Trusted infrastructure support systems, methods and techniques for secure electronic commerce transaction and rights management

• US 8,751,793 B2
• Filed: 12/02/2003
• Issued: 06/10/2014
• Est. Priority Date: 02/13/1995
• Status: Expired due to Fees

• Current Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Original Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Inventors: Ginter, Karl L., Shear, Victor H., Spahn, Francis J., Van Wie, David M., Weber, Robert P.
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Korsak, Oleg
• Application Number:
  US10/727,324
• Publication Number:
  US 20040123129A1
• Time in Patent Office: 3,843 Days
• Field of Search: 713/193, 713/156, 713/157, 713/158, 713/175, 726/4, 726/10, 726/28, 380/255, 705/14.23, 705/14.51
• US Class Current: 713/156
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 12/1483 using an access-table, e.g. matrix or list
• CPC Class Codes: G06F 21/109 by using specially-adapted hardware at the client
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/86 Secure or tamper-resistant housings
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/023 the neutral party being a clearing house
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/123 Shopping for digital content
• CPC Class Codes: G06Q 20/1235 with control of digital rights management [DRM]
• CPC Class Codes: G06Q 20/14 specially adapted for billing systems
• CPC Class Codes: G06Q 20/24 Credit schemes, i.e. "pay after"
• CPC Class Codes: G06Q 30/06 : Buying, selling or leasing transactions
• CPC Class Codes: G06Q 30/0601 : Electronic shopping [e-shopping]
• CPC Class Codes: G06T 1/0021 : Image watermarking
• CPC Class Codes: G07F 9/026 : for alarm, monitoring and auditing in vending machines or means for indication, e.g. when empty
• CPC Class Codes: G11B 20/00086 : Circuits for prevention of unauthorised reproduction or copying, e.g. piracy indicating unauthorised use of record carriers in general G11B23/28; scrambling for television signal recording H04N5/913; network architectures or network protocols for network security H04L63/00; cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
• CPC Class Codes: G11B 20/00159 : Parental control systems
• CPC Class Codes: G11B 20/00188 : involving measures which result in a restriction to authorised devices recording or reproducing contents to/from a record carrier
• CPC Class Codes: G11B 20/00557 : wherein further management data is encrypted, e.g. sector headers, TOC or the lead-in or lead-out areas
• CPC Class Codes: G11B 20/0071 : involving a purchase action
• CPC Class Codes: G11B 20/00768 : wherein copy control information is used, e.g. for indicating whether a content may be copied freely, no more, once, or never, by setting CGMS, SCMS, or CCI flags
• CPC Class Codes: G11B 2220/216 : Rewritable discs
• CPC Class Codes: G11B 2220/218 : Write-once discs
• CPC Class Codes: G11B 2220/2562 : DVDs [digital versatile discs]; Digital video discs; MMCDs; HDCDs
• CPC Class Codes: G11B 2220/2575 : DVD-RAMs
• CPC Class Codes: G11B 27/031 : Electronic editing of digitised analogue information signals, e.g. audio or video signals
• CPC Class Codes: G11B 27/329 : on a disc [VTOC]
• CPC Class Codes: H04L 12/40104 : Security; Encryption; Content protection cryptographic protocols H04L9/00; protocols for network security H04L63/00
• CPC Class Codes: H04L 12/40117 : Interconnection of audio or video/imaging devices home automation networks H04L12/2803; bitstream network arrangements specially adapted for distribution of digital video signals H04N7/24
• CPC Class Codes: H04L 2209/56 : Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/603 : Digital right managament [DRM]
• CPC Class Codes: H04L 2463/101 : applying security measures for digital rights management
• CPC Class Codes: H04L 2463/102 : applying security measure for e-commerce
• CPC Class Codes: H04L 2463/103 : applying security measure for protecting copyright
• CPC Class Codes: H04L 63/04 : for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/068 : using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/0823 : using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/321 : involving a third party or a trusted authority
• CPC Class Codes: H04N 21/2347 : involving video stream encryption
• CPC Class Codes: H04N 21/23476 : by partially encrypting, e.g. encrypting the ending portion of a movie
• CPC Class Codes: H04N 21/235 : Processing of additional data, e.g. scrambling of additional data or processing content descriptors
• CPC Class Codes: H04N 21/2362 : Generation or processing of Service Information [SI]
• CPC Class Codes: H04N 21/2541 : Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/2543 : Billing , e.g. for subscription services payment schemes, architectures or protocols G06Q20/00; e-commerce G06Q30/00; arrangements for billing for the use of broadcast information or broadcast-related information H04H60/21
• CPC Class Codes: H04N 21/2547 : Third Party Billing, e.g. billing of advertiser
• CPC Class Codes: H04N 21/25875 : involving end-user authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; arrangements for secret or secure communication including means for verifying the identity or authority of a user of the system H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/4143 : embedded in a Personal Computer [PC]
• CPC Class Codes: H04N 21/4345 : Extraction or processing of SI, e.g. extracting service information from an MPEG stream
• CPC Class Codes: H04N 21/435 : Processing of additional data, e.g. decrypting of additional data, reconstructing software from modules extracted from the transport stream
• CPC Class Codes: H04N 21/4405 : involving video stream decryption
• CPC Class Codes: H04N 21/44204 : Monitoring of content usage, e.g. the number of times a movie has been viewed, copied or the amount which has been watched monitoring of user activities for profile generation for accessing a video database G06F16/739; protecting generic digital content where the protection is independent of the precise nature of the content G06F21/10; arrangements for monitoring the use made of the broadcast services in broadcast systems H04H60/31
• CPC Class Codes: H04N 21/443 : OS processes, e.g. booting an STB, implementing a Java virtual machine in an STB or power management in an STB
• CPC Class Codes: H04N 21/4627 : Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/4753 : for user identification, e.g. by entering a PIN or password cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08
• CPC Class Codes: H04N 21/6581 : Reference data, e.g. a movie identifier for ordering a movie or a product identifier in a home shopping application
• CPC Class Codes: H04N 21/8166 : involving executable data, e.g. software arrangements for executing specific programs G06F9/44; broadcasting computer programmes in broadcast systems H04H20/91; involving the movement of software or configuration parameters H04L67/34
• CPC Class Codes: H04N 21/835 : Generation of protective data, e.g. certificates protecting software against unauthorised usage in a vending or licensing environment G06F21/10
• CPC Class Codes: H04N 21/8355 : involving usage data, e.g. number of copies or viewings allowed
• CPC Class Codes: H04N 21/83555 : using a structured language for describing usage rules of the content, e.g. REL
• CPC Class Codes: H04N 21/8358 : involving watermark protecting executable software by watermarking G06F21/16; image watermarking in general G06T1/0021; watermarks inserted in still images for transmission purposes H04N1/32144; inserting watermarks during video coding H04N19/467
• CPC Class Codes: H04N 7/162 : Authorising the user terminal, e.g. by paying; Registering the use of a subscription channel, e.g. billing
• CPC Class Codes: H04N 7/17309 : Transmission or handling of upstream communications
• CPC Class Codes: Y10S 707/99939 : Privileged access

Abstract

The present inventions provide an integrated, modular array of administrative and support services for electronic commerce and electronic rights and transaction management. These administrative and support services supply a secure foundation for conducting financial management, rights management, certificate authority, rules clearing, usage clearing, secure directory services, and other transaction related capabilities functioning over a vast electronic network such as the Internet and/or over organization internal Intranets.

These administrative and support services can be adapted to the specific needs of electronic commerce value chains. Electronic commerce participants can use these administrative and support services to support their interests, and can shape and reuse these services in response to competitive business realities.

A Distributed Commerce Utility having a secure, programmable, distributed architecture provides administrative and support services. The Distributed Commerce Utility makes optimally efficient use of commerce administration resources, and can scale in a practical fashion to accommodate the demands of electronic commerce growth.

The Distributed Commerce Utility may comprise a number of Commerce Utility Systems. These Commerce Utility Systems provide a web of infrastructure support available to, and reusable by, the entire electronic community and/or many or all of its participants.

Different support functions can be collected together in hierarchical and/or in networked relationships to suit various business models and/or other objectives. Modular support functions can combined in different arrays to form different Commerce Utility Systems for different design implementations and purposes. These Commerce Utility Systems can be distributed across a large number of electronic appliances with varying degrees of distribution.

Claims

1. A method for providing access to an online service, the method comprising:

receiving, at a first electronic appliance, a first digital certificate from a second electronic appliance associated with a user, the first digital certificate attesting to at least one attribute of the user;

determining, by the first electronic appliance, based at least in part on the first digital certificate, whether the user is authorized to access the online service;

issuing, by the first electronic appliance, based on the determination of whether the user is authorized to access the online service, a second digital certificate to the user, the second digital certificate attesting to the user'"'"'s permission to access the online service;

sending, from the first electronic appliance to the second appliance, the second digital certificate; and

receiving audit record information relating to the user'"'"'s use of the online service, the audit record information comprising an aggregation of usage information that masks one or more details of individual service items accessed or utilized in accordance with a level of detail associated with the usage information that is deemed acceptable by the user.

2. A method as in claim 1, further comprising:

receiving, at the second electronic appliance, a request from the user to access the online service;

checking, by the second electronic appliance, the second digital certificate to determine whether the user has permission to access the online service; and

allowing, by the second electronic appliance, the user to access the online service based on the determination of whether the user has permission to access the online service.

3. A method as in claim 2, in which said checking step is performed in a protected processing environment at the second electronic appliance.

4. A method as in claim 1, further comprising:

sending, from the first electronic appliance to the second electronic appliance, software for using the online service to the second electronic appliance; and

sending, from the first electronic appliance to the second electronic appliance, a digital signature for determining the integrity of the software to the user.

5. A method as in claim 4, in which the digital signature is bound, at least in part, to the identity of the online service.

6. A method as in claim 1, further comprising:

sending, from the first electronic appliance to the second electronic appliance, a third digital certificate, the third digital certificate attesting to the identity of the online service, the third digital certificate being issued by a certifying authority.

7. A method as in claim 6, in which the first digital certificate is issued by the certifying authority.

8. A method as in claim 1, in which the first digital certificate includes an indication of the user'"'"'s age.

9. A method as in claim 1, in which the first digital certificate identifies a party responsible for paying for the user'"'"'s access to online services.

10. A method as in claim 9, further comprising:

sending, by the first electronic appliance, a request for payment to the party responsible for paying for the user'"'"'s access to online services; and

receiving, at the first electronic appliance, an indication that payment has been received.

11. A method as in claim 10, in which the steps of (a) sending a request for payment and (b) receiving an indication that payment has been received are performed prior to performing the step of sending the second digital certificate to the user.

12. A method as in claim 1, in which the second digital certificate attests to the user'"'"'s permission to access the online service until a specified date.

13. A method as in claim 1, in which the at least one attribute comprises an indication of the amount of purchases the user is allowed to make in a given time period.

14. A method as in claim 1, in which the online service comprises an interactive online game.

15. A method as in claim 14, further comprising:

sending, from the first electronic appliance to the second electronic appliance software for playing the online game to the user in a secure container.

16. A method as in claim 1, in which the second digital certificate includes an expiration date of the subscription.

17. A method as in claim 1, further comprising:

collecting, by the first electronic appliance, payment information from the user.

18. A method as in claim 17, further comprising:

sending, by the first electronic appliance, the payment information to a financial clearinghouse.

19. A method as in claim 1, further comprising:

sending, by the first electronic appliance, the audit record information to a usage clearinghouse.