System and methods for assignation and use of media content subscription service privileges

• US 9,319,405 B2
• Filed: 06/16/2014
• Issued: 04/19/2016
• Est. Priority Date: 05/30/2003
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Johnson, Barry W., Riemenschneider, Kristen R. O., Russell, David C.
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): Khan, Sher A
• Application Number:
  US14/305,904
• Publication Number:
  US 20140298371A1
• Time in Patent Office: 673 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/51 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 18/22 Matching criteria, e.g. proximity measures
• CPC Class Codes: G06F 21/1076 Revocation
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06V 40/13 Sensors therefor
• CPC Class Codes: G06V 40/1365 Matching; Classification
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04N 21/25875 involving end-user authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; arrangements for secret or secure communication including means for verifying the identity or authority of a user of the system H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/4415 using biometric characteristics of the user, e.g. by voice recognition or fingerprint scanning cryptography using biological data H04L9/3231; authentication in networks using biometric H04L63/0861

Abstract

This invention describes a system and methods for media content subscription service distribution; typical services include cable television, premium content channels, pay-per-view, XM radio, and online mp3 services. Subscribers use portable electronic devices to store digital certificates certifying the subscriber'"'"'s privileges and an assigned public key. The devices can communicate with specially enabled televisions, radios, computers, or other media presentation apparatuses. These, in turn, can communicate with central databases owned by the provider, for verification purposes. Methods of the invention describe media content subscription service privilege issuing and use. The invention additionally describes methods for protecting media content transmitted to users with a variety of encryption schemes. The invention also comprises methods for subscribed users to bestow a subset of their privileges to a number of secondary users, with appropriate permission from the media content subscription service provider.

Claims

1. A method, comprising:

authenticating, at a first personal identification device, a biometric input of a first user based on a biometric template of the first user stored at the first personal identification device;

sending a subscription privilege associated with the first user from the first personal identification device of the first user to a media device when the biometric input is authentic such that the media device performs at least one of (1) ceasing to inhibit media output from a media provider based on the subscription privilege associated with the first user or (2) decrypting encrypted media output from the media provider based on the subscription privilege associated with the first user, the media being associated with a premium content channel of the media provider, the subscription privilege associated with the first user being associated with the premium content channel of the media provider, the subscription privilege associated with the first user being configured to permit full access to the media from the media provider associated with the subscription privilege associated with the first user;

producing, at the first personal identification device, a subscription privilege associated with a second user different from the first user, the subscription privilege associated with the second user being configured to permit limited access to the media from the media provider associated with the subscription privilege associated with the first user; and

sending from the first personal identification device to a second personal identification device the subscription privilege associated with the first user and the subscription privilege associated with the second user, the second personal identification device being associated with the second user.

2. The method of claim 1, wherein the sending the subscription privilege associated with the first user from the first personal identification device of the first user to the media device is performed such that the media device authenticates the subscription privilege associated with the first user.

3. The method of claim 1, wherein the biometric input is a first biometric input and the media device is a first media device at a first location, the method further comprising:

authenticating, at the first personal identification device, a second biometric input of the first user based on the biometric template of the first user stored at the first personal identification device; and

sending the subscription privilege associated with the first user from the first personal identification device of the first user to a second media device at a second location when the second biometric input is authentic such that the second media device performs at least one of (1) ceasing to inhibit the media output from the media provider based on the subscription privilege associated with the first user or (2) decrypting the encrypted media output from the media provider based on the subscription privilege associated with the first user, the second location being different from the first location, the media from the media provider being concurrently transmitted to the first media device and the second media device.

4. The method of claim 1, wherein the subscription privilege associated with the first user excludes biometric information of the first user.

5. The method of claim 1, wherein the media device has been pre-registered with a subscription service of the media provider.

6. The method of claim 1, further comprising:

deleting the biometric template from the first personal identification device upon unauthorized attempted physical or logical access.

7. The method of claim 1, wherein the biometric input is a first biometric input, the subscription privilege associated with the first user being a first subscription privilege associated with the first user, the premium content media channel having a frequency, the method further comprising:

sending a second subscription privilege associated with the first user from the first personal identification device of the first user to the media device when a second biometric input is authentic such that the media device performs at least one of (1) ceasing to inhibit media output associated with a second premium content media channel from a media provider based on the second subscription privilege associated with the first user or (2) decrypting encrypted media output associated with the second premium content media channel based on the second subscription privilege associated with the first user, the second subscription privilege associated with the first user being associated with the second premium content media channel having a frequency different than the frequency of the first premium content media channel.

8. The method of claim 1, further comprising:

verifying that the subscription privilege associated with the second user is a subset of the subscription privilege associated with the first user before the sending from the first personal identification device to the second personal identification device.

9. The method of claim 1, wherein the subscription privilege associated with the second user includes a restriction determined by the first user, the restriction being associated with media output based on the subscription privilege associated with the second user.

10. A method, comprising:

outputting, at a media device, media associated with a first media channel of a media provider;

inhibiting, at the media device, output of media associated with a second media channel of the media provider different from the first media channel, at least a portion of the media associated with the second media channel received at the media device concurrently with receipt at the media device of at least a portion of the media associated with the first media channel;

receiving, at the media device, from a first personal identification device a biometrically-authenticated subscription privilege associated with a first user, the biometrically-authenticated subscription privilege excluding biometric data of the first user, the biometrically-authenticated subscription privilege being configured to permit media output associated with the second media channel;

outputting, at the media device, media associated with the second media channel after the receiving the biometric ally-authenticated subscription privilege associated with the first user;

receiving, at the media device, from a second personal identification device the biometrically-authenticated subscription privilege associated with the first user and a biometrically-authenticated subscription privilege associated with a second user, the biometrically-authenticated subscription privilege associated with the second user excludes biometric data of the second user, the second personal identification device being associated with the second user;

verifying, at the media device, the biometrically-authenticated subscription privilege associated with the first user and the biometrically-authenticated subscription privilege associated with the second user; and

outputting, at the media device, media associated with the second media channel based on the biometrically-authenticated subscription privilege associated with the second user when the biometrically-authenticated subscription privilege associated with the first user is verified and when the biometrically-authenticated subscription privilege associated with the second user is verified.

11. The method of claim 10, further comprising:

sending to the media provider, before the outputting the media associated with the second media channel, the subscription privilege associated with the first user such that the media provider authenticates the subscription privilege associated with the first user.

12. The method of claim 10, further comprising:

verifying, before the outputting the media associated with the second media channel, the subscription privilege associated with the first user at the media device.

13. The method of claim 10, wherein the biometrically-authenticated subscription privilege associated with the first user is associated with the second media channel, the method further comprising:

receiving from the first personal identification device a biometrically-authenticated subscription privilege associated with a third media channel different from the first media channel and different from the second media channel, the biometrically-authenticated subscription privilege associated with the third media channel is associated with the first user and excludes the biometric data of the first user; and

outputting media associated with the third media channel when the biometrically-authenticated security subscription associated with the third media channel is verified.

14. The method of claim 10, wherein the first media channel has a frequency, the second media channel has a frequency different than the frequency of the first media channel, the method further comprising:

decrypting the media associated with the second media channel after the receiving the subscription privilege associated with the first user and when the media is encrypted.

15. The method of claim 10, wherein the verifying includes:

verifying that the biometrically-authenticated subscription privilege associated with the second user is authentic based on a digital signature associated with the first user; and

verifying that the biometrically-authenticated subscription privilege associated with the first user is authentic based on a digital signature associated with the media provider.

16. The method of claim 10, wherein the biometrically-authenticated subscription privilege associated with the second user includes a restriction determined by the first user, the restriction being associated with the media associated with the second media channel, the outputting, at the media device, the media associated with the second channel being based on the restriction.

17. A non-transitory computer-readable medium comprising executable instructions that, when executed by a processing system having at least one hardware processor, perform operations comprising:

authenticating, at a first personal identification device, a biometric input of a first user based on a biometric template of the first user stored at the first personal identification device;

sending a subscription privilege associated with the first user from the first personal identification device of the first user to a media device when the biometric input is authentic such that the media device performs at least one of (1) ceasing to inhibit media output from a media provider based on the subscription privilege associated with the first user or (2) decrypting encrypted media output from the media provider based on the subscription privilege associated with the first user, the media being associated with a premium content channel of the media provider, the subscription privilege associated with the first user being associated with the premium content channel of the media provider, the subscription privilege associated with the first user being configured to permit full access to the media from the media provider associated with the subscription privilege associated with the first user;

producing, at the first personal identification device, a subscription privilege associated with a second user different from the first user, the subscription privilege associated with the second user being configured to permit limited access to the media from the media provider associated with the subscription privilege associated with the first user; and

sending from the first personal identification device to a second personal identification device the subscription privilege associated with the first user and the subscription privilege associated with the second user, the second personal identification device being associated with the second user.

18. A system comprising:

a processing system comprising at least one hardware processor, coupled to a memory, the memory containing executable instructions that, when executed by the processing system, perform operations comprising;

authenticating, at a first personal identification device, a biometric input of a first user based on a biometric template of the first user stored at the first personal identification device;

sending a subscription privilege associated with the first user from the first personal identification device of the first user to a media device when the biometric input is authentic such that the media device performs at least one of (1) ceasing to inhibit media output from a media provider based on the subscription privilege associated with the first user or (2) decrypting encrypted media output from the media provider based on the subscription privilege associated with the first user, the media being associated with a premium content channel of the media provider, the subscription privilege associated with the first user being associated with the premium content channel of the media provider, the subscription privilege associated with the first user being configured to permit full access to the media from the media provider associated with the subscription privilege associated with the first user;

producing, at the first personal identification device, a subscription privilege associated with a second user different from the first user, the subscription privilege associated with the second user being configured to permit limited access to the media from the media provider associated with the subscription privilege associated with the first user; and

sending from the first personal identification device to a second personal identification device the subscription privilege associated with the first user and the subscription privilege associated with the second user, the second personal identification device being associated with the second user.

19. A non-transitory computer-readable medium comprising executable instructions that, when executed by a processing system having at least one hardware processor, perform operations comprising:

outputting, at a media device, media associated with a first media channel of a media provider;

inhibiting, at the media device, output of media associated with a second media channel of the media provider different from the first media channel, at least a portion of the media associated with the second media channel received at the media device concurrently with receipt at the media device of at least a portion of the media associated with the first media channel;

receiving, at the media device, from a first personal identification device a biometrically-authenticated subscription privilege associated with a first user, the biometrically-authenticated subscription privilege excluding biometric data of the first user, the biometrically-authenticated subscription privilege being configured to permit media output associated with the second media channel;

outputting, at the media device, media associated with the second media channel after the receiving the biometric ally-authenticated subscription privilege associated with the first user;

receiving, at the media device, from a second personal identification device the biometrically-authenticated subscription privilege associated with the first user and a biometrically-authenticated subscription privilege associated with a second user, the biometrically-authenticated subscription privilege associated with the second user excludes biometric data of the second user, the second personal identification device being associated with the second user;

verifying, at the media device, the biometrically-authenticated subscription privilege associated with the first user and the biometric ally-authenticated subscription privilege associated with the second user; and

outputting, at the media device, media associated with the second media channel based on the biometrically-authenticated subscription privilege associated with the second user when the biometrically-authenticated subscription privilege associated with the first user is verified and when the biometrically-authenticated subscription privilege associated with the second user is verified.

20. A system comprising:

a processing system comprising at least one hardware processor, coupled to a memory, the memory containing executable instructions that, when executed by the processing system, perform operations comprising;

outputting, at a media device, media associated with a first media channel of a media provider;

inhibiting, at the media device, output of media associated with a second media channel of the media provider different from the first media channel, at least a portion of the media associated with the second media channel received at the media device concurrently with receipt at the media device of at least a portion of the media associated with the first media channel;

receiving, at the media device, from a first personal identification device a biometrically-authenticated subscription privilege associated with a first user, the biometrically-authenticated subscription privilege excluding biometric data of the first user, the biometrically-authenticated subscription privilege being configured to permit media output associated with the second media channel;

outputting, at the media device, media associated with the second media channel after the receiving the biometric ally-authenticated subscription privilege associated with the first user;

receiving, at the media device, from a second personal identification device the biometrically-authenticated subscription privilege associated with the first user and a biometrically-authenticated subscription privilege associated with a second user, the biometrically-authenticated subscription privilege associated with the second user excludes biometric data of the second user, the second personal identification device being associated with the second user;

verifying, at the media device, the biometrically-authenticated subscription privilege associated with the first user and the biometric ally-authenticated subscription privilege associated with the second user; and

outputting, at the media device, media associated with the second media channel based on the biometrically-authenticated subscription privilege associated with the second user when the biometrically-authenticated subscription privilege associated with the first user is verified and when the biometrically-authenticated subscription privilege associated with the second user is verified.