Specifiying security for an element by assigning a scaled value representative of the relative security thereof

• US 8,005,757 B2
• Filed: 11/05/2004
• Issued: 08/23/2011
• Est. Priority Date: 03/27/1999
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Bell, Jeffrey R. C., Abburi, Rajasekhar, Peinado, Marcus
• Primary Examiner(s): Fischer; Andrew J.
• Assistant Examiner(s): ZELASKIEWICZ, CHRYSTINA E
• Application Number:
  US10/982,578
• Publication Number:
  US 20050091169A1
• Time in Patent Office: 2,482 Days
• Field of Search: 713/156, 713/2, 713/176, 726/1, 726/14, 705/51, 705/50, 705/59, 705/57
• US Class Current: 705/51
• CPC Class Codes: G06F 21/109 by using specially-adapted hardware at the client
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/84 output devices, e.g. displays or monitors
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G07F 9/002 Vending machines being part of a centrally controlled network of vending machines
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

To determine whether digital content can be released to an element such as a computer application or module, a scaled value representative of the relative security of the element is associated therewith, and the digital content has a corresponding digital license setting forth a security requirement. The security requirement is obtained from the digital license and the scaled value is obtained from the element, and the scaled value of the element is compared to the security requirement of the digital license to determine whether the scaled value satisfies the security requirement. The digital content is not released to the element if the scaled value does not satisfy the security requirement.

Claims

1. A computer-readable storage medium comprising:

an executable program stored on the computer-readable medium and having computer-executable instructions for determining whether digital content can be released to a computer-type operational element, a plurality of scaled values representative of the relative security of the element being associated therewith, each scaled value of the plurality of scaled values corresponding to a predetermined security factor relating to the relative security of the element, each scaled value being selected from a corresponding scale with a spectrum of values ranging from a first value indicative of an element that has been deemed not secure with respect to the corresponding security factor to a second value indicative of an element that has been deemed highly secure with respect to the corresponding security factor, the determination being made with respect to each scaled value according to a corresponding pre-defined security requirement specifying a minimum value between the respective first value and the respective second value, the computer-executable instructions performing;

obtaining from the element each scaled value; and

for each obtained scaled value, comparing the scaled value of the element to the minimum value of the corresponding security requirement to determine whether the scaled value is less than the minimum value of the security requirement, wherein the digital content is not released to the element if a predetermined number of the scaled values are less than the corresponding minimum values,

each corresponding pre-defined security requirement being specified in a digital license corresponding to the digital content, each scaled value being specified with regard to the element and assigned thereto by a certifying authority based at least in part on how tamper-resistant the element is, the digital content not being released to the element unless an identification of the assigning certifying authority appears in the digital license,

each scaled value being in a digital certificate associated with the element, the computer-executable instructions performing obtaining from the digital certificate each scaled value,

the security value certifying authority having issued the digital certificate associating each scaled value with the element, the pre-defined trusted security value certifying authority information being maintained regarding security value certifying authorities to be trusted, the computer-executable instructions performing;

obtaining the trusted security value certifying authority information;

obtaining the identification of the security value certifying authority from the digital certificate associated with the element;

comparing the obtained identification of the security value certifying authority to the trusted security value certifying authority information to determine whether the obtained identification of the security value certifying authority satisfies the trusted security value certifying authority information; and

releasing the digital content to the element only if the security value certifying authority satisfies the trusted security value certifying authority information.

2. The computer-readable storage medium of claim 1, wherein the determination is made with respect to a pre-defined security requirement stored in a digital rights management (DRM) system, the computer-executable instructions performing obtaining the security requirement from the DRM system.

3. The computer-readable storage medium of claim 1, wherein the pre-defined trusted security value certifying authority information is stored in a digital rights management (DRM) system, the computer-executable instructions performing obtaining the trusted security value certifying authority information from the DRM system.

4. The computer-readable storage medium of claim 1, wherein the digital certificate includes a hash based on the element, the computer-executable instructions performing verifying the hash against the element to verify the digital certificate.

5. The computer-readable medium of claim 1, wherein the scaled value is located in a digital certificate that includes a hash based on the element, the computer-executable instructions performing verifying the hash against the element to verify the digital certificate.

6. The computer-readable storage medium of claim 1, wherein a plurality of scaled values representative of the relative security of the element are associated therewith, the computer-executable instructions performing:

obtaining from the element the plurality of scaled values;

comparing the plurality of scaled values of the element to the security requirement to determine whether the plurality of scaled values satisfies the security requirement, wherein the digital content is not released to the element if the plurality of scaled values do not satisfy the security requirement.

7. The computer-readable storage medium of claim 6, wherein the determination is made with respect to a plurality of pre-defined security requirements respectively corresponding to the plurality of scaled values, the computer-executable instructions performing:

obtaining the plurality of security requirements; and

comparing each scaled value to the respective security requirement to determine whether such scaled value satisfies such security requirement, wherein the digital content is not released to the element if the plurality of scaled values do not satisfy the plurality of security requirements.

8. The computer-readable storage medium of claim 6, wherein the determination is made with respect to a pre-defined security requirement comprising a function of the plurality of scaled values and a range of acceptable results from the function, the computer-executable instructions performing:

obtaining the security requirement;

applying the plurality of scaled values to the security requirement to produce a result; and

comparing the result to the range of acceptable results to determine whether such result satisfies such range, wherein the digital content is not released to the element if the result does not satisfy the range.

9. A system for determining whether digital content can be released to a computer-type operational element, the system comprising memory comprising:

a plurality of scaled values in the memory representative of the relative security of the element being associated therewith, each scaled value of the plurality of scaled values corresponding to a predetermined security factor relating to the relative security of the element;

a corresponding scale for each of the plurality of scaled values, each scale having a spectrum of values ranging from a first value indicative of an element that has been deemed not secure with respect to the corresponding security factor to a second value indicative of an element that has been deemed highly secure with respect to the corresponding security factor, each scaled value being selected from the corresponding scale;

a corresponding pre-defined security requirement in the memory for each of the plurality of scaled values, each security requirement specifying a minimum value between the respective first value and the respective second value, the determination of each scaled value being made with respect to the corresponding pre-defined security requirement, wherein each scaled value from the element, and wherein each obtained scaled value of the element is compared to the minimum value of the corresponding security requirement to determine whether the scaled value is less than the minimum value of the security requirement, and wherein the digital content is not released to the element if a predetermined number of the scaled values are less than the corresponding minimum values,

each corresponding pre-defined security requirement being specified in a digital license corresponding to the digital content, each scaled value being specified with regard to the element and assigned thereto by a certifying authority based at least in part on how tamper-resistant the element is, the digital content not being released to the element unless an identification of the assigning certifying authority appears in the digital license;

each scaled value being in a digital certificate associated with the element, each scaled value being obtained from the digital certificate;

the security value certifying authority having issued the digital certificate associating each scaled value with the element;

pre-defined trusted security value certifying authority information being maintained regarding security value certifying authorities to be trusted;

the trusted security value certifying authority information being obtained, the identification of the security value certifying authority being obtained from the digital certificate associated with the element;

the identification of the security value certifying authority being compared to the trusted security value certifying authority information to determine whether the obtained identification of the security value certifying authority satisfies the trusted security value certifying authority information; and

the digital content being released to the element only if the security value certifying authority satisfies the trusted security value certifying authority information.

10. The system of claim 9, wherein the determination is made with respect to a pre-defined security requirement stored in a digital rights management (DRM) system, and wherein the security requirement is obtained from the DRM system.

11. The system of claim 9, wherein the pre-defined trusted security value certifying authority information is stored in a digital rights management (DRM) system, and wherein the trusted security value certifying authority information is obtained from the DRM system.

12. The system of claim 9, wherein the digital certificate includes a hash based on the element, and wherein the hash is verified against the element to verify the digital certificate.

13. The system of claim 9, wherein the scaled value is located in a digital certificate that includes a hash based on the element, and wherein the hash is verified against the element to verify the digital certificate.

14. The system of claim 9, wherein a plurality of scaled values representative of the relative security of the element are associated therewith, and wherein the element is obtained from the plurality of scaled values, and wherein the plurality of scaled values of the element are compared to the security requirement to determine whether the plurality of scaled values satisfies the security requirement, and wherein the digital content is not released to the element if the plurality of scaled values do not satisfy the security requirement.

15. The system of claim 14, wherein the determination is made with respect to a plurality of pre-defined security requirements respectively corresponding to the plurality of scaled values, and wherein the plurality of security requirements is obtained, and wherein each scaled value is compared to the respective security requirement to determine whether such scaled value satisfies such security requirement, and wherein the digital content is not released to the element if the plurality of scaled values do not satisfy the plurality of security requirements.

16. The system of claim 14, wherein the determination is made with respect to a pre-defined security requirement comprising a function of the plurality of scaled values and a range of acceptable results from the function, and wherein the security requirement is obtained, and wherein the plurality of scaled values is applied to the security requirement to produce a result, and wherein the result is compared to the range of acceptable results to determine whether such result satisfies such range, and wherein the digital content is not released to the element if the result does not satisfy the range.