the like in a digital rights management (DRM) system

• US 7,010,808 B1
• Filed: 08/25/2000
• Issued: 03/07/2006
• Est. Priority Date: 08/25/2000
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Leung, Yuen Yu, Peinado, Marcus, Strom, Clifford P.
• Primary Examiner(s): Song, Hosuk
• Assistant Examiner(s): Dada, Beemnet W
• Application Number:
  US09/645,887
• Time in Patent Office: 2,020 Days
• Field of Search: 713/172, 713/193, 380277-285, 380/259, 380/201, 380/286, 705/59, 705/56, 726/26, 726/30, 726/31
• US Class Current: 726/26
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04N 21/41407 embedded in a portable device, e.g. video client on a mobile phone, PDA, laptop constructional details of equipment or arrangements specially adapted for portable computer application G06F1/1626; arrangements specially adapted for mobile receivers in broadcast systems H04H20/57
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/4627 Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08

Abstract

Digital content is rendered on a device by transferring the content to the device and obtaining a digital license corresponding to the content. A sub-license corresponding to and based on the obtained license is composed and transferred to the device, and the content is rendered on the device only in accordance with the terms of the sub-license. The content is encrypted and decryptable according to a content key, and the sub-license includes the content key encrypted and decryptable according to a secret. The sub-license also includes indexing information identifying the secret to the device. The indexing information in the sub-license is obtained to identify the secret, and the secret is acquired based at least in part on the indexing information. The secret is then applied to the encrypted content key to decrypt and obtain the content key, and the obtained content key is applied to the encrypted content to decrypt and obtain the content. To compose the sub-license and also to render the content, the secret is derived by obtaining a device identifier, acquiring a super-secret, and applying the obtained device identifier and super-secret to a function to derive the secret.

Claims

1. A method for enabling the rendering of digital content on a device, the method comprising:

transferring the content to the device;

obtaining a digital license corresponding to the content;

composing a sub-license corresponding to and based on the obtained license and transferring the composed sub-license to the device, to enable rendering of the content on the device only in accordance with the terms of the sub-license on the device, wherein the composed sub-license is transferred to the device after transferring the content to the device,

wherein the content is encrypted and decryptable according to a content key and wherein the license includes the content key encrypted into a form un-decryptable by the device, the composing of the sub-license comprising re-encrypting the content key into a form that is decryptable by the device and placing the re-encrypted content key in the sub-license, and

wherein the composing of the sub-license further comprises placing indexing information in the sub-license, the indexing information identifying a secret to the device that the device employs to decrypt the encrypted content key.

2. The method of claim 1 further comprising, prior to composing the sub-license and transferring the composed sub-license to the device, checking the obtained license to determine that such license permits issuance of the sub-license to the device.

3. The method of claim 1 further comprising:

coupling the device to a computer;

placing the obtained license on the computer; and

transferring the composed sub-license from the computer to the device.

4. The method of claim 3 wherein transferring the content to the device comprises placing the content on the computer and then transferring the content from the computer to the device.

5. The method of claim 1 wherein the license is issued to a computer having a public key (PU) and a private key (PR) corresponding to (PU), and wherein the content key in the license is encrypted according to (PU) (PU(content key)), the re-encrypting of the content key comprising:

obtaining (PU(content key)) from the license;

applying (PR) to (PU(content key)) to obtain the content key; and

encrypting the content key according to a secret acquirable by the device.

6. The method of claim 5 wherein encrypting the content key comprises encrypting the content key according to a secret comprising a symmetric key.

7. The method of claim 1 wherein the composing of the sub-license further comprises placing a rights description in the sub-license, the rights description describing rights conferred by the license, the device rendering the corresponding content only in accordance with the rights description.

8. The method of claim 1 wherein the composing of the sub-license further comprises placing a signature in the sub-license, the signature verifying the sub-license.

9. A method for rendering digital content on a device, the content being encrypted and decryptable according to a content key, the content key being encrypted and decryptable according to a secret, the device having an identifier, the method comprising:

obtaining the encrypted content key from a digital license corresponding to the content;

deriving the secret by;

obtaining the device identifier;

acquiring a super-secret; and

applying the obtained device identifier and super-secret to a function to derive the secret;

(SECRET)=function (device identifier, (SUPER-SECRET));

decrypting the content key according to the derived secret;

decrypting the content according to the derived content key; and

rendering the decrypted content,

wherein the super-secret is identified by indexing information in the license, the method further comprising obtaining the indexing information from the license and thereby identifying the super-secret by way of the indexing information.

10. The method of claim 9 wherein the content has a content ID, the method comprising deriving a secret by:

obtaining the content ID of the content;

obtaining the device identifier;

acquiring a super-secret; and

applying the obtained content ID, device identifier, and super-secret to a function to derive the secret;

(SECRET)=function (content ID, device identifier, (SUPER-SECRET)).

11. The method of claim 9 wherein the super-secret is identified by an indexing value j, the indexing value j being located in the license, and wherein acquiring the super-secret comprises:

obtaining a super-super-secret;

obtaining the indexing value j from the license and thereby identifying the super-secret by way of the indexing value j; and

applying the obtained super-super-secret and the indexing value j to a function to derive the super-secret identified by the indexing value j;

(SUPER-SECRET)=function ((SUPER-SUPER-SECRET), j).

12. The method of claim 11 wherein the super-super-secret is identified by an indexing value k, the indexing value k being located in the license, and wherein acquiring the super-secret comprises:

obtaining the indexing value k from the license and thereby identifying the super-super-secret by way of the indexing value k;

obtaining the super-super-secret having the indexing value k;

obtaining the indexing value j from the license and thereby identifying the super-secret by way of the indexing value j; and

applying the obtained super-super-secret having the indexing value k and the indexing values j, k to a function to derive the super-secret identified by the indexing value j;

(SUPER-SECRET)=function ((SUPER-SUPER-SECRET), j, k).

13. A computer-readable medium having computer-executable instructions thereon for rendering digital content on a device, the instructions comprising modules including:

a first module for transferring the content to the device;

a second module for obtaining a digital license corresponding to the content; and

a third module for composing a sub-license corresponding to and based on the obtained license and transferring the composed sub-license to the device;

the content on the device being rendered only in accordance with the terms of the sub-license on the device after the content is loaded onto the device,

wherein the content is encrypted and decryptable according to a content key and wherein the license includes the content key encrypted into a form un-decryptable by the device, the third module composing the sub-license by re-encrypting the content key into a form that is decryptable by the device and placing the re-encrypted content key in the sub-license, and

wherein the third module places indexing information in the sub-license, the indexing information identifying a secret to the device that the device employs to decrypt the encrypted content key.

14. The medium of claim 13 further comprising, a fourth module for, prior to composing the sub-license and transferring the composed sub-license to the device, checking the obtained license to determine that such license permits issuance of the sub-license to the device.

15. The medium of claim 13 wherein the device is coupled to a computer, the second module placing the obtained license on the computer and the third module transferring the composed sub-license from the computer to the device.

16. The medium of claim 15 wherein the first module places the content on the computer and then transfers the content from the computer to the device.

17. The medium of claim 13 wherein the license is issued to a computer having a public key (PU) and a private key (PR) corresponding to (PU), and wherein the content key in the license is encrypted according to (PU) (PU(content key)), the third module re-encrypting the content key by:

obtaining (PU(content key)) from the license;

applying (PR) to (PU(content key)) to obtain the content key; and

encrypting the content key according to a secret acquirable by the device.

18. The medium of claim 17 wherein the third module encrypts the content key according to a secret comprising a symmetric key.

19. The medium of claim 13 wherein the third module places a rights description in the sub-license, the rights description describing rights conferred by the license, the device rendering the corresponding content only in accordance with the rights description.

20. The medium of claim 13 wherein the third module places a signature in the sub-license, the signature verifying the sub-license.

21. A computer-readable medium having computer-executable instructions thereon for rendering digital content on a device, the content being encrypted and decryptable according to a content key, the content key being encrypted and decryptable according to a secret, the device having an identifier, the instructions comprising modules including:

a first module for obtaining the encrypted content key from a digital license corresponding to the content;

a second module for deriving the secret by;

obtaining the device identifier;

acquiring a super-secret; and

applying the obtained device identifier and super-secret to a function to derive the secret;

(SECRET)=function (device identifier, (SUPER-SECRET));

a third module for decrypting the content key according to the derived secret;

a fourth module for decrypting the content according to the derived content key; and

a fifth module for rendering the decrypted content,

wherein the super-secret is identified by indexing information in the license, the method further comprising a sixth module for obtaining the indexing information from the license and thereby identifying the super-secret by way of the indexing information.

22. The medium of claim 21 wherein the content has a content ID, the first module deriving a secret by:

obtaining the content ID of the content;

obtaining the device identifier;

acquiring a super-secret; and

applying the obtained content ID, device identifier, and super-secret to a function to derive the secret;

(SECRET)=function (content ID, device identifier, (SUPER-SECRET)).

23. The method of claim 21 wherein the super-secret is identified by an indexing value j, the indexing value j being located in the license, and wherein the first module acquires the super-secret by:

obtaining a super-super-secret;

obtaining the indexing value j from the license and thereby identifying the super-secret by way of the indexing value j; and

applying the obtained super-super-secret and the indexing value j to a function to derive the super-secret identified by the indexing value j;

(SUPER-SECRET)=function ((SUPER-SUPER-SECRET), j).

24. The method of claim 23 wherein the super-super-secret is identified by an indexing value k, the indexing value k being located in the license, and wherein the first module acquires the super-secret by:

obtaining the indexing value k from the license and thereby identifying the super-super-secret by way of the indexing value k;

obtaining the super-super-secret having the indexing value k;

obtaining the indexing value j from the license and thereby identifying the super-secret by way of the indexing value j; and

applying the obtained super-super-secret having the indexing value k and the indexing values j, k to a function to derive the super-secret identified by the indexing value j;

(SUPER-SECRET)=function ((SUPER-SUPER-SECRET), j, k).