Methods and apparatus for protected distribution of applications and media content

• US 9,026,804 B2
• Filed: 02/24/2006
• Issued: 05/05/2015
• Est. Priority Date: 02/24/2006
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Durand, Julian, Kenagy, Jason B., Nielsen, Per, Bernard, Christophe, McGaraghan, Amy, Campbell, Bryan L.
• Primary Examiner(s): Tabor, Amare F
• Application Number:
  US11/361,154
• Publication Number:
  US 20070208953A1
• Time in Patent Office: 3,357 Days
• Field of Search: 726 22- 33, 713189-193
• US Class Current: 713/193
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

Methods, devices, apparatus, computer-readable media and processors are provided that protect the distribution of media content. Media content is encrypted and the associated cryptographic mechanisms are stored and accessible either remotely at a networked database or internally within a data storage device memory. Access to the cryptographic mechanisms is granted by associating the cryptographic mechanisms with a data storage device identification and, optionally, a computing device identification.

Claims

1. A method for accessing content, the method comprising:

Forwarding a storage device identifier to a network device, wherein the storage device identifier identifies a storage device that includes protected content;

receiving at least a reference to a cryptographic mechanism from the network device based on an association with the storage device identifier, the cryptographic mechanism configured to provide access to less than all of the protected content on the storage device; and

accessing at least a portion of the protected content with the cryptographic mechanism.

2. The method of claim 1, further comprising:

forwarding to the network device a request for access to at least one other portion of the protected content different from the portion accessed with the cryptographic mechanism, the request comprising at least one of the storage device identifier and a computing device identifier, the computing device identifier associated with a computing device operable to receive the storage device;

receiving at least a reference to at least one other cryptographic mechanism from the network device based on an association with at least one of the storage device identifier and the computing device identifier, the other cryptographic mechanism corresponding to at least the other portion of the protected content; and

accessing at least the other portion of the protected content with the other cryptographic mechanism.

3. The method of claim 1, further comprising providing payment information prior to receiving the cryptographic mechanism, the payment information corresponding to a payment to access at least the portion of the protected content.

4. The method of claim 2, further comprising providing payment information prior to receiving the other cryptographic mechanism, the payment information corresponding to a payment to access at least the other portion of the protected content.

5. The method of claim 1, wherein receiving at least the reference to the cryptographic mechanism from the network device is further based on a confirmation of an availability for use of the storage device.

6. The method of claim 5, wherein the confirmation of the availability for use of the storage device is based on an association between the storage device identifier and a procurement transaction involving the storage device.

7. The method of claim 1, further comprising forwarding a computing device identifier to the network device, the computing device identifier associated with a computing device operable to receive the storage device, and wherein receiving the reference to the cryptographic mechanism from the network device further comprises receiving at the computing device based on an association with the computing device identifier.

8. The method of claim 7, further comprising forwarding another computing device identifier to the network device, the other computing device identifier associated with another computing device operable to receive the storage device, and wherein receiving at least the reference to the cryptographic mechanism from the network device further comprises receiving at the other computing device based on an association with the other computing device identifier.

9. The method of claim 1, wherein receiving at least the reference to the cryptographic mechanism further comprises receiving the cryptographic mechanism.

10. The method of claim 1, wherein the protected content comprises content obscured by a predetermined cryptographic mechanism.

11. The method of claim 1, wherein the receiving the storage device comprising the storage device identifier and protected content further comprises the receiving the storage device comprising the storage device identifier, protected content and non-protected content.

12. The method of claim 11, further comprising the accessing the non-protected content, wherein the non-protected content includes preview content.

13. The method of claim 11, further comprising accessing the non-protected content, wherein the non-protected content includes limited-use content.

14. The method of claim 13, wherein the non-protected content includes limited-use content that further defines the limited-use content as being limited-use content based on a computing device that receives the storage device.

15. A non-transitory computer readable medium tangibly storing a sequence of instructions that, when executed, cause a computer device to perform the actions of:

forwarding a storage device identifier to a network device, wherein the storage device identifier identifies a storage device that includes protected content;

receiving at least a reference to a cryptographic mechanism from the network device based on an association with the storage device identifier, the cryptographic mechanism configured to provide access to less than all of the protected content on the storage device; and

accessing at least a portion of the protected content with the cryptographic mechanism.

16. A wireless device, comprising:

means for forwarding a storage device identifier to a network device, wherein the storage device identifier identifies a storage device that includes protected content;

means for receiving at least a reference to a cryptographic mechanism from the network device based on an association with the storage device identifier, the cryptographic mechanism configured to provide access to less than all of the protected content on the storage device; and

means for accessing at least a portion of the protected content with the cryptographic mechanism.

17. A computing device, comprising:

a processing engine; and

a content access initiator module executable by the processing engine, the content access initiator module operable to recognize protected content stored on a storage device, communicate a storage device identifier to a network device, receive from the network device at least a reference to a first cryptographic mechanism associated with the storage device identifier, the first cryptographic mechanism configured to provide access to less than all of the protected content on the storage device, and apply the first cryptographic mechanism to at least a portion of the protected content to convert the portion of the protected content to a portion of un-protected content.

18. The computing device of claim 17, further comprising the storage device identifier and the first cryptographic mechanism each stored in communication with the content access initiator module, wherein the content access initiator module is further operable to communicate, wirelessly, the storage device identifier to the network device and receive, wirelessly, from the network device at least the reference to the first cryptographic mechanism associated with the storage device identifier.

19. The computing device of claim 17, further comprising a computing device identifier associated with the computing device, wherein the content access initiator module is further operable to communicate the computing device identifier and the storage device identifier to the network device, and wherein at least the reference to the first cryptographic mechanism corresponds to a predetermined association between the computing device identifier and the storage device identifier.

20. The computing device of claim 17, further comprising the storage device in removable communication with the computing device, the storage device comprising the storage device identifier and the protected content.

21. The computing device of claim 20, wherein the storage device further comprises non-protected content, wherein the non-protected content includes preview content.

22. The computing device of claim 20, wherein the storage device further comprises non-protected content, wherein the non-protected content includes limited-use content.

23. The computing device of claim 22, wherein the limited-use content limits use based on which computing device is associated with the storage device.

24. The computing device of claim 20, wherein the storage device is selected from a group consisting of a flash media card, a compact disc (CD) and a digital video disc (DVD).

25. The computing device of claim 20, wherein the protected content comprises a plurality of protected content portions, each corresponding to one of a plurality of cryptographic mechanisms, wherein the content access initiator module is operable to receive at least one of the plurality of cryptographic mechanisms corresponding to at least one of the plurality of protected content portions.

26. The computing device of claim 17, further comprising the first cryptographic mechanism and a second cryptographic mechanism stored in communication with the content access initiator module, wherein the protected content comprises the portion of the protected content and another portion of the protected content, wherein the content access initiator module is operable to apply the second cryptographic mechanism to at least the other portion of the protected content to convert the other portion of the protected content to another portion of un-protected content.

27. The computing device of claim 26, further comprising a memory having payment information, wherein the content access initiator module is further operable to forward the payment information to the network device in exchange for the second cryptographic mechanism.

28. The computing device of claim 17, wherein the computing device comprises a wireless device operable on a wireless network.

29. A method for distributing content in a protected environment, the method comprising:

obtaining an association between a first storage device identifier and a cryptographic mechanism, the first storage device identifier identifying at least a portion of a storage device;

obtaining at least a reference to the cryptographic mechanism;

receiving a request from a computing device for access to at least a portion of a protected content, the request comprising a second storage device identifier, the second storage device identifier identifying a different portion of the storage device than the first storage device identifier; and

forwarding at least the reference to the cryptographic mechanism to the computing device based on a correspondence between at least a portion of the second storage device identifier and the first storage device identifier.

30. The method of claim 29, further comprising:

obtaining an association between the first storage device identifier, at least one other portion of the protected content, and at least one other cryptographic mechanism;

obtaining at least a reference to the other cryptographic mechanism;

receiving a request from the computing device for access to at least the one other portion of the protected content, the request comprising the second storage device identifier; and

forwarding at least the reference to the other cryptographic mechanism to the computing device based on the correspondence between the at least a portion of the second storage device identifier and the first storage device identifier.

31. The method of claim 29, further comprising:

obtaining an association between a computing device identifier, the first storage device identifier and the cryptographic mechanism, the computing device identifier associated with the computing device;

wherein receiving the request from the computing device further comprises one other computing device identifier; and

wherein the forwarding at least the reference to the cryptographic mechanism to the computing device further comprises forwarding based on a correspondence between the computing device identifier and the one other computing device identifier.

32. The method of claim 29, further comprising:

obtaining an association between a procurement transaction, the first storage device identifier and the cryptographic mechanism, the procurement transaction associated with the computing device; and

wherein the forwarding at least the reference to the cryptographic mechanism to the computing device further comprises forwarding based on correspondence between the at least the portion of the second storage device identifier, the first storage device identifier, and the procurement transaction.

33. The method of claim 29, further comprising:

receiving a request from at least one other computing device for access to at least a portion of the protected content, the request comprising a third storage device identifier; and

forwarding a purchase option message to the at least one other computing device based on a lack of correspondence between at least the portion of the third storage device identifier, and the first storage device identifier.

34. The method of claim 33, further comprising receiving payment information from one other computing device in response to a purchase option message, and forwarding at least the reference to the cryptographic mechanism to the computing device based on the received payment information.

35. The method of claim 29, wherein the forwarding at least the reference to the cryptographic mechanism further comprises forwarding the cryptographic mechanism.

36. The method of claim 29, wherein the obtaining the association between the first storage device identifier and the cryptographic mechanism further comprises obtaining an association between a plurality of portions of the protected content and a corresponding plurality of cryptographic mechanisms, wherein each of the plurality of portions of the protected content corresponds to at least one cryptographic mechanism in the plurality of the cryptographic mechanisms.

37. The method of claim 29, further comprising:

loading unprotected content on the storage device having the first storage device identifier;

obscuring at least a portion of the unprotected content with the cryptographic mechanism, thereby defining at least the portion of the protected content; and

defining an association between the first storage device identifier and the cryptographic mechanism.

38. The method of claim 29, further comprising:

storing one or more procurement transaction data, wherein each procurement transaction data is associated with a corresponding portion of protected data; and

recognizing authorization of the computing device to access protected content portions based on the stored procurement transaction data.

39. The method of claim 38, further comprising communicating protected content portion-related data to the computing device based on recognition of the authorization to access protected content portions.

40. The method of claim 29, further comprising:

monitoring content access activity of the computing device; and

communicating, to the computing device, content purchase recommendations based on the monitoring of the content access activity.

41. The method of claim 40, further comprising:

monitoring environmental attributes of the computing device; and

communicating, to the computing device, content purchase recommendations based on the monitoring of the environmental attributes.

61. The method of claim 29, wherein the second storage device identifier identifies at least a portion, and less than all, of the protected content on the storage device.

42. A non-transitory computer readable medium tangibly storing a sequence of instructions that, when executed, cause a computer device to perform the actions of:

obtaining an association between a first storage device identifier and a cryptographic mechanism, the first storage device identifier identifying at least a portion of a storage device;

obtaining at least a reference to the cryptographic mechanism;

receiving a request from a computing device for access to at least a portion of a protected content, the request comprising a second storage device identifier, the second storage device identifier identifying a different portion of the storage device than the first storage device identifier; and

forwarding at least the reference to the cryptographic mechanism to the computing device based on a correspondence between at least a portion of the second storage device identifier and the first storage device identifier.

43. At least one processor configured to perform the actions of:

obtaining an association between a first storage device identifier and a cryptographic mechanism, the first storage device identifier identifying at least a portion of a storage device;

obtaining at least a reference to the cryptographic mechanism;

receiving a request from a computing device for access to at least a portion of a protected content, the request comprising a second storage device identifier, the second storage device identifier identifying a different portion of the storage device than the first storage device identifier; and

forwarding at least the reference to the cryptographic mechanism to the computing device based on a correspondence between at least a portion of the second storage device identifier and the first storage device identifier.

44. A network device, comprising:

means for obtaining an association between a first storage device identifier and a cryptographic mechanism, the first storage device identifier identifying at least a portion of a storage device;

means for obtaining at least a reference to the cryptographic mechanism;

means for receiving a request from a computing device for access to at least a portion of a protected content, the request comprising a second storage device identifier, the second storage device identifier identifying a different portion of the storage device than the first storage device identifier; and

means for forwarding at least the reference to the cryptographic mechanism to the computing device based on a correspondence between at least a portion of the second storage device identifier and the first storage device identifier.

45. A network device, comprising:

a processing engine; and

a personalization module executed by the processing engine, the personalization module operable to receive a storage device identifier from a networked computing device, the storage device identifier identifying a storage device that includes protected content, to determine a cryptographic mechanism associated with the storage device identifier and communicate at least a reference to the cryptographic mechanism to the networked computing device, the cryptographic mechanism configured to provide access to less than all of the protected content on the storage device.

46. The network device of claim 45, further comprising a network database in communication with the personalization module, the network database comprising the storage device identifier in association with at least the reference to the cryptographic mechanism.

47. The network device of claim 46, wherein the network database further comprises an identification of a plurality of portions of a protected content in association with a plurality of cryptographic mechanisms, wherein the plurality of portions of the protected content are further associated with the storage device identifier, wherein the personalization module is further operable to receive the identification of one of the plurality of portions of the protected content, and wherein the reference to the cryptographic mechanism further comprises a reference to one of the plurality of cryptographic mechanisms corresponding to the identified one of the plurality of portions of the protected content.

48. The network device of claim 46, wherein the network database further comprises a computing device identifier associated with the storage device identifier, wherein the personalization module is further operable to communicate at least the reference to the cryptographic mechanism to a computing device if the computing device corresponds to the computing device identifier.

49. The network device of claim 46, wherein the network database further comprises procurement information associated with the storage device identifier, wherein the personalization module is further operable to communicate at least the reference to the cryptographic mechanism to a computing device if the computing device is associated with the procurement information.

50. A method of distributing content, comprising:

loading unprotected content on a storage device having a storage device identifier, the storage device configured for removable communication with a computing device;

obscuring at least a portion of the unprotected content with a cryptographic mechanism, thereby defining at least a portion of a protected content;

defining an association between the storage device identifier and the cryptographic mechanism; and

forwarding the defined association to a network device operable to provide access to at least the portion of the protected content to a networked computing device having the storage device identifier.

51. The method of claim 50, wherein the obscuring further comprises obscuring a plurality of portions of the unprotected content with at least one of a plurality of cryptographic mechanisms, thereby defining a plurality of portions of the protected content, wherein the defining the association further comprises associating the plurality of portions of the protected content with the corresponding one of the plurality of cryptographic mechanisms used to obscure the respective portion, and wherein the forwarding the defined association further comprises forwarding to the network device operable to provide access to a requested portion of the protected content.

52. A non-transitory computer-readable storage medium, comprising:

a memory comprising a data storage device identifier and protected content,

wherein the protected content is convertible to unprotected content based on a cryptographic mechanism that is received from a network device upon receipt of the data storage device identifier, the cryptographic mechanism configured to provide access to less than all of the protected content on the non-transitory computer-readable storage medium.

53. The non-transitory computer-readable storage medium of claim 52, wherein the non-transitory computer-readable storage medium is selected from a group consisting of a flash media card, a compact disc (CD), and a digital video disc (DVD).

54. The non-transitory computer-readable storage medium of claim 52, wherein the protected content is selected from a group consisting of a gaming application, an executable application, a text file, an audio file, an image file, and a video file.

55. The non-transitory computer-readable storage medium of claim 52, wherein the non-transitory computer-readable storage medium is a removable non-transitory computer-readable storage medium that is capable of being removably secured and read by a computing device.

56. The non-transitory computer-readable storage medium of claim 55, wherein the computing device is operable to recognize the protected content, communicate the data storage device identifier to the network device, receive the cryptographic mechanism from the network device and apply the cryptographic mechanism to the protected content.

57. The non-transitory computer-readable storage medium of claim 52, wherein the protected content further comprises a plurality of protected content, and each of the plurality of protected content has a content identifier.

58. The non-transitory computer-readable storage medium of claim 57, wherein at least a portion of the plurality of protected content is convertible to unprotected content by communicating a respective content identifier to the network device that responds with one of a plurality of cryptographic mechanisms corresponding with the respective content identifier.

59. The non-transitory computer-readable storage medium of claim 52, wherein the memory further comprises non-protected content, and the non-protected content includes preview content.

60. The non-transitory computer-readable storage medium of claim 52, wherein the memory further comprises non-protected content, and the non-protected content includes limited-use content.