DRM system

• US 9,460,271 B2
• Filed: 07/03/2014
• Issued: 10/04/2016
• Est. Priority Date: 09/30/2005
• Status: Active Grant

• Current Assignee: Koninklijke Philips N.V.
• Original Assignee: Koninklijke Philips N.V.
• Inventors: Baks, Wouter, Kamperman, Franciscus L. A. J., Lenoir, Petrus J., Szostek, Lukasz
• Primary Examiner(s): SHEHNI, GHAZAL B
• Application Number:
  US14/323,508
• Publication Number:
  US 20150013017A1
• Time in Patent Office: 824 Days
• Field of Search: 726 26- 30
• US Class Current: 1/1
• CPC Class Codes: G06F 21/1012 to domains
• CPC Class Codes: G06F 21/1015 to users
• CPC Class Codes: G06F 21/105 Arrangements for software license management or administration, e.g. for managing licenses at corporate level
• CPC Class Codes: H04L 67/01 Protocols

Abstract

A method of and system for digital rights management, in which access to a piece of content is granted in accordance with a license owned by a license owner to a client who is a member of a domain. This requires successfully verifying that a membership relation exists between the client and the domain as reflected in a first state variable, and that an association relation exists between the license owner and the domain as reflected in a second state variable. Both relationships are revoked by executing an online protocol between the parties in the relationship after which both remove the corresponding state variable. The domain controller propagates the state administration relating to the domain is propagated to the client so that the client can update its state administration.

Claims

1. A domain controller for digital rights management (DRM) to grant access to content, provided by at least one license provider using a provider device to at least one client using a client device, the domain controller comprising:

a tangible computer-readable storage-memory that is not a transitory propagating wave or signal, comprising;

a first state variable for indicating a membership relation in a domain; and

a second state variable for indicating an association relation with the domain; and

wherein access to content, provided by at least one provider device, is granted to at least one client device when;

the domain controller verifies that at least one provider device includes the second state variable in common with the domain controller indicating the association relation between the at least one license provider device and the domain controller; and

the domain controller verifies that the at least one client device includes the first state variable in common with the domain controller indicating the membership relation of the client device with the domain.

2. The domain controller of claim 1, wherein each of the association relation and the membership relation include a validity period, and each of the association relation and the membership relation are valid only if the respective validity period has not expired.

3. The domain controller of claim 1, wherein the domain controller and the at least one client device include a third state variable, and the access to content is denied when the third state variable is missing from at least one of the following group of:

the domain controller; and

the at least one client device.

4. The domain controller of claim 3, wherein the third state variable is for indicating an identifier for enabling the access to the content.

5. The domain controller of claim 3, wherein the at least one provider device creates and provides the third state variable to the domain controller, which provides the third state variable to the at least one client device.

6. The domain controller of claim 1, wherein the membership relation between and identity of the at least one client device and the domain are expressed in a digital certificate having a validity period.

7. The domain controller of claim 1, wherein the at least one client device includes the first and second state variable and wherein the domain controller relates the domain to the at least one client in order to remove the second state variable.

8. A client device of a client for digital rights management (DRM) for the client to receive access to content, provided by at least one license provider using a provider device, the client device comprising:

a tangible computer-readable storage-memory that is not a transitory propagating wave or signal, comprising a first state variable indicating a membership relation of the client device in a domain; and

a processor;

wherein access to content controlled by at least one provider device is received by the processor when;

a second state variable is in common on the at least one provider device and a domain controller indicating the association relation between the at least one provider device and the domain; and

the processor confirms that the first state variable is in common on the client device and the domain controller.

9. The client device of claim 8, wherein the association relation has a validity period, and the association relation is valid only if the respective validity period has not expired.

10. The client device of claim 8, wherein the domain controller and the client device mutually include a third state variable, and the access to content is denied when the third state variable is missing from one of the group of:

the domain controller; and

the at least one client device.

11. The client device of claim 10, wherein the third state variable includes a representation of an identifier for enabling the access to the content.

12. The client device of claim 10, wherein the at least one provider device creates and provides the third state variable to the domain controller, which provides the third state variable to the client device.

13. The client device of claim 8, wherein the membership relation between, and identity of, the at least one client device and the domain, are expressed in a certificate having a validity period.

14. The client device of claim 8, wherein the at least one client device includes the first and second state variable, and wherein the domain controller relates the domain to the at least one client to remove the second state variable.

15. A provider device of a license provider for digital rights management (DRM) to grant access to content licensed by the license provider, to at least one client using a client device, the provider device comprising:

a tangible computer-readable storage-memory that is not a transitory propagating wave or signal, comprising a second state variable indicating an association relation between a provider device and a domain; and

a processor;

wherein access to the content, provided by the provider device is granted to at least one client device when;

the second state variable is in common on the provider device and a domain controller; and

the processor confirms that a first state variable is in common on the at least one client device and on the domain controller indicating a membership relation of the at least one client device in a domain.

16. The provider device of claim 15, wherein the membership relation has a validity period, and the membership relation is valid only if the respective validity period has not expired.

17. The provider device of claim 15, wherein the domain controller and the provider device include a third state variable, the access to content is denied when the third state variable is missing from one of the group of:

the domain controller; and

the at least one client device.

18. The provider device of claim 17, wherein the third state variable includes a representation of an identifier for enabling the access to the content.

19. The provider device of claim 17, wherein the provider device creates and provides the third state variable to the domain controller, which provides the third state variable to the at least one client device.

20. The provider device of claim 15, wherein the membership relation between and identity of the at least one client device and the domain are expressed in a certificate having a validity period.

21. The provider device of claim 15, wherein the at least one client device includes the first and second state variable and wherein the domain controller relates the domain to the at least one client to remove the second state variable.

22. A method of operating a domain controller for digital rights management (DRM) to grant access to content, provided by at least one license provider using a provider device, to at least one client using a client device, the method comprising acts of:

in a domain controller of a domain;

storing in a tangible computer-readable storage-memory that is not a transitory propagating wave or signal;

a first state variable for indicating a membership relation of a client device in the domain of the domain controller; and

a second state variable for indicating an association relation between the domain and a provider device; and

granting access to content, provided by the provider device, to at least one client device when;

the second state variable is in common with a second state variable of the provider device, indicating the association relation of the at least one provider device with the domain, for accessing the content; and

the first state variable is in common with a first state variable of the at least one client device, indicating the membership relation of the client device in the domain.

23. A method of operating a client device of a client for digital rights management (DRM) to grant itself access to content, provided by at least one provider device, to the client device, the method comprising acts of:

in a client device;

storing a first state variable for indicating a membership relation of the client device in a domain, in a tangible computer-readable storage-memory that is not a transitory propagating wave or signal;

granting itself access to content, provided by at least one provider device, to the client device when;

a second state variable, is in common on the at least one provider device and on a controller of the domain, indicating an association relation between the at least one provider device and the domain; and

the first state variable is in common on the client device and the domain controller.

24. A method of operating a provider device of a license provider for digital rights management (DRM) to grant access to content provided by the license provider device, to at least one client using a client device, the method comprising acts of:

in a provider device of a provider;

storing in a tangible computer-readable storage-memory that is not a transitory propagating wave or signal a second state variable for indicating an association relation between the provider device and the domain; and

granting access to content, provided by the provider device, to at least one client device when;

the second state variable is in common on the provider device and on a domain controller of a domain, indicating the association relation between the provider device and the domain; and

a first state variable is in common on the at least one client device and the domain controller, indicating the membership relation of the at least one client device, in the domain.

25. A tangible computer-readable storage-media that is not a transitory propagating signal or wave, comprising control instructions for a method of operating a domain controller for digital rights management (DRM) to grant access to content, provided by at least one provider device, to at least one client device, the method comprising acts of:

in a domain controller of a domain;

storing in a tangible computer-readable storage-memory that is not a transitory propagating wave or signal;

a first state variable for indicating a membership relation of a client device in the domain of the domain controller; and

a second state variable for indicating an association relation between the domain and at least one provider device of content; and

granting access to the content, provided by the at least one provider device, to the at least one client device when;

the second state variable is in common with a second state variable of the domain controller, indicating the association relation of the at least one provider device with the domain; and

the first state variable is in common with a first state variable of the at least one client device, indicating the membership relation of the client device in the domain.

26. A tangible computer-readable storage-media that is not a transitory propagating signal or wave, comprising control instructions for a method of operating a client device for digital rights management (DRM) to receive access to content, provided by at least one license provider using a provider device, to the client using the client device, the method comprising acts of:

in a client device;

storing a first state variable for indicating a membership relation of the client device in a domain, in a tangible computer-readable storage-memory that is not a transitory propagating wave or signal; and

receiving access to content, provided by the at least one provider device, to the client device when;

a second state variable is in common on the at least one provider device and on a controller of the domain, indicating the association relation between the at least one provider device and the domain; and

the first state variable is in common on the client device and the domain controller indicating the membership relation of the client device in a domain.

27. A tangible computer-readable storage-media that is not a transitory propagating signal or wave, comprising control instructions for a method of operating a provider device of a license provider for digital rights management (DRM) to grant access to content provided by the provider device, to at least one client using a client device, the method comprising acts of:

in a provider device of a provider;

storing in a tangible computer-readable storage-memory that is not a transitory propagating wave or signal a second state variable for indicating an association relation between the provider device and the domain; and

granting access to content, provided by the provider device, to the at least one client device when;

the second state variable is in common on the provider device and on the domain controller indicating the association relation between the provider device and the domain; and

a first state variable is in common on the at least one client device and the domain controller, indicating the membership relation, of the at least one client device, in the domain.

28. A method of digital rights management in a domain of users and networked devices, wherein an association relation between a license provider and the domain is expressed in a digital certificate in which the license provider and the domain are identified, and wherein a membership relation between a client and the domain is indicated by a mutual variable, the method comprising:

granting, by a first device, access by a second device, to a piece of content stored in a third device in accordance with a digital certificate provided by a provider device to the client device of a client who is a member of the domain, conditional upon successfully;

verifying, by a fourth device, the existence of a membership relation between the client and the domain as reflected in a first state variable, and that the value of a domain configuration number attributed to the certificate expressing the membership relation between the client and the domain is equal to or greater than the value of the first state variable, the first state variable is maintained both by a device of the client and by a controller of the domain and is incremented when a relation in the domain changes;

verifying, by a fifth device, the existence of an association relation between the license provider and the domain as indicated by a mutual second state variable, and that the value of a license configuration number attributed to the certificate expressing the association relation between the License Provider and the Domain is equal to or greater than the value of the second state variable, the second state variable is maintained both by the controller of the domain and by a license provider controller associated with the license provider and is incremented when a license targeted to the license provider changes;

executing, by a sixth device, an online protocol for revoking the membership relation between the controller of the domain and the client after which both the controller of the domain and the device of the client remove the first state variable;

executing, by a seventh device, an online protocol for revoking the association relation between the license provider device and the controller of the domain after which the controller of the domain removes the second state variable from the domain and after which a state administration comprising the first and second state variables relating to the domain is propagated to the device of the client, which removes the second state variable from the device of the client,

Wherein the first, second, third, fourth, fifth, six and seventh devices are each a same or different one or more of;

the provider device, the client device, or one or more other devices of the network.

29. The method of claim 28, in which the state administration includes a validity period of the association relation and the membership relation, and the verification of the association relation and the membership relation comprises evaluating a validity period of the relation in question and successfully verifying the association relation in question only if the validity period has not expired.

30. The method of claim 28, in which the domain controller and the device of the client maintain a third state variable to guard the state of the granting of access, and the third state variable permits the termination of access by being removed.

31. The method of claim 30, in which the third state variable contains a representation of an identifier for the grant of access.

32. The method of claim 30, in which the provider device of the license provider creates the third state variable and propagates the third state variable to the domain controller that propagates the third state variable to the client.

33. The method of claim 28, in which the certificate carries an identification of its validity period.

34. The method of claim 28, wherein the device of the client has a state administration comprising the first and second state variable and wherein the domain controller propagates a state administration relating the domain to the client, so that the device of the client can update its state administration and remove the second state variable reflecting the association relation.

35. The method of claim 28, wherein the first device is different from the second device, and the fourth device is the same as the fifth device.

36. A system for digital rights management in a domain comprising devices and users, wherein an association relation between a license provider and the domain is expressed in a certificate in which the license provider and the domain are identified, and wherein a membership relation between a client and the domain is expressed in a certificate in which the client and the domain are identified, the system is configured for granting access to a piece of content in accordance with a digital certificate provided by the digital certificate provider, to a client who is a member of the domain, conditional upon successfully:

verifying the existence of a membership relation between a client and a domain as reflected in a first state variable, and that the value of a domain configuration number attributed to a digital certificate expressing the membership relation between the client and the domain is equal to or greater than the value of the first state variable, and

verifying the existence of an association relation between the license provider and the domain as indicated in a second state variable, and that the value of a license configuration number in the certificate expressing the association relation between a license provider and the Domain is equal to or greater than the value of the second state variable, a device of the client and a controller of the domain being configured to both maintain the first state variable, and to increment the first state variable when a relation in the domain changes and being configured to revoke the membership relation by executing an online protocol between them after which both remove the first state variable,

the controller of the domain and a provider device of the license provider being configured to both maintain the second state variable, and to increment the second state variable when access to content granted by the license provider changes, and being configured to revoke the association relation by executing an online protocol between them after which both remove the second state variable, the controller of the domain further being configured to propagate the state administration relating to the domain to the client for causing the client to remove the second state variable.