Digital rights management engine systems and methods

• US 9,626,667 B2
• Filed: 10/18/2006
• Issued: 04/18/2017
• Est. Priority Date: 10/18/2005
• Status: Active Grant

• Current Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Original Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Inventors: Boccon-Gibod, Gilles, Boeuf, Julien G., Manente, Michael G., Bradley, William B.
• Primary Examiner(s): KIM, STEVEN S
• Application Number:
  US11/583,527
• Publication Number:
  US 20070185814A1
• Time in Patent Office: 3,835 Days
• Field of Search: 705 51, 705 59, 380278, 380279, 380281-283, 380285, 726 2
• CPC Class Codes: G06F 21/1013 to locations
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06Q 20/123 Shopping for digital content
• CPC Class Codes: G06Q 20/1235 with control of digital rights management [DRM]
• CPC Class Codes: G06Q 20/202 Interconnection or interaction of plural electronic cash registers [ECR] or to host computer, e.g. network details, transfer of information from host to ECR or from ECR to ECR
• CPC Class Codes: G06Q 2220/18 Licensing
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/302 involving the integer factorization problem, e.g. RSA or quadratic sieve [QS] schemes
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Systems and methods are described for performing digital rights management. In one embodiment, a digital rights management engine is provided that evaluates license associated with protected content to determine if a requested access or other use of the content is authorized. In some embodiments, the licenses contain control programs that are executable by the digital rights management engine.

Claims

1. A method of managing enterprise documents, the method comprising:

authoring, by a first software application executing on a first computing device, an electronic document;

encrypting, by a digital rights management plug-in executing on the first computing device, the electronic document;

associating, by the digital rights management plug-in executing on the first computing device, a license with the encrypted electronic document, the license comprising an encrypted first key configured to decrypt the encrypted electronic document and a control program, the control program comprising instructions for determining;

a logical connection between a node associated with a first group of users and a second node based on possession of one or more link objects, and

a callback;

sending, by the first computing device, the encrypted electronic document and the license to a second computing device;

receiving the encrypted electronic document and the license by the second computing device from the first computing device;

determining authorization to access the encrypted electronic document, comprising;

determining the logical connection between the node associated with the first group of users and the second node based on possession of the one or more link objects by executing the control program using a virtual machine of the second computing device, the second computing device comprising the second node, wherein at least one of the one or more link objects comprises an encrypted second key, the second key configured to decrypt the encrypted first key;

determining the callback by executing the control program using the virtual machine;

determining a host application of the second computing device supports the callback using the host application;

calling a control routine according to the callback using the host application;

recording access to the encrypted electronic document in a database by executing the control routine using the virtual machine;

providing an authorization indication to the host application based on execution of the control routine using the virtual machine; and

accessing the encrypted electronic document based on the authorization comprising;

decrypting, by the second computing device, the encrypted second key using a key associated with the second computing device,

decrypting, by the second computing device, the encrypted first key using the decrypted second key,

decrypting, by the second computing device, the electronic document using the decrypted first key, and

accessing the decrypted electronic document.

2. The method of claim 1, wherein encrypting the electronic document and associating the license with the electronic document further comprises:

receiving, by the first computing device, a first template selection from a set of one or more templates, the one or more templates expressing policy conditions that can be imposed on access to electronic documents, the digital rights management plug-in automatically converting the policy conditions expressed by the selected first template into the control program.

3. The method of claim 1, further comprising:

creating, by the digital rights management plug-in, a controller object configured to securely bind the control program with the encrypted first key.

4. The method of claim 3, the controller object including a hash of a content key object and a control object, wherein the content key object comprises the encrypted first key, wherein the method further comprises associating the control program with the control object.

5. The method of claim 4, the controller object being signed with a hashed message authentication code using an unencrypted version of the encrypted first key.

6. The method of claim 4, the controller object being signed with a public key signature of an author of the electronic document.

7. The method of claim 6, the public key signature being signed with a hashed message authentication code using an unencrypted version of the encrypted first key.