Interoperable systems and methods for peer-to-peer service orchestration

• US 9,317,843 B2
• Filed: 10/27/2011
• Issued: 04/19/2016
• Est. Priority Date: 06/05/2003
• Status: Expired due to Fees

• Current Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Original Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Inventors: Bradley, William, Maher, David, Boccon-Gibod, Gilles
• Primary Examiner(s): Hewitt, II, Calvin L
• Assistant Examiner(s): Nilforoush, Mohammad A
• Application Number:
  US13/283,126
• Publication Number:
  US 20120159642A1
• Time in Patent Office: 1,636 Days
• Field of Search: 705 50- 79
• US Class Current: 1/1
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/1073 Conversion
• CPC Class Codes: G06F 21/1084 via third party
• CPC Class Codes: G06F 21/1085 Content sharing, e.g. peer-to-peer [P2P]
• CPC Class Codes: G06Q 20/1235 with control of digital rights management [DRM]
• CPC Class Codes: G06Q 2220/10 Usage protection of distributed data files
• CPC Class Codes: G06Q 2220/18 Licensing
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1061 using node-based peer discovery mechanisms static access to replicated servers H04L67/1006; service discovery H04L67/51
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 : using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0861 : Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/3263 : involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3271 : using challenge-response

Abstract

Systems and methods are described for performing policy-managed, peer-to-peer service orchestration in a manner that supports the formation of self-organizing service networks that enable rich media experiences. In one embodiment, services are distributed across peer-to-peer communicating nodes, and each node provides message routing and orchestration using a message pump and workflow collator. Distributed policy management of service interfaces helps to provide trust and security, supporting commercial exchange of value. Peer-to-peer messaging and workflow collation allow services to be dynamically created from a heterogeneous set of primitive services. The shared resources are services of many different types, using different service interface bindings beyond those typically supported in a web service deployments built on UDDI, SOAP, and WSDL. In a preferred embodiment, a media services framework is provided that enables nodes to find one another, interact, exchange value, and cooperate across tiers of networks from WANs to PANs.

Claims

1. A method of accessing content according to a DRM policy, comprising:

receiving, by a service access point of a device, from one or more web services agents;

an encrypted content item,

a control program containing executable code,

an encrypted content key for decrypting the encrypted content item,

a first link object digitally-signed by a link key, the first link object representing a relationship between a first node object and a second node object and comprising references to first node attributes included in the first node object and second node attributes included in the second node object, and

a certificate for validating the link key, the certificate comprising a constraint program, the constraint program imposing link conditions on use of the link key to digitally sign link objects, and the link conditions depending on the first node attributes and the second node attributes;

determining, by the device, authorization to access the encrypted content item, comprising;

validating the first link object, comprising executing the constraint program and determining by the constraint program satisfaction of the link conditions based on the first node attributes and the second node attributes referenced by the first link object, verifying the certificate based on satisfaction of the link conditions, validating the use of the link key to digitally sign the first link object based on verification of the certificate, and validating the first link object based on validation of the use of the link key to digitally sign the first link object,

constructing an authorization graph by processing two or more link objects, including the validated first link object;

generating a chain of keys by processing the two or more link objects, including the validated first link object;

querying the authorization graph by executing the executable code contained in the control program, and

generating a target node key by processing the chain of keys; and

based on a result of querying the authorization graph, generating by the device a decrypted version of the encrypted content key by decrypting the encrypted content key using the target node key, generating by the device a decrypted content item by decrypting the encrypted content item using the decrypted version of the encrypted content key, and accessing by the device the decrypted content item.

2. The method of claim 1, wherein a DRM profile defines the first link object, the first node attributes, and the second node attributes.

3. The method of claim 2, wherein the DRM profile defines a semantics of the relationship represented by the first link object.

4. The method of claim 3, wherein the DRM profile defines the relationship as one of ownership or membership.

5. The method of claim 2, wherein the DRM profile is expressed in WSDL and the first node object and the second node object are web services agents.

6. The method of claim 1, wherein generating the chain of keys comprises processing a chain of link objects connecting a first node to a target node.

7. The method of claim 6, wherein the chain of link objects connects the first node to the target node through at least one intermediate node.

8. The method of claim 6, wherein each link object in the chain of link objects comprises cryptographic data and a reference to a “

from”

node and a “

to”

node.

9. The method of claim 8, wherein the cryptographic data comprises a key of the “

to”

node encrypted with a key of the “

from”

node.

10. The method of claim 9, wherein the key of the “

to”

node is a symmetric key or a private key.

11. The method of claim 1, wherein the executable code comprises instructions for querying the authorization graph for an existence of a first path and a second path, and querying the authorization graph by executing the executable code contained in the control program comprises determining the existence of the first path and the second path.

12. The method of claim 11, wherein the first path connects a first path node to a second path node and the second path connects a third path node to a fourth path node.

13. The method of claim 11, wherein the executable code comprises byte code.

14. A non-transitory computer readable medium containing instructions that, when executed by a processor of a device, cause the device to perform operations comprising:

receiving, by a service access point of the device, from one or more web services agents;

an encrypted content item,

a control program containing executable code,

an encrypted content key for decrypting the encrypted content item,

a first link object digitally-signed by a link key, the first link object representing a relationship between a first node object and a second node object and comprising references to first node attributes included in the first node object and second node attributes included in the second node object, and

a certificate for validating the link key, the certificate comprising a constraint program, the constraint program imposing link conditions on use of the link key to digitally sign link objects, and the link conditions depending on the first node attributes and the second node attributes;

determining, by the device, authorization to access the encrypted content item, comprising;

validating the first link object, comprising executing the constraint program and determining by the constraint program satisfaction of the link conditions based on the first node attributes and the second node attributes referenced by the first link object, verifying the certificate based on satisfaction of the link conditions, validating the use of the link key to digitally sign the first link object based on verification of the certificate, and validating the first link object based on validation of the use of the link key to digitally sign the first link object,

constructing an authorization graph by processing two or more link objects, including the validated first link object;

generating a chain of keys by processing the two or more link objects, including the validated first link object;

querying the authorization graph by executing the executable code contained in the control program, and

generating a target node key by processing the chain of keys; and

based on a result of querying the authorization graph, generating by the device a decrypted version of the encrypted content key by decrypting the encrypted content key using the target node key, generating by the device a decrypted content item by decrypting the encrypted content item using the decrypted version of the encrypted content key, and accessing by the device the decrypted content item.

15. The non-transitory computer readable medium of claim 14, wherein a DRM profile expressed in WSDL defines the first link object, a semantics of the relationship represented by the first link object, the first node attributes, and the second node attributes;

and wherein the first node object and the second node object are web services agents.

16. The non-transitory computer readable medium of claim 14, wherein generating the chain of keys comprises processing a chain of link objects connecting a first node to a target node through at least one intermediate node.

17. The non-transitory computer readable medium of claim 16, wherein each link object in the chain of link objects comprises cryptographic data and a reference to a “

from”

node and a “

to”

node.

18. The non-transitory computer readable medium of claim 17, wherein the cryptographic data comprises a key of the “

to”

node encrypted with a key of the “

from”

node.

19. The non-transitory computer readable medium of claim 14, wherein the executable code comprises instructions for querying the authorization graph for an existence of a first path connecting a first path node to a second path node and a second path connecting a third path node to a fourth path node, and querying the authorization graph by executing the executable code contained in the control program comprises determining the existence of the first path and the second path.

20. A device for obtaining and accessing an encrypted content item, comprising at least one processor, and a non-transitory computer memory containing instructions that, when executed by the at least one processor, cause the processor to perform operations comprising:

receiving, by a service access point of the device, from one or more web services agents;

the encrypted content item,

a control program containing executable code,

an encrypted content key for decrypting the encrypted content item,

a first link object digitally-signed by a link key, the first link object representing a relationship between a first node object and a second node object and comprising references to first node attributes included in the first node object and second node attributes included in the second node object, and

a certificate for validating the link key, the certificate comprising a constraint program, the constraint program imposing link conditions on use of the link key to digitally sign link objects, and the link conditions depending on the first node attributes and the second node attributes;

determining, by the device, authorization to access the encrypted content item, comprising;

validating the first link object, comprising executing the constraint program and determining by the constraint program satisfaction of the link conditions based on the first node attributes and the second node attributes referenced by the first link object, verifying the certificate based on satisfaction of the link conditions the constraint program, validating the use of the link key based on the certificate, and validating the first link object based on validation of the use of the link key to digitally sign the first link object,

constructing an authorization graph by processing two or more link objects, including the validated first link object;

generating a chain of keys by processing the two or more link objects, including the validated first link object;

querying the authorization graph by executing the executable code contained in the control program; and

generating a target node key by processing the chain of keys; and

based on a result of querying the authorization graph, generating by the device a decrypted version of the encrypted content key by decrypting the encrypted content key using the target node key, generating by the device a decrypted content item by decrypting the encrypted content item using the decrypted version of the encrypted content key, and accessing by the device the decrypted content item.

21. The device of claim 20, wherein a DRM profile expressed in WSDL defines the first link object, a semantics of the relationship represented by the first link object, the first node attributes, and the second node attributes;

and wherein the first node object and the second node object are web services agents.

22. The device of claim 20, wherein generating the chain of keys comprises processing a chain of link objects connecting a first node to a target node through at least one intermediate node, each link object in the chain of link objects comprising cryptographic data and a reference to a “

from”

node and a “

to”

node, the cryptographic data comprising a key of the “

to”

node encrypted with a key of the “

from”

node.

23. The device of claim 20, wherein the executable code comprises instructions for querying the authorization graph for an existence of a first path connecting a first path node to a second path node and a second path connecting a third path node to a fourth path node;

and querying the authorization graph by executing the executable code contained in the control program comprises determining the existence of the first path and the second path.