Publishing content in connection with digital rights management (DRM) architecture

• US 7,065,787 B2
• Filed: 06/12/2002
• Issued: 06/20/2006
• Est. Priority Date: 06/12/2002
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Ganesan, Krishnamurthy, Dublish, Pratul, Sahasrabudhe, Sandeep, Strom, Clifford Paul
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US10/170,791
• Publication Number:
  US 20030233561A1
• Time in Patent Office: 1,469 Days
• Field of Search: 726/21, 726/17
• US Class Current: 726/21
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]

Abstract

A packager packages digital content for a user and a licensor issues a digital license to the user for the content such that the user renders the content only in accordance with the license. The licensor and packager share a Secret to allow the packager and the licensor to calculate a content key (KD) for the content. To package the content for the user, the packager calculates a content key (KD) based on the shared Secret and a content ID and encrypts the content according to (KD). To issue a license to the user for the content, the licensor also calculates (KD) based on the shared Secret and the content ID, encrypts (KD) according to a public key of the user to form the license, and sends the license to the user.

Claims

1. A method in combination with a digital rights management architecture wherein a packager packages digital content for a user and a licensor issues a digital license to the user for the content, the user rendering the content only in accordance with the license, the method for the licensor to provision the packager to package the content for the user such that the licensor can issue the license to the user and comprising:

receiving a provisioning request from the packager;

generating a Secret to be shared with the packager, the shared Secret allowing each to calculate a content key (KD) for the content;

generating a random content key (KD-PROV);

encrypting the Secret according to (KD-PROV) to form (KD-PROV(Secret));

signing a public key of the packager (PU-PA1) with a private key of the licensor (PR-LI) to certify same ((PU-PA1) S (PR-LI)), the packager having a corresponding private key (PR-PA1) and the licensor having a corresponding public key (PU-LI); and

sending (KD-PROV(Secret)), (PU-PA1) S (PR-LI), and any associated certificate chain to the packager.

2. The method of claim 1 further comprising generating (PU-PA1, PR-PA1) for the packager, and encrypting (PR-PA1) according to (KD-PROV) to form (KD-PROV(PR-PA1)), the method comprising sending (KD-PROV(Secret)), (KD-PROV(PR-PA1)), (PU-PA1) S (PR-LI), and any associated certificate chain to the packager.

3. The method of claim 1 comprising receiving a provisioning request from the packager including (PU-PA1).

4. The method of claim 1 comprising receiving the provisioning request including proposed business rules specifying conditions under which the user is to be granted the license for the content packaged by the packager.

5. The method of claim 1 further comprising performing a financial transaction with the packager to provision same.

6. The method of claim 1 comprising sending (KD-PROV(Secret)), (PU-PA1) S (PR-LI), and any associated certificate chain to the packager as provisioning content renderable by the packager only in accordance with a corresponding provisioning license.

7. The method of claim 6 comprising receiving the provisioning request including a public key associated with the packager (PU-PA2), the packager having a corresponding private key (PR-PA2), the method further comprising generating the provisioning license by encrypting (KD-PROV) with (PU-PA2) to form (PU-PA2(KD-PROV)), and sending the provisioning license to the packager.

8. The method of claim 7 wherein (PU-PA2, PR-PA2) are (PU-PA1, PR-PA1).

9. The method of claim 7 wherein (PU-PA2, PR-PA2) are different from (PU-PA1, PR-PA1).

10. The method of claim 7 further comprising generating a provisioning content ID and appending same to the provisioning license.

11. The method of claim 10 further comprising appending the generated provisioning content ID to the provisioning content.

12. The method of claim 10 wherein the provisioning content ID includes an identifier of the licensor.

13. The method of claim 7 further comprising specifying usage rules for using the provisioning license and appending same to the provisioning license.

14. The method of claim 1 further comprising storing provisioning information including (PU-PA1) and the shared Secret, the stored provisioning information to be employed when constructing the license for the user.

15. A method in combination with a digital rights management architecture wherein a packager packages digital content for a user and a licensor issues a digital license to the user for the content, the user rendering the content only in accordance with the license, the packager having provisioning content from the licensor including a shared Secret encrypted according to a random content key (KD-PROV) ((KD-PROV(Secret)));

and a provisioning license from the licensor including (KD-PROV) encrypted according to a public key of the packager (PU-PA2) ((PU-PA2(KD-PROV))), the method for the packager to package the content for the user such that the licensor can issue the license to the user and comprising;

selecting the provisioning license and provisioning content from the licensor;

obtaining (PU-PA2(KD-PROV)) from the provisioning license;

applying a corresponding private key of the packager (PR-PA2) to (PU-PA2(KD-PROV)) to result in (KD-PROV);

obtaining (KD-PROV(Secret)) from the provisioning content;

applying (KD-PROV) to (KD-PROV(Secret)) to result in the shared Secret;

generating a random content ID for the content;

calculating a content key (KD) based on the random content ID and the Secret;

encrypting the content according to, (KD) ((KD(Content)));

obtaining from one of the provisioning license and the provisioning content a provisioning content ID having an identifier of the licensor;

appending to (KD(Content)) the random content ID, a public key of the packager (PU-PA1), and the identifier of the licensor to form the packaged content; and

distributing the packaged content to the user.

16. The method of claim 15 wherein the provisioning license further includes usage rules for using the provisioning license, the method further comprising reviewing the usage rules and making a determination based on such usage rules that (KD-PROV) can be made available from the provisioning license.

17. The method of claim 15 comprising calculating the content key (KD) based on a hash of the random content ID and the Secret.

18. The method of claim 15 wherein the provisioning content includes a signature based on a private key of the licensor (PR-LI) to certify same (S (PR-LI)), and any associated certificate chain, the method further comprising traversing the certificate chain to obtain (PU-LI) and applying same to verify S (PR-LI).

19. The method of claim 15 further comprising appending a signature to (KD(Content)), the signature being based on at least one of the random content ID, the public key of the packager (PU-PA1), the identifier of the licensor, and any usage rules specifying how the user can render the content as packaged.

20. The method of claim 15 wherein (PU-PA2) is (PU-PA1).

21. The method of claim 15 wherein (PU-PA2) is different from (PU-PA1).

22. The method of claim 15 further comprising appending to (KD(Content)) any usage rules specifying how the user can render the content as packaged to form the packaged content.

23. A method in combination with a digital rights management architecture wherein a packager packages digital content for a user and a licensor issues a digital license to the user for the content, the user rendering the content only in accordance with the license, the packaged content including the content encrypted according to a content key (KD) ((KD(Content))), a content ID, and a public key of the packager (PU-PA1), the method for the licensor to issue the license to the user and comprising:

receiving a request for a license from the user, the request including the content ID, (PU-PA1), and a public key associated with the user (PU-US) that is to be employed to bind the license to the user, the user having a corresponding private key (PR-US);

obtaining based on (PU-PA1) stored provisioning information regarding the packager including a Secret shared therewith;

calculating (KD) based on the content ID received with the request and the obtained Secret;

encrypting (KD) according to (PU-US) as received with the request ((PU-US(KD)));

appending to (PU-US(KD)) the content ID to form the license; and

sending the license to the user.

24. The method of claim 23 comprising calculating the content key (KD) based on a hash of the random content ID and the Secret.

25. The method of claim 23 comprising receiving the request further including usage rules specifying how the user can render the content;

and

further comprising appending to (PU-US(KD)) the usage rules.

26. The method of claim 23 comprising receiving (PU-US) in an identifying certificate, and any associated certificate chain.

27. The method of claim 23 wherein the packaged content further includes a signature based on a private key of the packager (PR-PA1) corresponding to the public key of the packager (PU-PA1) ((S(PR-PA1))), the method comprising receiving the request further including (S(PR-PA1)) and verifying (S(PR-PA1)) with (PU-PA1).

28. The method of claim 23 further comprising performing a financial transaction with the user to license same.

29. The method of claim 23 comprising calculating the content key (KD) based on a hash of the random content ID and the Secret.

30. The method of claim 23 further comprising appending to (PU-US(KD)) a signature based on a private key of the licensor (S (PR-LI)), and a corresponding public key of the licensor (PU-LI) to verify same.