Cloud-based movable-component binding

• US 8,850,230 B2
• Filed: 01/14/2008
• Issued: 09/30/2014
• Est. Priority Date: 01/14/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Schnell, Patrik, Grigorovitch, Alexandre V, Dubhashi, Kedarnath A
• Primary Examiner(s): Siddiqi, Mohammad A
• Application Number:
  US12/014,079
• Publication Number:
  US 20090183010A1
• Time in Patent Office: 2,451 Days
• Field of Search: 713/193, 713/192, 713/1, 713/2, 713/155, 713/168, 713/172, 726/2, 726/4, 726/6, 726/17, 726/9, 726/20, 726/21, 709/226
• US Class Current: 713/193
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2463/103 applying security measure for protecting copy right protecting software against unauthorised usage in a vending or licensing environment, e.g. protection the software providers copyright G06F21/10; data processing systems or methods, specially adapted for payment schemes, architectures or protocols G06Q20/00; secrecy systems or subscription systems H04N7/16
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 12/48 using secure binding, e.g. securely binding identity modules to devices, services or applications

Abstract

This document describes tools capable of enabling cloud-based movable-component binding. The tools, in some embodiments, bind protected media content to a movable component in a mobile computing device in a cryptographically secure manner without requiring the movable component to perform a complex cryptographic function. By so doing the mobile computing device may request access to content and receive permission to use the content quickly and in a cryptographically robust way.

Claims

1. One or more computer-readable storage devices having computer-executable instructions that, when executed by one or more processors on a mobile computing device, perform acts comprising:

requesting, from a movable component physically connected to the mobile computing device but removable from the mobile computing device, a cryptographically secure identifier bound to the movable component, identifying the movable component, and not decryptable by the mobile computing device but decryptable by a remote computing device capable of communication with the mobile computing device using a mobile-device communication network, the movable component comprising a token associated with a DRM license, the DRM license permitting the mobile computing device to perform actions on protected media content that is stored on a removable memory physically connected to the mobile computing device but removable from the mobile computing device;

receiving the cryptographically secure identifier from the movable component;

transmitting the cryptographically secure identifier to the remote computing device over the mobile-device communication network to request permission to use the protected media content, the cryptographically secure identifier usable by the remote computing device to determine that the movable component is authentic and an entity associated with the movable component has a right to the requested use of the protected media content;

transmitting a device identifier identifying the mobile computing device effective to enable the remote computing device to determine whether or not the mobile computing device is trusted;

transmitting a non-encrypted identifier for the movable component effective to enable the remote computing device to authenticate the movable component using at least the non-encrypted identifier and the cryptographically secure identifier; and

receiving, from the remote computing device over the mobile-device communication network, permission to use the protected media content based at least in part on an indication from the remote computing device that the mobile computing device is trusted, the permission received responsive to the remote computing device authenticating the movable component using the non-encrypted identifier and the cryptographically secure identifier.

2. The one or more computer-readable storage devices of claim 1, wherein the movable component is a Subscriber Identity Module (SIM).

3. The one or more computer-readable storage devices of claim 1, wherein the movable component is a hardware card that is computationally slow relative to the remote computing device.

4. The one or more computer-readable storage devices of claim 1, wherein the cryptographically secure identifier is computed by the movable component with a symmetric key operation using a secret bound to the movable component and known by the remote computing device.

5. The one or more computer-readable storage devices of claim 1, wherein the act of receiving permission includes receiving information sufficient to enable the mobile computing device to decrypt the protected media content.

6. A method implemented at least in part by a computing device comprising:

receiving, via a mobile-device communication network and from a mobile computing device, a request to use protected media content and a cryptographically secure identifier bound to a movable component physically connected to the mobile computing device but removable from the mobile computing device, the request including a non-encrypted identifier configured to identify the movable component associated with the cryptographically secure identifier, the movable component comprising a token associated with a DRM license, the DRM license permitting the mobile computing device to perform actions on the protected media content, the protected media content stored on a removable memory physically connected to the mobile computing device but removable from the mobile computing device, the request further including a device identifier identifying the mobile computing device and usable to determine whether the mobile computing device is trusted;

determining, based on the cryptographically secure identifier and the non-encrypted identifier, that the movable component is authentic and that an entity associated with the removable component has a right to the requested use of the protected media content; and

responsive to determining that the movable component is authentic and that the entity associated with the removable component has a right to the requested use of the protected media content, transmitting information to the mobile computing device via the mobile-device communication network based on a determination that the mobile computing device is trusted, the information sufficient to enable the mobile computing device to use the protected media content.

7. The method of claim 6, wherein the act of determining finds a number and a secret associated with the non-encrypted identifier, decrypts the cryptographically secure identifier using the secret to provide a decrypted identifier, and wherein, if the decrypted identifier matches or is an increment of the number, determining that the movable component is authentic and that the entity has the right to the requested use.

8. The method of claim 6, wherein the act of determining comprises performing an asymmetric key operation and the cryptographically secure identifier is computed by the movable component with a symmetric key operation.

9. The method of claim 6, wherein the computing device on which the method is implemented at least in part includes a server having fast computational abilities compared to computational abilities of the movable component.

10. The method of claim 9, wherein the movable component is a hardware Subscriber Identity Module (SIM) card that is computationally slow relative to the server.

11. The method of claim 6, wherein the information comprises a key usable by the mobile computing device to decrypt the protected media content.

12. A method implemented at least in part by a mobile computing device comprising:

requesting, from a movable component physically connected to the mobile computing device but removable from the mobile computing device, a cryptographically secure identifier bound to the movable component, identifying the movable component, and not decryptable by the mobile computing device but decryptable by a remote computing device capable of communication with the mobile computing device using a mobile-device communication network, the movable component comprising a token associated with a DRM license, the DRM license permitting the mobile computing device to perform actions on protected media content that is stored on a removable memory physically connected to the mobile computing device but removable from the mobile computing device;

receiving the cryptographically secure identifier from the movable component;

transmitting the cryptographically secure identifier to the remote computing device over the mobile-device communication network to request permission to use the protected media content, the cryptographically secure identifier usable by the remote computing device to determine that the removable component is authentic and an entity associated with the removable component has a right to the requested use of the protected media content;

transmitting a device identifier identifying the mobile computing device effective to enable the remote computing device to determine whether the mobile computing device is trusted;

transmitting a non-encrypted identifier for the movable component effective to enable the remote computing device to authenticate the movable component using at least the non-encrypted identifier and the cryptographically secure identifier; and

receiving, from the remote computing device over the mobile-device communication network, permission to use the protected media content based on a determination that the mobile computing device is trusted, the permission received responsive to the remote computing device authenticating the movable component using the non-encrypted identifier and the cryptographically secure identifier.

13. The method of claim 12, wherein the movable component is a Subscriber Identity Module (SIM).

14. The method of claim 12, wherein the movable component is a hardware card that is computationally slow relative to the remote computing device.

15. The method of claim 12, wherein the cryptographically secure identifier is computed by the movable component with a symmetric key operation using a secret bound to the movable component and known by the remote computing device.

16. The method of claim 12, wherein the act of receiving permission includes receiving information sufficient to enable the mobile computing device to decrypt the protected media content.

17. The method of claim 12, wherein the movable component is configured to store a unique secret key and nonce.

18. The method of claim 12, wherein the DRM license includes multiple license identifiers including at least one of a customer identifier, a service identifier, or a domain identifier, the multiple identifiers being usable to authenticate the mobile computing device to a license server of a DRM system.