Systems and methods for governing content rendering, protection, and management applications

• US 8,397,070 B2
• Filed: 09/14/2011
• Issued: 03/12/2013
• Est. Priority Date: 06/04/2000
• Status: Expired due to Term

• Current Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Original Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Inventors: MacKay, Michael K., Maher, David P.
• Primary Examiner(s): Zee, Edward
• Assistant Examiner(s): GYORFI, THOMAS A
• Application Number:
  US13/232,903
• Publication Number:
  US 20120005764A1
• Time in Patent Office: 545 Days
• Field of Search: 713/165, 713/171, 726 26- 30
• US Class Current: 713/171
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

System and methods are disclosed for governing digital rights management systems and other applications through the use of supervisory governance applications and keying mechanisms. Governance is provided by enabling the supervisory applications to revoke access keys and/or to block certain file system calls, thus preventing governed applications from accessing protected electronic content.

Claims

1. A non-transitory computer-readable storage medium storing instructions that, when executed by a processor on a first computer system, are configured to cause the first computer system to perform a method for controlling the operation of a first digital rights management system on the first computer system, the method comprising:

receiving, at a control application located on the first computer system, a request from the first digital rights management system to access a piece of electronic content;

receiving, at the control application, a first keyshare from the first digital rights management system;

receiving, at the control application, a second keyshare from a second digital rights management system located on the first computer system, the second digital rights management system being operable to send the second keyshare only if one or more conditions are satisfied;

using the first keyshare and the second keyshare to enable the control application to retrieve a piece of content-access information from protected storage on the first computer system; and

using the piece of content-access information to enable the first digital rights management system to access the piece of electronic content.

2. The non-transitory computer-readable storage medium of claim 1, in which the first keyshare and the second keyshare comprise portions of a first cryptographic key, the first cryptographic key being used to decrypt the piece of content-access information, the piece of content-access information comprising a second cryptographic key.

3. The non-transitory computer-readable storage medium of claim 2, in which the second cryptographic key is used by the second digital rights management system to decrypt the piece of electronic content.

4. The non-transitory computer-readable storage medium of claim 2, in which the second cryptographic key is sent to the first digital rights management system, the first digital rights management system being operable to use the second cryptographic key to decrypt the piece of electronic content.

5. The non-transitory computer-readable storage medium of claim 4, in which the decrypted piece of the electronic content comprises content protected in accordance with the encoding format of the first digital rights management system.

6. The non-transitory computer-readable storage medium of claim 1, further including instructions that, when executed by the processor, are configured to cause the first computer system to perform a method further comprising:

determining that the first digital rights management system is not functioning properly; and

sending control information to the second digital rights management system, the control information being operable to cause the second digital rights management system to deny access to the second keyshare when the first digital rights management system, or a process acting on its behalf, requests access to the second keyshare.

7. The non-transitory computer-readable storage medium of claim 1, further including instructions that, when executed by the processor, are configured to cause the first computer system to perform a method further comprising:

receiving first control information at the second digital rights management system, the first control information causing at least one of said conditions to not be satisfied, thereby inhibiting the second digital rights management system from sending the second keyshare.

8. The non-transitory computer-readable storage medium of claim 7, further including instructions that, when executed by the processor, are configured to cause the first computer system to perform a method further comprising:

receiving second control information at the second digital rights management system, the second control information causing said at least one condition to be satisfied, thereby enabling the second digital rights management system to send the second keyshare.

9. The non-transitory computer-readable storage medium of claim 1, in which the first keyshare is different from the second keyshare.

10. The non-transitory computer-readable storage medium of claim 1, further including instructions that, when executed by the processor, are configured to cause the first computer system to perform a method further comprising:

the first digital rights management system receiving a request to access the piece of electronic content from a rendering application.

11. The non-transitory computer-readable storage medium of claim 1, in which the one or more conditions include a condition that the first digital rights management comply with a set of security requirements.

12. The non-transitory computer-readable storage medium of claim 1, in which the one or more conditions include a condition that the first digital rights management system is not known to have been compromised.