SECURING DIGITAL CONTENT SYSTEM AND METHOD

• US 20080310623A1
• Filed: 07/29/2008
• Published: 12/18/2008
• Est. Priority Date: 10/20/2003
• Status: Active Grant

• Current Assignee: Digital Reg of Texas, LLC (DRM Technologies LLC)
• Original Assignee: Digital Reg of Texas, LLC (DRM Technologies LLC)
• Inventors: Ornstein, Seth, PHILLIPS, Eugene B. II
• Granted Patent: US 7,979,697 B2
• Time in Patent Office: Days
• US Class Current: 380/29
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A system and method of encrypting digital content in a digital container and securely locking the encrypted content to a particular user and/or computer or other computing device is provided. The system uses a token-based authentication and authorization procedure and involves the use of an authentication/authorization server. This system provides a high level of encryption security equivalent to that provided by public key/asymmetric cryptography without the complexity and expense of the associated PKI infrastructure. The system enjoys the simplicity and ease of use of single key/symmetric cryptography without the risk inherent in passing unsecured hidden keys. The secured digital container when locked to a user or user'"'"'s device may not open or permit access to the contents if the digital container is transferred to another user'"'"'s device. The digital container provides a secure technique of distributing electronic content such as videos, text, data, photos, financial data, sales solicitations, or the like.

Claims

1. :

A system for securely delivering data, comprising;

a first computer based component that creates a electronic container having electronic content and a electronic container identifier;

a second computer based component that encrypts at least one data block of the electronic content using a symmetric encryption technique and to encrypt at least one header associated with at least one data block of the electronic content using an asymmetric encryption technique, the at least one header including a symmetric decryption key; and

wherein the at least one data block is configured to be decrypted and accessed by one of the user and a device associated with the user based on an authentication of one of the user and the device associated with the user with the electronic container identifier.

2. :

The system of claim 1, further comprising a third computer based component that re-keys the at least one header using data associated with one of the user and the device associated with the user to lock at least a portion of the electronic content to one of the user and the device associated with the user.

3. :

The system of claim 1, wherein the at least one header is at least two headers with each header including a different symmetric encryption key.

4. :

The system of claim 3, wherein the at least one data block comprises at least two sets of data blocks each having a different symmetric key in a respective one of the at least two headers.

5. :

The system of claim 3, wherein the at least two headers are encrypted with different asymmetric keys.

6. :

The system of claim 1, wherein the electronic content includes at least any one of;

a video file, a text file, an audio file, a data file and an executable file.

7. :

The system of claim 1, wherein the electronic container is configured so that the portions of the electronic content can be streamed with a first portion of the electronic content being protected from access while a second portion of the electronic content is decrypted and provided for use to an application.

8. :

The system of claim 7, wherein the first portion and second portion dynamically change to comprise different data blocks during the streaming.

9. :

An apparatus for securely accessing data, comprising;

a first computer based component configured to re-key at least one header of a least one data block associated with electronic content using data associated with one of a user and a device associated with the user to lock at least a portion of the electronic content to one of the user and the device associated with the user, wherein the header contains a symmetric encryption key and the at least one header is encrypted using a asymmetric encryption technique,

wherein the first computer based component locks at least a portion of the electronic content to at least one of the user and the device associated with the user so that the electronic content can be accessed by one of the user and the device associated with the user upon authentication of one of the user and the device associated with the user with a container identifier that provides the electronic content.

10. :

The apparatus of claim 9, further comprising a second computer based component configured to protect a first subset of the electronic content from access while providing a second subset of the electronic content to an application for use.

11. :

The apparatus of claim 10, wherein the first subset and second subset change dynamically in content during use.

12. :

The apparatus of claim 10, wherein the first subset is protected at least by the asymmetric encryption technique and the second subset is decrypted using the symmetric key.

13. :

A computer-implemented method for protecting electronic content, comprising the steps of;

encrypting at least one header of at least one block of electronic content with an asymmetric encryption/decryption technique wherein the encrypted at least one header includes a symmetric key for decrypting the at least one block of electronic content; and

providing the electronic content with the encrypted at least one header for access by an application wherein the electronic content is accessible by decrypting the header using the asymmetric encryption/decryption technique to provide access to the symmetric key for decrypting the at least one block of electronic content for use by an application.

14. :

The computer-implemented method of claim 13, further comprising the step of decrypting the at least one block of electronic content.

15. :

The computer-implemented method of claim 13, wherein the at least one block of electronic content is a plurality of blocks and wherein the providing step provides a first portion of the plurality of blocks for use in decrypted form to the application while a second portion of the plurality of blocks remains encrypted.

16. :

The computer-implemented method of claim 13, wherein the step of encrypting locks the electronic content to a device.

17. :

The computer-implemented method of claim 13, wherein the step of encrypting locks the electronic content to a user.

18. :

The computer-implemented method of claim 13, wherein the step of providing includes transmitting the electronic content to a device.

19. :

The computer-implemented method of claim 18, further comprising the step of locking the electronic to the device so that the electronic content can be accessed at the device.

20. :

The computer-implemented method of claim 13, wherein the at least one data block comprises a plurality of data blocks and the step of providing includes streaming the electronic content to the application so that a first portion of the plurality of data blocks remains encrypted while a second portion of the electronic content is streamed unencrypted to the application.

21. :

The computer-implemented method of claim 20, further comprising selecting a starting location of the second portion within the electronic content.

22. :

The computer-implemented method of claim 13, further comprising re-encrypting the at least one header of the at least one block of electronic content using a re-keying value to lock the electronic content to a device.

23. :

The computer-implemented method of claim 22, wherein the re-keying value is provided to the device independent of the electronic content.