System and method for controlling and enforcing access rights to encrypted media

• US 7,200,230 B2
• Filed: 01/15/2001
• Issued: 04/03/2007
• Est. Priority Date: 04/06/2000
• Status: Expired due to Fees

• Current Assignee: Marking Object Virtualization Intelligence, LLC
• Original Assignee: Macrovision Corporation (Adeia Inc.)
• Inventors: Knauft, Christopher L.
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Tran, Tongoc
• Application Number:
  US09/760,956
• Publication Number:
  US 20010029581A1
• Time in Patent Office: 2,269 Days
• Field of Search: 380200-203, 380210-211, 380231-232, 380/259, 380/30, 380/45, 713/165, 713/172, 713/182, 713/193, 705/54, 705/57, 705/51, 705/71
• US Class Current: 380/201
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A system for providing rights controlled access to digital media comprises a server data processor and a client data processor connected by a communications network. The user data processor provides access to a data object in accordance with rules associated with the data object by the server data processor. The client data processor comprises a machine key device and a user key device. The machine key device is preferably an installed component of the client data processor that provides encryption, decryption, and authentication functionality for the client data processor. The user key device is preferably a removable, portable device that connects to the client data processor and provides encryption, decryption, and authentication functionality for the user. A method restricts the use of a data object to a particular user and a particular data processor through the use of additional layers of encryption. The method preferably comprises encrypting a data object such that the it can be decrypted by the machine key device, and further encrypting the data object such that it can be decrypted by the user key device. A method restricts the use of a data object to a particular user and a particular data processor through the use of rules that require authentication of the machine key device and the user key device.

Claims

1. A user data processor for providing access to a rights controlled data object, the user data processor comprising:

a processing device;

a communications device connected to the processing device and configured to receive an encrypted secure package containing a portion of the rights controlled data object and having at least three secure layers requiring decryption;

a user program running on the processing device, the user program configured to control access to the rights controlled data object;

a user program security module configured to at least partially decrypt a first secure layer of the secure package using a user program key associated with the user program;

a user key device associated with a user, the user key device detachably connected to the processing device, accessible by the user program, and configured to restrict the use of the data object to the user using a user key for decrypting a second secure layer of the secure package; and

a machine key device connected to and associated with the processing device and accessible by the user program, the machine key device configured to restrict the use of the data object to the user data processor using a machine key for decrypting a third secure layer of the secure package.

2. The user data processor of claim 1, wherein the user program is configured to communicate with the machine key device to authenticate the identity of the processing device using the machine key.

3. The user data processor of claim 2, wherein the processing device is configured to provide rights controlled access to digital video.

4. The user data processor of claim 1, wherein the user program is configured to communicate with the machine key device to authenticate the identity of the processing device using the machine key.

5. The user data processor of claim 4, wherein the machine key is an asymmetric machine key pair comprising a public machine key and a private machine key.

6. The user data processor of claim 5, wherein the machine key device is configured to generate the asymmetric machine key pair.

7. The user data processor of claim 1, wherein the user program is configured to communicate with the machine key device to authenticate the identity of the processing device using the machine key, and wherein the user program is configured to communicate with the user key device to authenticate the identity of the user using the user key.

8. The user data processor of claim 1, further comprising:

a second security module configured to at least partially decrypt the secure package using a second key; and

a third security module configured to at least partially decrypt the secure package using a third key.

9. The user data processor of claim 8, wherein the second security module is configured to communicate with the user key device to authenticate the identity of the processing device using the user key, and wherein the third security module is configured to communicate with the machine key device to authenticate the identity of the processing device using the machine key.

10. The user data processor of claim 8, wherein the second key is a portion of the user key, wherein the second security module is configured to obtain the second key from the user key device, wherein the third key is a portion of the machine key, and wherein the third security module is configured to obtain the third key from the machine key device.

11. The user data processor of claim 10, wherein the second security module and the third security module are parts of the user program.

12. The user data processor of claim 1, further comprising a third security module configured to at least partially decrypt the secure package using a third key.

13. The user data processor of claim 12, wherein the third security module is configured to communicate with the machine key device to authenticate the identity of the processing device using the machine key.

14. The user data processor of claim 13, wherein the third key is the media access controller (MAC) address of the user data processor.

15. The user data processor of claim 12, wherein the third key is a portion of the machine key, and wherein the third security module is configured to obtain the third key from the machine key device.

16. The user data processor of claim 15, wherein the third security module is a part of the user program.

17. The user data processor of claim 1, wherein the user program is implemented in hardware.

18. The user data processor of claim 1, wherein the user program security module is part of the user program.

19. The user data processor of claim 1, wherein the processing device is a general purpose computer.

20. The user data processor of claim 1, wherein the processing device and the machine key device are contained in a single integrated circuit.

21. The user data processor of claim 1, wherein the user key device provides encryption and decryption functionality for the user.

22. The user data processor of claim 1, wherein the machine key device provides encryption and decryption functionality for the user data processor.

23. The user data processor of claim 1, wherein the user key is used for decryption.

24. A method of restricting the use of a data object, the method comprising:

(A) associating a user program key with a user program configured to run on a user data processor;

(B) determining whether the use of the data object is to be restricted to a particular user data processor;

(C) associating a machine key device with the particular user data processor, wherein the machine key device is accessible by the user program, and wherein the machine key device maintains a portion of a machine key;

(D) encrypting the data object such that decryption of a first secure layer and a second secure layer of the encrypted data object requires the user program key and the machine key, respectively;

(E) determining whether the use of the data object is to be restricted to a particular user;

(F) associating a user key device with the particular user, wherein the user key device is accessible by the user program, and wherein the user key device maintains a portion of a user key; and

(G) encrypting the data object such that decryption of a third secure layer of the encrypted data object requires the user key.

25. The method of claim 24, further comprising:

(H) providing control elements for controlling the use of the data object through the user program;

(I) transmitting the encrypted data object to the user data processor; and

(J) transmitting the control elements to the user data processor.

26. The method of claim 25, further comprising:

(K) digitally signing the control elements such that the control elements can be authenticated; and

(L) transmitting the digital signature of the control elements to the user data processor.

27. The method of claim 26, wherein the machine key is an asymmetric machine key pair comprising a public machine key and a private machine key.

28. The method of claim 24, wherein (D) comprises:

encrypting the data object with a session key, and

encrypting the session key such that decryption requires the user program key and the machine key.

29. The method of claim 24, wherein the user key is an asymmetric user key pair comprising a public user key and a private user key.

30. A method of restricting the use of a rights controlled data object, the method comprising:

(A) associating a user program key with a user program configured to run on a user data processor;

(B) encrypting the data object such that decryption of a first secure layer of the encrypted data object requires the user program key;

(C) determining whether the use of the data object is to be restricted to a particular user data processor;

(D) associating a machine key device with the particular user data processor, wherein the machine key device is accessible by the user program, and wherein the machine key device maintains a portion of a machine key for decrypting a second secure layer of the encrypted data object;

(E) creating a machine control element configured to cause the user program to restrict use of the data object to the particular user data processor by authenticating the particular user data processor based upon at least the machine key and by at least communicating with the machine key device;

(F) transmitting the encrypted data object and the machine control element to the user data processor;

(G) including the machine control element in a set of control elements configured to cause the user program to control access to the data object;

(H) signing the set of control elements, wherein (F) comprises transmitting the signed set of control elements;

(I) determining whether the use of the data object is to be restricted to a particular user;

(J) associating a user key device with the particular user, wherein the user key device is accessible by the user program, and wherein the user key device maintains a portion of a user key for decrypting a third secure layer of the encrypted data object;

(K) creating a user control element configured to cause the user program to restrict use of the data object to the particular user by authenticating the particular user based upon at least the user key and by at least communicating with the user key device; and

(L) including the user control element in the set of control elements.

31. The method of claim 30, wherein the machine key is an asymmetric machine key pair comprising a public machine key and a private machine key.

32. The method of claim 31, wherein (E) comprises including in the machine control element a digital certificate comprising the public machine key.

33. The method of claim 30, further comprising (M) encrypting the data object such that decryption also requires the machine key.

34. A method of restricting the use of a data object, the method comprising:

(A) associating a user program key with a user program configured to run on a user data processor;

(B) determining whether the use of the data object is to be restricted to a particular user data processor;

(C) associating a machine key with the particular user data processor;

(D) encrypting the data object such that decryption requires the user program key and the machine key;

(E) transferring the encrypted data object to the user data processor;

(F) determining whether the data object has been encrypted such that decryption requires the machine key;

(G) decrypting a first secure layer and a second secure layer of the data object using the user program key and the machine key, respectively;

(H) determining whether the use of the data object is to be restricted to a particular user;

(I) associating a user key with the particular user;

(J) encrypting the data object such that decryption also requires the user key;

(K) determining whether the data object has been encrypted such that decryption requires the user key; and

(L) decrypting a third secure layer of the data object using the user key.

35. The method of claim 34,

wherein (D) comprises:

encrypting the data object with a symmetric session key, and

encrypting the symmetric session key such that decryption requires the user program key and the machine key, and

wherein (G) comprises;

decrypting the symmetric session key with the user program key and the machine key, and

decrypting the data object using the decrypted symmetric session key.

36. The method of claim 35, wherein the user program key is an asymmetric user program key pair comprising a public user program key and a private user program key.

37. The method of claim 35, wherein the user program key is a symmetric key.

38. The method of claim 35, wherein the machine key is an asymmetric machine key pair comprising a public machine key and a private machine key.

39. A secure data package for controlling the use of a data object, the package comprising a controlled portion of the data object, the controlled portion encrypted such that decryption of a first secure layer and a second secure layer of the encrypted data object requires both a user program key and a machine key, respectively, wherein a portion of the user program key is maintained by and associated with a user program configured to run on a user data processor to provide controlled access to the data object, wherein the user data processor has a permanently attached machine key device configured to maintain the machine key, and wherein the controlled portion comprises an essential portion of the data object, wherein the controlled portion is additionally encrypted such that decryption of a third secure layer of the encrypted data object requires a user key, wherein the user key is maintained by a user key device associated with a particular user and detachably connected to the processing device.