Consumption of content

• US 7,224,805 B2
• Filed: 12/28/2001
• Issued: 05/29/2007
• Est. Priority Date: 07/06/2001
• Status: Expired due to Fees

• Current Assignee: Nokia Corporation
• Original Assignee: Nokia Corporation
• Inventors: Hurst, Leon, Michael, Mulligan, Wilkinson, Jeffrey Miles, Durand, Julian
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Wyszynski; Aubrey H.
• Application Number:
  US10/029,349
• Publication Number:
  US 20030007646A1
• Time in Patent Office: 1,978 Days
• Field of Search: 380/285
• US Class Current: 380/285
• CPC Class Codes: H04N 21/2541 Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/63345 by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

A method and apparatus for consumption of content (1) is described in which a licensor is able to exercise control over consumption based on a personal identity in the form of a set of binding attributes (15). The control may be exercised for a number of consuming terminals (19) including rendering machines such as portable video and audio players.

Claims

1. A method of decrypting encrypted content stored on a terminal, the method comprising the steps of:

receiving a request to access encrypted content on a terminal;

obtaining a license comprising a content decryption key and a set of binding attributes, the attributes including a public key of an authorized user of the encrypted content;

in response to the request, polling a personal trusted device of said user to digitally sign data with a private key associated with the device;

receiving said digitally signed data from said device;

verifying at the terminal the digitally signed data utilizing the public key; and

wherein the terminal in response to verification of the digitally signed data uses the content decryption key to decrypt the encrypted content;

following said step of receiving said digitally signed data, applying a hashing algorithm to said data and decrypting said digitally signed data; and

comparing results of said application of said hashing algorithm with said decrypted data in said step of verifying.

2. A method as claimed in claim 1, comprising:

encrypting at least the content decryption key.

3. A method as claimed in claim 2, wherein:

encryption is performed using a public key of an asymmetric key pair such that decryption of the content decryption key is carried out using a private key of the asymmetric key pair.

4. A method as claimed in claim 3, wherein:

the private key is stored in a tamperproof and secure location.

5. A method as claimed in claim 4, wherein:

the secure location comprises a security element.

6. The method of claim 1, wherein said personal trusted device is communicatively coupled with said terminal via a wireless interface.

7. The method of claim 6, wherein said wireless interface is a low power radio frequency interface.

8. The method of claim 1, wherein said terminal is a rendering machine, and said method further includes a step of rendering said decrypted content on said rendering machine.

9. The method of claim 1, further comprising the steps of:

receiving an identification of a user making said request; and

comparing said identification with a public portion of said license.

10. The method of claim 9, further comprising the step of accessing public portions of a plurality of licenses stored on said terminal to locate a license corresponding to said user.

11. The method of claim 1, wherein said personal trusted device is located proximate to the terminal, and wherein said polling uses a personal area network to instruct said personal trusted device to digitally sign test verification data with a private key of the authorized user stored in said personal trusted device.

12. The method of claim 1, wherein said polling transmits to two or more devices within a personal area network containing the terminal.

13. The method of claim 12, wherein said polling uses low power radio frequency transmission.

14. The method of claim 12, further comprising receiving polling responses from a plurality of devices located proximate to the terminal and connected to the personal area network.

15. A terminal for accessing encrypted content comprising:

a storage storing the encrypted content and a license, the license containing a content decryption key and a set of binding attributes, the attributes including a public key for a licensee of said content;

a digital rights management engine configured to;

receive a request to access said stored encrypted content from said licensee of said content;

generate identity verification data in response to said request;

establish, in response to said request, a communication link between the terminal and at least one other local terminal using a personal area network to request the other local terminal to encrypt and digitally sign the identity verification data, generated by said terminal, using a private key stored at the other local terminal and assigned to said licensee of said content, wherein said other terminal is a mobile telephone of said licensee;

receive said digitally signed identity verification data from said other local terminal;

use said public key to decrypt said encrypted identity verification data; and

analyze said decrypted data to verify that the private key stored at the other local terminal corresponds to the public key in the license, and upon successful verification, decrypt the encrypted content using the content decryption key.

16. A terminal as claimed in claim 15, comprising:

a secure storage for a private key of an asymmetric key pair; and

wherein the controller is further configured to decrypt at least the content decryption key, the content decryption key having been encrypted using a public key of the asymmetric key pair.

17. A terminal as claimed in claim 16, wherein:

the storage is provided by a security element.

18. A terminal as claimed in claim 17, wherein:

the digitally signed identity verification data is delivered to the storage.

19. A terminal as claimed in claim 16, wherein:

the digitally signed identity verification data is delivered to the storage.

20. A terminal as claimed in claim 15, wherein:

the digitally signed identity verification data is delivered to the storage.

21. The terminal of claim 15, wherein said identity verification data is a text string randomly generated by said other terminal.

22. The terminal of claim 15, further comprising:

a low power radio frequency interface, wherein said engine is further configured to use said low power radio frequency interface to establish said communication link with said other local terminal.

23. A method of decrypting encrypted content stored on a terminal, the method comprising the steps of:

receiving a request to access encrypted content on a terminal;

obtaining a license comprising a content decryption key and a set of binding attributes, the attributes including a public key of an authorized user of the encrypted content;

in response to the request, polling a personal trusted device of said user to digitally sign data with a private key associated with the device, wherein said personal trusted device is a mobile telephone;

receiving said digitally signed data from said device; and

verifying at the terminal the digitally signed data utilizing the public key; and

wherein the terminal in response to verification of the digitally signed data uses the content decryption key to decrypt the encrypted content.

24. A digital rights management system, comprising:

a rendering terminal, said rendering terminal including;

a memory storing encrypted content and a license, said license including an exposed identity of a licensee to said content and an encrypted decryption content key;

a processor configured to receive a request to access said content and, in response to said request, perform the following;

transmit a polling request to a personal area network local to the terminal, said polling request requesting that a terminal receiving the request digitally sign test verification data using a private key stored on said terminal, said private key being assigned to said licensee;

receive a response to the polling request and determine whether said licensee is within a range of said personal area network, wherein said rendering terminal processor is further configured to generate said test verification data using a hashing algorithm; and

a mobile terminal, said mobile terminal including;

a memory storing a private key assigned to said licensee; and

a controller configured to receive said polling request and digitally sign said test verification data in response to said polling request.

25. The system of claim 24, wherein said rendering terminal processor is further configured to generate said test verification data randomly.

26. The system of claim 24, wherein said rendering terminal and said mobile terminal each include a low power radio frequency interface.