Information security systems and methods

• US 9,589,110 B2
• Filed: 04/11/2012
• Issued: 03/07/2017
• Est. Priority Date: 04/11/2011
• Status: Active Grant

• Current Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Original Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Inventors: Carey, W. Knox, Nilsson, Jarl
• Primary Examiner(s): Traore, Fatoumata
• Application Number:
  US13/444,624
• Publication Number:
  US 20120260346A1
• Time in Patent Office: 1,791 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Systems and methods for governing derived electronic resources are provided. In one embodiment, a digital resource is associated with one or more rules and a set of one or more computations, wherein the rules correspond to one or more conditions for accessing the digital resource and the computations operate upon the digital resource in order to provide a specific view of the digital resource that differs from the digital resource.

Claims

1. A method for governing the use of a digital resource, the method comprising:

receiving one or more programs associated with a user, wherein the one or more programs are configured to operate upon the digital resource when executed to generate a derived digital resource by performing at least one computation on information contained in the digital resource, the derived digital resource being different, at least in part, than the digital resource;

associating one or more rules with the digital resource, wherein the rules correspond to one or more conditions for accessing the digital resource;

associating the one or more programs with the digital resource; and

receiving a request to generate the derived digital resource from a system associated with the user;

executing the one or more programs to generate the derived digital resource based on the digital resource wherein the digital resource contains information not included in the generated derived digital resource, and the generated derived resource is a limited view of said digital resource from which it is not possible to recreate the digital resource, and the digital resource is obscured using pseudorandom information based on deterministic seed information associated with a given principal such that the same principal always receives the same obscured view of the digital resource,

and wherein executing the one or more programs comprises enforcing the one or more conditions for accessing the digital resource in connection with execution of the one or more programs; and

transmitting the derived digital resource to the system associated with the user.

2. The method of claim 1, in which the at least one program is associated with a set of users rather than an individual user.

3. The method of claim 2, in which the set of users is specified by explicitly listing the users for whom the at least one program applies.

4. The method of claim 2, in which the set of users is specified by providing an attribute common to the set of users, such that the at least one program is required for any user to whom said attribute applies.

5. The method of claim 1, in which the user whose access is restricted by the computation comprises a non-human principal.

6. The method of claim 1, in which the generated derived resource is dependent upon the user, set of users, or other principal to whom the at least one program applies.

7. The method of claim 1, further comprising:

receiving a new set of programs configured to operate upon the digital resource;

receiving a request for associating the new set of programs with the digital resource.

8. The method of claim 7, further comprising:

approving the request for associating the new set of programs with the digital resource.

9. The method of claim 1, further comprising:

using cryptographic techniques to associate the one or more programs with the digital resource.

10. The method of claim 9, in which the association is made by creating a digitally signed document consisting of the pairing of a unique representation of the digital resource and a unique representation of the one or more programs to be associated with the digital resource.

11. The method of claim 10, in which the representation of the digital resource is the result of applying a one-way function.

12. The method of claim 11, in which the one-way function comprises the SHA-1 hash function.

13. The method of claim 10, in which the representation of the digital resource is a unique identifier associated with the digital resource.

14. The method of claim 13, in which the unique identifier associated with the digital resource was assigned by a trusted third party.

15. The method of claim 14, in which the trusted third party has made the association between the unique identifier and the digital resource by digitally signing a document containing both the identifier and the digital resource, or a representation of the digital resource.

16. The method of claim 10 in which the representation of the one or more programs to be associated with the digital resource comprises the one or more programs expressed in a machine-readable format.

17. The method of claim 10, in which the representation of the one or more programs to be associated with the digital resource is the result of applying a one-way function to a machine-readable representation of the one or more programs.

18. The method of claim 10, in which the representation of the one or more programs to be associated with the digital resource is a unique identifier associated with the one or more programs.

19. The method of claim 18, in which the unique identifier associated with the one or more programs comprises an identifier assigned by a trusted third party.

20. The method of claim 19, in which the trusted third party has made the association between the unique identifier and the one or more programs by digitally signing a document containing both the identifier and the one or more programs, or a representation of the one or more programs.

21. The method of 9, in which the one or more programs are cryptographically associated with a digital resource by packaging a machine-readable representation of the one or more programs in the same secure package used to associate the rules with the digital resource.