Distributing access to a data item

• US 8,046,840 B2
• Filed: 03/16/2009
• Issued: 10/25/2011
• Est. Priority Date: 10/07/1998
• Status: Expired due to Fees

• Current Assignee: Adobe Systems Incorporated (Adobe Inc.)
• Original Assignee: Adobe Systems Incorporated (Adobe Inc.)
• Inventors: Kawell, Leonard M. Jr., Diaz, Thomas R., Heinen, Mary Ellen, Heinen, Roger J. Jr.
• Primary Examiner(s): Shiferaw; Eleni
• Assistant Examiner(s): CALLAHAN, PAUL E
• Application Number:
  US12/405,092
• Publication Number:
  US 20090183005A1
• Time in Patent Office: 953 Days
• Field of Search: 705/54, 713/170, 713/171, 726/4, 726/27
• US Class Current: 726/27
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 2211/008 Public Key, Asymmetric Key, Asymmetric Encryption
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A method is provided for use in distributing access to a data item. The method includes allowing multiple transfers between computers of a single instance of permission to gain access to the data item, the transfers occurring across data connections and including a first transfer between a first computer and a second computer and a subsequent transfer between the second computer and a third computer, wherein at any one time only one computer retains the instance of permission and is able to use the instance of permission to gain access to the data item.

Claims

1. A computer-implemented method, comprising:

verifying that a first computer is in the same group as a second computer, the first computer storing first permission data allowing a first number of end users to access an encrypted data item, each group member identified as a publisher computer, distributor computer, retailer computer or end-user computer, where members of the group are associated with a common group key, and group membership is established, in part, by encrypting a signature using the group key;

transferring second permission data from the first computer to the second computer, the second permission data allowing access to the encrypted data item for a second number of end-users through the second computer, where the second number does not exceed the first number; and

reducing the first number of end users.

2. The method of claim 1, where:

the first computer is a distributor computer and the second computer is a retailer computer.

3. The method of claim 1, where:

the first computer is a distributor computer and the second computer is a distributor computer.

4. The method of claim 1 where:

the group members are ordered and transferring second permission data is between two adjacent members in the order.

5. The method of claim 1 where the transferring includes:

transferring the second permission data from the first computer to an intermediary computer, and from the intermediary computer to the second computer.

6. The method of claim 1, further comprising:

providing a key from the first computer to the second computer which can be used to decrypt the data item.

7. The method of claim 1 where:

the second permission data includes an expiration time indicating when access to the data item for the end-users will be disabled.

8. A computer program product, encoded on a computer-readable storage device, operable to cause a data processing apparatus to perform operations comprising:

verifying that a first computer is in the same group as a second computer, the first computer storing first permission data allowing a first number of end users to access an encrypted data item, each group member identified as a publisher computer, distributor computer, retailer computer or end-user computer, where members of the group are associated with a common group key, and group membership is established, in part, by encrypting a signature using the group key;

transferring second permission data from the first computer to the second computer, the second permission data allowing access to the encrypted data item for a second number of end-users through the second computer, where the second number does not exceed the first number; and

reducing the first number of end users.

9. The program product of claim 8 where:

the first computer is a distributor computer and the second computer is a retailer computer.

10. The program product of claim 8 where:

the first computer is a distributor computer and the second computer is a distributor computer.

11. The program product of claim 8 where:

the group members are ordered and transferring second permission data is between two adjacent members in the order.

12. The program product of claim 8 where the transferring includes:

transferring the second permission data from the first computer to an intermediary computer, and from the intermediary computer to the second computer.

13. The program product of claim 8, further comprising:

providing a key from the first computer to the second computer which can be used to decrypt the data item.

14. The program product of claim 8 where:

the second permission data includes an expiration time indicating when access to the data item for the end-users will be disabled.