Systems and methods for secure transaction management and electronic rights protection

• US 8,677,507 B2
• Filed: 02/08/2011
• Issued: 03/18/2014
• Est. Priority Date: 02/13/1995
• Status: Expired due to Fees

• Current Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Original Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Inventors: Ginter, Karl L., Shear, Victor H., Spahn, Francis J., Van Wie, David M.
• Primary Examiner(s): Darrow, Justin T
• Application Number:
  US13/023,415
• Publication Number:
  US 20110197285A1
• Time in Patent Office: 1,134 Days
• Field of Search: 726 27- 29, 726/33, 713/178, 713/179, 713/193, 713/194, 380/231, 380/233, 705/52
• US Class Current: 726/27
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04N 21/25816 involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/25875 involving end-user authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; arrangements for secret or secure communication including means for verifying the identity or authority of a user of the system H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/454 Content or additional data filtering, e.g. blocking advertisements
• CPC Class Codes: H04N 21/6334 for authorisation, e.g. by transmitting a key wireless communications network key management H04W12/04; wireless communications network access security H04W12/08

Abstract

The present invention provides systems and methods for secure transaction management and electronic rights protection. Electronic appliances such as computers equipped in accordance with the present invention help to ensure that information is accessed and used only in authorized ways, and maintain the integrity, availability, and/or confidentiality of the information. Such electronic appliances provide a distributed virtual distribution environment (VDE) that may enforce a secure chain of handling and control, for example, to control and/or meter or otherwise monitor use of electronically stored or disseminated information. Such a virtual distribution environment may be used to protect rights of various participants in electronic commerce and other electronic or electronic-facilitated transactions. Distributed and other operating systems, environments and architectures, such as, for example, those using tamper-resistant hardware-based processors, may establish security at each node. These techniques may be used to support an all-electronic information distribution, for example, utilizing the “electronic highway.”

Claims

1. A method comprising:

creating first control information, the first control information being configured for use by a protected processing environment to govern access to or other use of an electronic content object at a first electronic appliance, the first control information including a requirement that information relating to access to or other use of the electronic content object be recorded;

sending the first control information to a first electronic appliance;

determining whether usage information relating to access to or other use of the electronic content object has been recorded; and

conditionally sending, based at least in part on results of the determining step and the first control information, second control information to the first electronic appliance, the second control information including a time-based constraint.

2. The method of claim 1, wherein the first control information includes a time-based constraint.

3. The method of claim 1, wherein the first control information comprises information relating to one or more of:

storing the usage information,

analyzing the usage information,

collecting payment for the usage information, and

reporting the usage information.

4. The method of claim 3, wherein the usage information is reported via a pathway determined at least in part using the first control information, the pathway comprising electronic appliances associated with one or more of:

a creator of content embodied in the electronic content object,

a distributor of content embodied in the electronic content object,

an auditor, and

a clearinghouse.

5. The method of claim 1, wherein the protected processing environment comprises at least a secure processing unit having at least one hardware element that is tamper resistant, the tamper resistance being achieved through enclosure within tamper resistant packaging and/or employment of tamper resistant techniques comprising microfusing and thin wire detection.

6. The method of claim 5, wherein at least a portion of the first control information or second control information is securely maintained within the secure processing unit, and one or more different portions of the first control information or second control information are stored outside the secure processing unit, the one or more different portions being securely loaded into the secure processing unit for processing when necessary.

7. The method of claim 1, wherein the usage information is recorded by being stored according to one or more usage-related increments comprising one or more bytes, images, and logically related blocks.

8. The method of claim 1, wherein the first control information provides user defined constraints on at least the recording or reporting of the usage information, the constraints comprising one or more categories of usage information that may not be recorded or disseminated without the user'"'"'s consent.

9. A method comprising:

receiving first control information at a first electronic appliance, the first electronic appliance including a protected processing environment;

using the first control information to obtain access to or make other use of an electronic content object at the first electronic appliance, the access to or use of the electronic content object being governed by the protected processing environment in accordance with the first control information;

determining that at least a portion of the first control information has expired or has been consumed;

sending usage information to a second electronic appliance after obscuring one or more details of usage not permitted to be disseminated, the one or more details being identified based on control information associated with the electronic content object;

sending a request for second control information; and

receiving second control information.

10. The method of claim 9, in which receipt of the second control information is contingent at least in part on performance of the step of sending usage information to the second electronic appliance.

11. The method of claim 9, in which the sending steps are performed at least in part in response to the determining step.

12. The method of claim 9, in which the first control information comprises a budget.

13. The method of claim 9, in which the usage information and the request are combined.

14. The method of claim 12, wherein the budget comprises a monetary limit associated with access to or use of the electronic content object by one or more users at one or more electronic appliances including the first electronic appliance.

15. The method of claim 9, wherein the usage information comprises metering information, information derived from metering information, and payment information related to access to or use of the electronic content object.

16. The method of claim 9, wherein obscuring one or more details of usage not permitted to be disseminated comprises summarizing the usage information to obscure the usage details.

17. The method of claim 9, wherein the first control information is formed through an integration of control information provided by two or more parties.

18. The method of claim 17, wherein the integration of control information comprises one or more of:

one or more parties negotiating a modification of control information,

giving precedence to control information that is already in place over control information that is submitted later in time, and

allowing control information that is already in place to stipulate which subsequently submitted pieces of control information takes precedence over other conflicting subsequently submitted pieces of control information.

19. The method of claim 9, wherein the second control information is integrated with one or more portions of the first control information that have not expired or been consumed.

20. The method of claim 9, wherein the second control information is created at least in part based on an analysis of usage information from multiple electronic appliances including the first electronic appliance, the usage information from the multiple appliances providing one or more usage patterns related to a particular content object or collection of content objects.