Method and apparatus for secure content delivery over broadband access networks

• US 20060272023A1
• Filed: 01/30/2006
• Published: 11/30/2006
• Est. Priority Date: 11/16/1998
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Eichin, Mark W., Schmeidler, Yonah, Atkins, Derek, Rostcheck, David J.
• Granted Patent: US 7,707,641 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: Y10S 707/99931 Database or file accessing

Abstract

A system for secure delivery of on-demand content over broadband access networks utilizes a pair of servers of security mechanisms to prevent client processes from accessing and executing content without authorization. A plurality of encrypted titles are stored on a content server coupled to the network. An access server also coupled to the network contains the network addresses of the titles and various keying and authorization data necessary to decrypt and execute title. A client application executing on a user'"'"'s local computer system is required to retrieve the address, keying and authorization data from the access server before retrieving a title from the content server and enabling execution of the title on a user'"'"'s local computer system.

Claims

1. In a system for delivery of a content title to a client system over a computer network, the system including a content server having at least one content title stored thereon in unexecutable form, a method for creating an activator for processing a content title into executable form, comprising:

providing cryptographic data for decrypting content title data;

embedding the cryptographic data in obfuscated bytecode to inhibit unauthorized extraction of the cryptographic data, wherein the obfuscated bytecode implements executable instructions for decryption; and

storing the activator in the form of the obfuscated bytecode at a location on the computer network accessible by the client system.

2. The method of claim 1, further comprising

adding authorization data to the activator, the authorization data identifying a time period in which the content title remains in executable form.

3. The method of claim 2, further comprising

creating a token authorizing the client system to access a content title stored on the content server;

and

storing the token with the activator at a location on the computer network accessible by the client system.

4. The method of claim 2, wherein the activator is valid for a single use.