System and method for digital rights management using a standard rendering engine

• US 7,743,259 B2
• Filed: 01/16/2002
• Issued: 06/22/2010
• Est. Priority Date: 08/28/2000
• Status: Expired due to Term

• Current Assignee: ContentGuard Holdings, Inc. (Pendrell Corporation)
• Original Assignee: ContentGuard Holdings, Inc. (Pendrell Corporation)
• Inventors: Wu, Hsi-Cheng, Raley, Michael, Ta, Thanh, Chen, Daniel
• Primary Examiner(s): Dada; Beemnet W
• Application Number:
  US10/046,670
• Publication Number:
  US 20020108050A1
• Time in Patent Office: 3,079 Days
• Field of Search: 713200-202, 713/165, 713/168, 713/193, 705/50, 705/51, 705/59, 726/4, 726/27, 726/26, 726/28, 726/7
• US Class Current: 713/193
• CPC Class Codes: G06F 21/1063 Personalisation
• CPC Class Codes: G06F 21/1083 Partial license transfers
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/62 Establishing a time schedule for servicing the requests
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context
• CPC Class Codes: H04N 21/4788 communicating with other users, e.g. chatting arrangements for providing for computer conferences, e.g. chat rooms, to substation in data switching networks H04L12/1813; distributed application using peer-to-peer [P2P] networks H04L67/104
• CPC Class Codes: H04N 21/632 using a connection between clients on a wide area network, e.g. setting up a peer-to-peer communication via Internet for retrieving video segments from the hard-disk of other client devices broadcast-related systems characterised by transmission among terminal devices H04H60/80; distributed application using peer-to-peer [P2P] networks H04L67/104

Abstract

A system and method for the secure distribution and consumption of electronic documents using a standard rendering engine. The documents can usage rights associated therewith. A server stores at least one of the documents in computer readable form. A client having a standard application program including a rendering engine capable of rendering unencrypted documents for viewing is operated by a user. The client and the server are coupled by a communications network. A security module controls requested for at least one of the documents on the server from the client and delivers the document and a set of rights associated with the document to the client.

Claims

1. A system for controlling use of requested digital content having usage rights associated therewith, said system comprising:

a client computer having a standard application program including a standard rendering engine programmed to render content;

a communications interface for coupling said client to a server having digital content stored thereon; and

a client side security module, separate from the standard rendering engine, which is downloaded and included in said client computer, the security module being programmed to be attached to the standard application program, to enforce usage rights for which the standard rendering engine is not programmed to enforce, and to provide access to the standard rendering engine,

wherein, in response to a request to render the requested digital content, the security module determines whether the requested digital content is protected content based upon the usage rights associated with the requested digital content, and

wherein, when the requested digital content is protected content, the security module intercepts a request to the standard rendering engine to render the protected digital content, and

wherein, when the security module determines that the requested digital content is protected content, the security module determines whether to allow a user to perform a requested function on the protected digital content based upon the usage rights associated with the protected digital content, and responds to the request to perform the requested function on the protected digital content based on the usage rights associated with the protected digital content, and

wherein, when the security module determines that the requested digital content is not protected content, the security module disengages from the standard rendering engine.

2. A system as recited in claim 1, wherein said security module is operative to define a user interface of said standard application program.

3. A system as recited in claim 1, wherein said security module is operative to superimpose a watermark based on client specific data on a image rendered by said standard rendering engine.

4. A system as recited in claim 3, wherein the client specific data is unique to the standard application program.

5. A system as recited in claim 3, wherein the client specific data is unique to the client computer.

6. A system as recited in claim 1, wherein said security module creates a document containing references to the digital content and spawns a child instance of the standard rendering engine to render the document, and wherein said child instance of said standard rendering engine is operative to follow the references to retrieve content through an asynchronous protocol from a secured location.

7. A system as recited in claim 6, wherein said secured location is a trusted server system.

8. A system as recited in claim 1, wherein said standard rendering engine is a Web browser.

9. A system as recited in claim 1, further comprising a trusted server system and wherein said security module is operative to check security information of executable code to be loaded on said client computer to ascertain if said executable code is certified for security and if said executable code is certified, permitting said executable code to be installed on said client computer and wherein if said executable code is not certified, said server contacts said trusted site to verify if said executable code is certified by said trusted site and permits said executable code to be installed on said client computer if said executable code is authorized.

10. A system as recited in claim 1, wherein said digital content is an HTML document.

21. A system as recited in claim 1, further comprising:

an HTML document adapted to be rendered by Web browser in a secure environment, said document comprising;

an HTML header defined between header tags;

an HTML body containing content; and

security information embedded in said header, said security information being associated with one or more usage rights for the digital content,

wherein the HTML header, the HTML body, and the security information are delivered to a client computing system, and

the client computing system interprets the security information and honors the usage rights while processing the HTML body and the HTML header.

22. The system as recited in claim 21, wherein said HTML body does not contain security information for digital content in the HTML document.

23. The system as recited in claim 22, wherein said security information is in the form of an attribute of said HTML header.

24. A system as recited in claim 1, wherein the security module is installed on the client computer separately from the standard application program.

25. A system as recited in claim 1, wherein the security module is installed on the client computer at a different time than the standard application program.

11. A method for controlling use of digital content having usage rights associated therewith, said method comprising:

requesting, over a communications network, the digital content from a client computer having a standard application program including a standard rendering engine programmed to render content; and

enforcing security conditions for accessing the standard rendering engine with a client side security module, separate from the standard rendering engine, which is downloaded and included in said client computer, the security module being programmed to be attached to the standard application program, to enforce usage rights for which the standard rendering engine is not programmed to enforce, and to provide access to the standard rendering engine,

wherein, in response to a request to render digital content, said enforcing step comprises;

determining whether the requested digital content is protected content based upon the usage rights associated with the digital content;

intercepting a request to the standard rendering engine to render the protected digital content when the client side security module determines that the requested digital content is protected content;

determining whether to allow a user to perform a requested function on the protected digital content based on the usage rights associated with the digital content when the client side security module determines that the requested digital content is protected content;

responding to the request to allow a user to perform a requested function on the protected digital content based on the usage rights associated with the digital content when the client side security module determines that the requested digital content is protected content; and

disengaging the client side security module from the standard rendering engine when the client side security module determines that the requested content is not protected content.

12. A method as recited in claim 11, wherein said enforcing step comprises defining a user interface of said standard application program.

13. A method as recited in claim 11, wherein said enforcing step comprises creating a client specific watermark based on client specific data and superimposing the client specific watermark on a image rendered by said standard rendering engine.

14. A method as recited in claim 13, wherein the client specific data is unique to the standard application program.

15. A method as recited in claim 11, wherein the client specific data is unique to the client computer.

16. A method as recited in claim 11, wherein said enforcing step comprises creating a document containing references to the digital content and spawning a child instance of the standard rendering engine to render the document, and retrieving content through an asynchronous protocol from a secured location with said child instance of said standard rendering engine by following the references to.

17. A method as recited in claim 16, wherein said secured location is a trusted server system.

18. A method as recited in claim 11, wherein said standard rendering engine is a Web browser.

19. A method as recited in claim 11, wherein said enforcing step comprises checking security information of executable code to be loaded on said client computer to ascertain if said executable code is certified for security and if said executable code is certified, permitting said executable code to be installed on said client computer and wherein if said executable code is not certified, contacting a trusted site to verify if said executable code is authorized by said trusted site and permitting said executable code to be installed on said client computer if said executable code is authorized.

20. A method as recited in claim 11, wherein said digital content is an HTML document.

26. A method as recited in claim 11, wherein the security module is installed on the client computer separately from the standard application program.

27. A method as recited in claim 11, wherein the security module is installed on the client computer at a different time than the standard application program.