Server for an electronic distribution system and method of operating same

• US 7,047,411 B1
• Filed: 06/27/2000
• Issued: 05/16/2006
• Est. Priority Date: 12/17/1999
• Status: Expired due to Term

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: DeMello, Marco A., Zeman, Pavel, Krishnaswamy, Vinay, Byrum, Frank D.
• Primary Examiner(s): Peeso, Thomas R.
• Application Number:
  US09/604,540
• Time in Patent Office: 2,149 Days
• Field of Search: 713/176, 713/164, 713/170, 713/179, 713/182, 713/189, 713/193, 713/200, 713/201
• US Class Current: 713/176
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data

Abstract

A server architecture for a digital rights management system that distributes and protects rights in content. The server architecture includes a retail site which sells content items to consumers, a fulfillment site which provides to consumers the content items sold by the retail site, and an activation site which enables consumer reading devices to use content items having an enhanced level of copy protection. Each retail site is equipped with a URL encryption object, which encrypts, according to a secret symmetric key shared between the retail site and the fulfillment site, information that is needed by the fulfillment site to process an order for content sold by the retail site. Upon selling a content items, the retail site transmits to the purchase a web page having a link to a URL comprising the address of the fulfillment site and a parameter having the encrypted information. Upon the following the link, the fulfillment site downloads the ordered content to the consumer preparing the content if necessary in accordance with the type of security to be carried with the content. The fulfillment site includes an asynchronous fulfillment pipeline which logs information about processed transactions using a store-and-forward messaging service. The fulfillment site may be implemented as several server devices, each having a cache which stores frequently downloaded content items, in which case the asynchronous fulfillment pipeline may also be used to invalidate the cache if a change is made at one server that affects the cached content items. An activation site provides an activation certificate and a secure repository executable to consumer content-rendering devices which enable those content rendering devices to render content having an enhanced level of copy-resistance. The activation site “activates” client-reading devices in a way that binds them to a persona, and limits the number of devices that may be activated for a particular persona, or the rate at which such devices may be activated for a particular persona.

Claims

1. A method of using a first computing device to provide a content item to a second computing device:

receiving, at said first computing device from said second computing device via a network, a communication, said communication comprising encrypted information, said communication being initiated at said second computing device based on a universal record locator, said universal record locator comprising an address of said first computing device and said encrypted information;

using a secret to decrypt at least some of said encrypted information, said secret being shared between said first computing device and a third computing device; and

providing said electronic content item to said second computing devices.

2. The method of claim 1, further comprising the act of including at least some of said decrypted information in said content item.

3. The method of claim 2, wherein said decrypted information includes personal information pertaining to a user associated with said second computing device, and wherein the at least some decrypted information included in said content item comprises said personal information.

4. The method of claim 3, wherein said personal information comprises a name, a credit card number, or a receipt number.

5. The method of claim 3, further comprising sealing at least some data contained in said content item using said personal information.

6. The method of claim 1, wherein said decrypted information comprises a first cryptographic key, wherein said content item comprises a second cryptographic key and content decryptable with said second cryptographic key, and wherein said method further comprises the acts of:

encrypting said second cryptographic key with said first cryptographic key; and

including the encrypted second cryptographic key in said content item.

7. The method of claim 1, wherein said encrypted information includes a timestamp, and wherein said method further comprises the act of determining, based on said timestamp, that a time within which said content item may be provided has not expired.

8. The method of claim 1, wherein said encrypted information is provided together with a hash of said encrypted information, wherein said hash is computed prior to said information being encrypted, and wherein said method further comprises the act of determining, based on said hash, whether said encrypted information has been tampered with.

9. The method of claim 1, further comprising the act of including in said content item an electronically-enforceable license to use said content item.

10. The method of claim 1, wherein said universal record locator is provided to said second computing device by said third computing device in the form of a link on a web page, and wherein said communication is initiated by a user of said second computing device following said link.

11. The method of claim 1, wherein said secret comprises a cryptographic key.

12. The method of claim 11, wherein said cryptographic key comprises a symmetric key.

13. A computer-readable medium having computer-executable instructions to perform the method of claim 1.

14. A method of providing electronic content, said method comprising the acts of:

receiving, via a network, a communication, said communication comprising a universal record locator and originating at a first computing device, said universal record locator having information relating to an electronic content item, said information being included in said universal record locator in an encrypted form;

decrypting said encrypted information; and

providing said electronic content item to said first computing device based at least in part on at least some of said information.

15. The method of claim 14, wherein said electronic content item comprises textual content.

16. The method of claim 14, wherein said electronic content item comprises multimedia content.

17. The method of claim 14, wherein said universal record locator is provided to said first computing device by a seller of said electronic content item.

18. The method of claim 14, wherein said universal record locator is provided to said first computing device in the form of a link on a web page, said web page being provided to said first computing device by a second computing device remote from said first computing device.

19. The method of claim 14, wherein said information comprises personal information pertaining to the purchaser of said electronic content item, and wherein said electronic content item includes said personal information.

20. The method of claim 19, wherein said personal information comprises a name, a credit card number, or a receipt number.

21. The method of claim 19, further comprising the acts of:

retrieving an unindividualized content item from storage, said content item comprising;

content in an encrypted form so as to be decryptable by a first cryptographic key;

meta-data; and

said first cryptographic key sealed with said meta-data; and

wherein said method further comprises the acts of;

unsealing said first cryptographic key;

adding said personal information to said meta-data to produce new meta-data;

re-sealing said first cryptographic key with said new meta-data to produce an individualized content item including the new meta-data and the re-sealed key;

wherein said content item provided to said first computing device comprises said individualized content item.

22. The method of claim 14, wherein said information comprises a second cryptographic key associated with a purchaser of said content item, wherein said content item comprises content in an encrypted form so as to be decryptable by a first cryptographic key, and wherein said method further comprises the acts of:

encrypting said first cryptographic key with said second cryptographic key; and

including the resulting encrypted first cryptographic key in said content item.

23. The method of claim 14, wherein said information comprises an identification of said content item, and wherein said providing act comprises using said identification of said content item to retrieve said content item from among plural content items stored in a storage device.

24. The method of claim 14, wherein said content item comprises non-encrypted content.

25. The method of claim 14, further comprising the act of including a license in said electronic content item.

26. A computer-readable medium having computer-executable instructions to perform the method of claim 14.

27. A method of providing an electronic content item, said method comprising the acts of:

receiving, from a first computing device, a first cryptographic key;

retrieving said electronic content item from storage, said electronic content item comprising encrypted content decryptable with said second cryptographic key;

encrypting said second cryptographic key with said first cryptographic key to produce an encrypted cryptographic key;

including said encrypted cryptographic key in the retrieved electronic content item; and

transmitting, to said first computing device, the retrieved electronic content item including said encrypted cryptographic key.

28. The method of claim 27, wherein said first cryptographic key is the public key of an asymmetric key pair associated with said first computing device.

29. The method of claim 27, further comprising the act of sealing said encrypted cryptographic key.

30. The method of claim 29, wherein the retrieved electronic content item includes meta-data, and wherein said sealing act comprises sealing the encrypted cryptographic key with said meta-data.

31. The method of claim 30, further comprising the act of adding personal information pertaining to a user to said meta-data to produce new meta-data, and wherein said sealing act comprises sealing the encrypted content with the new metadata.

32. The method of claim 31, wherein said personal information comprises a name, a credit card number, or a receipt number.

33. The method of claim 27, wherein said first cryptographic key is received in the form of encrypted data, and wherein said method comprises the act of decrypting said encrypted data to obtain said first cryptographic key.

34. The method of claim 33, wherein said encrypted data is included in a universal record locator on said first computing device, and wherein said receiving act is performed as the result of an operator on said first computing device navigating to said universal record locator.

35. The method of claim 34, wherein said universal record locator comprises a POST request.

36. The method of claim 34, wherein said universal record locator comprises a GET request.

37. A computer-readable medium having computer-executable instructions to perform the method of claim 27.

38. A method of preventing unauthorized distribution of content, said method comprising the acts of:

receiving a first communication from a first computing device, said first communication comprising first encrypted information, said first communication being initiated at said first computing device based on a first universal record locator, said first universal record locator comprising an address of said first computing device and said first encrypted information, said first encrypted information comprising first time information;

decrypting said first encrypted information to retrieve said first time information;

determining, based on said first time information, that a time limit has not expired; and

providing a first electronic content item to said first computing device.

39. The method of claim 38, further comprising the acts of:

receiving a second communication from a second computing device, said second communication comprising second encrypted information, said second communication being initiated at said second computing device based on a second universal record locator, said second universal record locator comprising an address of said first computing device and said second encrypted information, said second encrypted information comprising second time information and an identification of a second electronic content item;

decrypting said second encrypted information to retrieve said second time information;

determining, based on said second time information, that a time limit has expired; and

at least temporarily denying said second electronic content item to said second computing device.

40. The method of claim 38, wherein said electronic content item comprises textual information.

41. The method of claim 38, wherein said electronic content item comprises multimedia works.

42. The method of claim 38, wherein said first time information comprises a timestamp, and wherein said time limit comprises a fixed amount of time subsequent to the time specified in said timestamp.

43. The method of claim 42, wherein said timestamp comprises the time at which said first encrypted information was encrypted.

44. The method of claim 38, wherein said first universal record locator is provided to said first computing device by a second computing device in the form of a link on a web page, and wherein said first communication is initiated by a user associated with said first computing device following said link.

45. A computer-readable medium having computer-executable instructions to perform the method of claim 38.

46. A method of electronic distribution, said method comprising the acts of:

a first party receiving an order for an item from a third party;

said first party creating information relating to said item;

said first party encrypting said information with a secret to produce encrypted information, said secret being shared between said first party and a second party;

.

said first party transmitting to said third party a universal record locator, said universal record locator comprising said encrypted information and a network address of a server associated with said second party;

said second party receiving a transmission comprising said encrypted information, said transmission being actuated by said third party based on said universal record locator;

said second party using said secret to decrypt said encrypted information; and

said second party performing at least one action in furtherance of fulfilling said order based on said decrypted information.

47. The method of claim 46, wherein said first party sells said item and wherein said second party provides, to said third party, said item sold by said first party.

48. The method of claim 46, wherein said item comprises electronic content, and wherein said at least one action in furtherance of fulfilling said order comprises transmitting said electronic content to said third party.

49. The method of claim 46, wherein said secret comprises a cryptographic key.

50. A method of providing content item individualized for a user, said method comprising the acts of:

retrieving, from a storage device, a content item, said content item comprising;

meta-data, a decryption key sealed with said meta-data, and encrypted content decryptable with said decryption key;

unsealing said decryption key;

adding at least some personal information pertaining said user to said meta-data to produce new meta-data; and

resealing said decryption key with said new meta-data.

51. The method of claim 50, wherein said personal information comprises a name, a credit card number, or a receipt number.

52. The method of claim 50, further comprising the acts of:

receiving encrypted data comprising said personal information; and

decrypting said encrypted data to obtain said personal information.

53. The method of claim 50, wherein said decryption key comprises a symmetric key.

54. A computer-readable medium having computer-executable instructions to perform the method of claim 50.

55. A download server adapted to deliver electronic content to client devices, comprising:

a validation module that validates incoming requests for the electronic content;

a content store module that determines a location on the download server of the requested electronic content;

a security level determination module that determines the level of protection the electronic content is to receive; and

a sealing module that seals the electronic content in accordance with a determined level of security for downloading to the client devices.

56. The download server of claim 55, further comprising:

a licensing module that validates the credentials of a user downloading the electronic content and generates a license to the user granting rights with respect to the electronic content.

57. The download server of claim 55, wherein said level of security is selected from the group consisting of:

a first level, wherein said electronic content is not encrypted;

a second level, wherein said electronic content includes;

encrypted content, a decryption key which decrypts said encrypted content, and meta-data, said decryption key being sealed with said meta-data;

a third level, wherein said electronic content includes;

encrypted content, a decryption key which decrypts said encrypted content, and meta-data, said decryption key being sealed with said meta-data, said meta-data including personal information of a user;

a fourth level, wherein said electronic content includes a digital signature; and

a fifth level, wherein said electronic content includes;

encrypted content, a decryption key which decrypts said encrypted content, and meta-data, said decryption key being encrypted with a first cryptographic key associated with a user, the encrypted decryption key being sealed said meta-data.

58. The download server of claim 55, wherein said incoming requests for electronic content comprise at least some encrypted information, and wherein said validation module decrypts said encrypted information.

59. The download server of claim 58, wherein said incoming request is based on a universal record locator, said universal record locator comprising said at least some encrypted information and an address of said download server.

60. A method of preventing unauthorized distribution of content, said method comprising the acts of:

receiving a first communication from a first computing device, said first communication comprising first encrypted information, said first communication being initiated at said first computing device based on a first HTTP request, said first HTTP request comprising an address of said first computing device and said first encrypted information, said HTTP request further comprising a hash of said first encrypted information computed prior to the encryption of said encrypted information;

decrypting said first encrypted information;

determining, based on a comparision of the computed hash with the decrypted information that said encrypted information has not been tampered with; and

providing a first electronic content item to said first computing device.

61. The method of claim 60, further comprising the acts of:

receiving a second communication from a second computing device, said second communication comprising second encrypted information, said second communication being initiated at said second computing device based on a second HTTP request, said second HTTP request comprising an address of said first computing device and said second encrypted information, said second HTTP request further comprising a hash of the second encrypted information computed prior to the encryption of the second information, said second encrypted information comprising second time information and an identification of a second electronic content item;

decrypting said second encrypted information;

determining, based on a comparison of the second decrypted information with the hash of the second information that said second encrypted information has been tampered with; and

at least temporarily denying said second electronic content item to said second computing device.

62. The method of claim 60, wherein said HTTP request comprises a POST request.

63. The method of claim 60, wherein said HTTP request comprises a GET request.