Method for obtaining a black box for performing decryption and encryption functions in a digital rights management (DRM) system

• US 7,051,005 B1
• Filed: 01/13/2000
• Issued: 05/23/2006
• Est. Priority Date: 03/27/1999
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Jones, Thomas C., England, Paul, Peinado, Marcus, Blinn, Arnold N., Jakubowski, Mariusz H., Bell, Jeffrey R. C., Abburi, Rajasekhar, Manferdelli, John L., Yu, Hai Ying (Vincent), Venkatesan, Ramaranthnam
• Primary Examiner(s): FADOK, MARK A
• Application Number:
  US09/482,840
• Time in Patent Office: 2,322 Days
• Field of Search: 705/26, 705/44, 705/51, 705/59, 705/54, 705/57, 705/27, 709/229, 713/202
• US Class Current: 705/57
• CPC Class Codes: G06F 21/1011 to devices
• CPC Class Codes: G06F 21/109 by using specially-adapted hardware at the client
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/84 output devices, e.g. displays or monitors
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G06Q 50/188 Electronic negotiation
• CPC Class Codes: G07F 9/002 Vending machines being part of a centrally controlled network of vending machines
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

A digital rights management (DRM) system operates on a computing device and requires a black box for performing decryption and encryption functions. To obtain the black box from a black box server, the DRM system requests such black box from such black box server. The black box server in response generates the black box, where such black box is unique and has a public/private key pair. The black box server then delivers the generated black box to the DRM system and the DRM system installs the delivered black box in such DRM system.

Claims

1. In combination with a digital rights management (DRM) system operating on a computing device, the DRM system requiring a black box for performing decryption and encryption functions, a method of obtaining the black box by the DRM system from a black box server, the method comprising:

requesting, by the DRM system, a first black box from the black box, server;

generating, by the black box server, the first black box, such generated first black box being unique and having a public/private key pair and electronic code for employing the key pair within the DRM system on the computing device;

delivering, by the black box server, the generated first black box to the DRM system; and

installing, by the DRM system, the delivered first black box in such DRM system,

the DRM system further providing code for periodically determining whether the first black box is current or not current and for upgrading at least the public/private key pair in the first black box from the black box server to result in a second black box when the first black box is not current.

2. The method of claim 1 wherein the DRM system has a previously installed black box prior to the requesting step, the method further comprising determining prior to the requesting step that the previously installed black box is non-unique.

3. The method of claim 1 wherein the DRM system has a previously installed black box prior to the requesting step, the method further comprising determining prior the requesting step that the previously installed black box is not current.

4. The method of claim 1 wherein the requesting step comprises requesting the black box by way of a network connection to the black box server.

5. The method of claim 4 wherein the requesting step comprises requesting the black box by way of an Internet connection to the black box server.

6. The method of claim 1 wherein the DRM system has a first previously installed black box prior to the requesting step, the first previously installed black box having a public/private key pair different from the public/private key pair of the generated black box, and wherein the generating step includes providing the generated black box with the public/private key pair of the first previously installed black box.

7. The method of claim 6 wherein the DRM system had a second previously installed black box prior to having the first previously installed black box, the second previously installed black box having a public/private key pair different from the public/private key pair of the first previously installed black box and also different from the public/private key pair of the generated black box, and wherein the generating step further includes providing the generated black box with the public/private key pair of the second previously installed black box.

8. The method of claim 1 wherein the generating step includes providing the generated black box with an identified indicative of currency.

9. The method of claim 8 wherein the generating stop includes providing the generated black box with a version number.

10. The method of claim 1 wherein the generating step includes providing the generated black box with a digital certificate.

11. The method of claim 10 wherein the generating step includes providing the generated black box with a digital certificate proffering that the generated black box should be trusted.

12. The method of claim 1 wherein the generating step includes encrypting at least a portion of the private key of the generated black box according to a code-based encryption technique.

13. The method of claim 12 wherein thc generating step includes encrypting at least a portion of the private key of the generated black box according to software code associated with the generated black box, whereby adulteration of such software code prevents such private key from being decrypted.

14. The method of claim 1 wherein the generating step includes associating the generated black box with the DRM system/computing device, whereby the generated black box is inoperable on another DRM system/computing device.

15. The method of claim 14 wherein the requesting step includes providing information unique to the DRM system/computing device, and wherein the generating step includes generating the black box based in part on the provided information, whereby the generated black box can recognize whether it is intended for the DRM system/computing device upon which it is installed.

16. The method of claim 14 wherein the DRM system computing device is a first DRM system/computing device, wherein the generating step includes associating the generated black box with the first DRM system/computing device and also with a second DRM system/computing device, whereby the generated black box is inoperable on another DRM system/computing device which is not the first or second DRM system/computing device.

17. In combination with a digital rights management (DRM) system operating on a computing device, the DRM system requiring a black box for performing description and encryption functions, a method of obtaining the black box by the DRM system, the method comprising:

requesting a first black box from a black box server, the black box server thereafter generating the first black box, such first generated black box being unique and having a public/private key pair and electronic code for employing the key pair within the DRM system on the computing device;

receiving the generated first black box from the black box server; and

installing the received first black box in such DRM system,

the DRM system further providing code for periodically determining whether the first black box is current or not current and for upgrading at least the public/private key pair in the first black box from the black box server to result in a second black box when the first black box is not current.

18. The method of claim 17 wherein the DRM system has a previously installed black box prior to the requesting step, the method further comprising determining prior to the requesting step that the previously installed black box is non-unique.

19. The method Of claim 17 wherein the DRM system has a previously installed black box prior to the requesting step, the method further comprising determining prior to the requesting step that the previously installed black box is not current.

20. The method of claim 17 wherein the requesting step comprises requesting the black box by way of a network connection to the black box server.

21. The method of claim 20 wherein the requesting step comprises requesting the black box by way of an Internet connection to the black box server.

22. The method of claim 17 wherein the DRM system has a first previously installed black box prior to the requesting step, the first previously installed black box having a public/private key pair different from the public/private key pair of the generated black box, and wherein the requesting step includes providing the public/private key pair of the first previously installed black box to the black box server, whereby the generated black box is provided with the public/private key pair of the first previously installed black box.

23. The method of claim 22 wherein the, DRM system haid a second previously installed black box prior to having the first previously installed black box, the second previously installed black box having a public/private key pair different from the public/private key pair of the first previously installed black box and also different from the public/private key pair of the generated black box, and wherein the requesting step further includes providing the public/private key pair of the second previously installed black box to the black box server, whereby the generated black box is also provided with the public/private key pair of the second previously installed black box.

24. The method of claim 17 wherein the received black box includes an identifier indicative of currency.

25. The method of claim 24 wherein the received black box includes a version number.

26. The method of claim 17 wherein the received black box includes a digital certificate.

27. The method of claim 26 wherein the received black box includes a digital certificate proffering that such received black box should be trusted.

28. The method of claim 17 wherein at least a portion of the private key of the received black box is encrypted according to a code-based encryption technique.

29. The method of claim 28 at least a portion of the private key of the received black box is encrypted according to software code associated with such received black box, whereby adulteration of such software code prevents such private key from being decrypted.

30. The method of claim 17 wherein the received black box is associated with the DRM system/computing device, whereby such received black box is inoperable on another DRM system/computing device.

31. The method of claim 30 wherein the requesting step includes providing information unique to the DRM system/computing device, and wherein the received black box was generated based in part on the provided information, whereby the received black box can recognize whether it is intended for the DRM system/computing device upon which it is installed.

32. Thc method of claim 30 wherein the DRM system/computing device is a first DRM system/computing device, wherein the received black box is associated with the first DRM system/computing device and also with a second DRM system/computing device, whereby the received black box is inoperable on another DRM system of computing device which is not the first or second DRM system/computing device.

33. In combination with a digital right management (DRM) system operating on a computing device, the DRM system requiring a black box for performing decryption and encryption functions, a method of providing the black box by a black box server, the method comprising:

receiving a request for a first black box from the DRM system;

generating the first black box, such generated first black box being unique and having a public/private key pair and electronic code for employing the key pair within the DRM system on the computing device; and

delivering the generated first black box to the DRM system, the delivered first black box being installed by the DRM system in such DRM system,

the DRM system further providing code for upgrading at least the public/private key the first black box is current or not current and for upgrading at least the public/private key pair in the first black box from the black box server to result in a second black box when the first black box is not current.

34. The method of claim 33 wherein the receiving step comprises receiving the request by way of a network connection between the black box server and the DRM system.

35. The method of claim 34 wherein the receiving step comprises receiving the request by way of an Internet connection between the black box server and the DRM system.

36. The method of claim 33 wherein the DRM system has a first previously installed black box prior to the requesting step, the first previously installed black box having a public/private key pair different from the public/private key pair of the generated black box, and wherein the generating step includes providing the generated black box with the public/private key pair of the first previously installed black box.

37. The method of claim 36 wherein the DRM system had a second previously installed black box prior to having the first previously installed black box, the second previously installed black box having a public/private key pair different from the public/private key pair of the first previously installed black box and also different from the public/private key pair of the generated black box, and wherein the generating step further includes providing the generated black box with the public/private key pair of the second previously installed black box.

38. The method of claim 33 wherein the generating, step includes providing the generated black box with an identifier indicative of currency.

39. The method of claim 38 wherein the generating step includes providing the generated black box with a version number.

40. The method of claim 33 wherein the generating step includes providing the generated black box with a digital certificate.

41. The method of claim 40 wherein the generating step includes providing the generated black box with a digital certificate proffering that the generated black box should be trusted.

42. The method of claim 33 wherein the generating step includes encrypting at least a portion of the private key of the generated black box according to a code-based encryption technique.

43. The method of claim 42 wherein the generating step includes encrypting at least a portion of the private key of the generated black box according to software code associated with the generated black box, whereby adulteration of such software code prevents such private key from being decrypted.

44. The method of claim 33 wherein the generating slop includes associating the generated black box with the DRM system/computing device, whereby the generated black box is inoperable on another DRM system/computing device.

45. The method of claim 44 wherein the receiving step includes receiving information unique to the DRM system/computing device, and wherein the generating step includes generating the black box based in part on the received information, whereby the generated black box can recognize whether it is intended for the DRM system/computing device upon which it is installed.

46. The method of claim 44 wherein the DRM system/computing device is a first DRM system/computing device, wherein the generating step includes associating the generated black box with the first DRM system/computing device and also with a second DRM system/computing device, whereby the generated black box is inoperable on another DRM system/computing device which is not the first or second DRM system/computing device.

47. A computer-readable medium having computer-executable instructions thereon for performing a method in combination with a digital rights management (DRM) system operating on a computing device, the DRM system requiring a black box for performing, decryption and encryption functions, the method for obtaining the black box by the DRM system and comprising:

requesting a first black box from a black box server, the black box server thereafter generating the first black box, such first generated black box being unique and having a public/private key pair and electronic code for employing the key pair within the DRM system on the computing device;

receiving the generated first black box from the black box server; and

installing the received first black box in such DRM system,

the DRM system further providing code for periodically determining whether the first black box is current or not current and for upgrading at least the public/private key pair in the first black box from the black box server to result in a second black box when the first black box is not current.

48. The method of claim 47 wherein the DRM system has a previously installed black box prior to the requesting step, the method further comprising determining prior to the requesting step that the previously installed black box is non-unique.

49. The method of claim 47 wherein the DRM system has a previously installed black box prior to the requesting step, the method further comprising determining prior to the requesting a step that the previously installed black box is not current.

50. The method of claim 47 wherein the requesting step comprises requesting the black box by way of a network connection to the black box server.

51. The method of claim 50 wherein the requesting step comprises requesting the black box by way of an Internet connection to the black box server.

52. The method of claim 47 wherein the DRM system has a first previously installed black box prior to the requesting stop, the first previously installed black box having a public/private key pair different from the public/private key pair of the generated black box, and wherein the requesting step includes providing the public/private key pair of the first previously installed black box to the black box server, whereby the generated black box is provided with the public/private key pair of the first previously installed black box.

53. The method of claim 52 wherein the DRM system had a second previously installed black box prior to having the first previously installed black box, the second previously installed black box having a public/private key pair different from the public/private key pair of the first previously installed black box and also different from thc public/private key pair of the generated black box, and wherein the requesting step further includes providing the public/private key pair of the second previously installed black box to the black box server, whereby the generated black box is also provided with the public/private key pair of the second previously installed black box.

54. The method of claim 47 wherein the received black box includes an identifier indicative of currency.

55. The method of claim 54 wherein the received black box includes a version number.

56. The method of claim 47 wherein the received black box includes a digital certificate.

57. The method of claim 56 wherein the received black box includes a digital certificate proffering that such received black box should be trusted.

58. The method of claim 47 wherein at least a portion of the private key of thc received black box is encrypted according to a code-based encryption technique.

59. The method of claim 58 at least a portion of the private key of the received black box is encrypted according to software code associated with such received black box, whereby adulteration of such software code prevents such private key from being decrypted.

60. The method of claim 47 wherein the received black box is associated with the DRM system/computing device, whereby such received black box is inoperable on another DRM system/computing device.

61. The method of claim 60 wherein the requesting step includes providing information unique to the DRM system/computing device, and wherein the received black box was generated based in part on the provided information, whereby the received black box can recognize whether it is intended for the DRM system/computing device upon which it is installed.

62. The method of claim 60 wherein the DRM system computing device is a first DRM system/computing device, wherein the received black box is associated with the first DRM system/computing device and also with a second DRM system/computing device, whereby the received black box is inoperable on another DRM system/computing device which is not the first or second DRM system/computing device.

63. A computer-readable medium having computer executable instructions thereon for performing a method in combination with a digital rights management (DRM) system operating on a computing device, the DRM system requiring a black box for performing decryption and encryption functions, the method for providing the black box by a black box server and comprising:

receiving a request for a first black box from the DRM system;

generating the first black box, such generated first black box being unique and having a public/private key pair and electronic code for employing the key pair within the DRM system on the computing device; and

delivering the generated first black box to the DRM system, the delivered first black box being installed by thc DRM system in such DRM system,

the DRM system further providing code for periodically determining whether the first black box is current or not current and for upgrading at least the public/private key pair in the first black box from the black box server to result in a second black box when the first black box is not current.

64. The method of claim 63 wherein the receiving step comprises receiving the request by way of a network connection between the black box server and the DRM system.

65. The method of claim 64 wherein the receiving step comprises receiving the request by way of an Internet connection between the black box service and the DRM system.

66. The method of claim 63 wherein the DRM system has a first previously installed black box prior to the requesting step, the first previously installed black box having a public/private key pair different from the public/private key pair of the generated black box, and wherein the generating step includes providing the generated black box with the public/private key pair of the first previously installed black box.

67. The method of claim 66 wherein the DRM system had a second previously installed black box prior to having the first previously installed black box, the second previously installed black box having a public/private key pair different from the public/private key pair of the first previously installed black box and also different from the public/private key pair of the generated black box, and wherein the generating stop further includes providing the generated black box with the public/private key pair of the second previously installed black box.

68. The method of claim 63 wherein the generating step includes providing the generated black box with an identifier indicative of currency.

69. The method of claim 68 wherein the generating step includes providing the generated black box with a version number.

70. The method of claim 63 wherein the generating step includes providing the generated black box with a digital certificate.

71. The method of claim 70 wherein the generating step includes providing the generated black box with a digital certificate proffering that the generated black box should he trusted.

72. The method of claim 63 wherein the generating step includes encrypting at least a portion of the private key of the generated black box according to a code-based encryption technique.

73. The method of claim 72 wherein the generating step includes encrypting at least a portion of the private key of the generated black box according to software code associated with the, generated black box, whereby adulteration of such software code prevents such private key from being decrypted.

74. The method of claim 63 wherein the generating step includes associating the generated black box with the DRM system/computing device, whereby the generated black box is inoperable on another DRM system/computing device.

75. The method of claim 74 wherein the receiving step includes receiving information unique to the DRM system/computing device, and wherein the generating step includes generating the black box based in part on the received information, whereby the generated black box can recognize whether it is intended for the DRM system/computing device upon which it is installed.

76. The method of claim 74 wherein the DRM system/computing device is a first DRM system/computing device, wherein the generating step includes associating the generated black box with the first DRM system/computing device and also with a second DRM system/computing device, whereby the generated black box is inoperable on another DRM system/computing device which is not the first or second DRM system/computing device.