System and method for localizing data and devices

• US 7,340,769 B2
• Filed: 10/26/2005
• Issued: 03/04/2008
• Est. Priority Date: 01/07/2005
• Status: Expired due to Fees

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Baugher, Mark John
• Primary Examiner(s): Moise; Emmanuel L.
• Assistant Examiner(s): GERGISO, TECHANE
• Application Number:
  US11/260,531
• Publication Number:
  US 20060156392A1
• Time in Patent Office: 860 Days
• Field of Search: 726/5, 713/151, 713/168, 713/185
• US Class Current: 726/5
• CPC Class Codes: G06F 21/1012 to domains
• CPC Class Codes: G06F 21/1063 Personalisation
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04N 21/00 Selective content distribution, e.g. interactive television or video on demand [VOD] real-time bi-directional transmission of motion video data H04N7/14 ; broadcast or conference over packet switching networks H04L12/18

Abstract

Methods and devices controlling access to content are described. For example, a request to enroll a device is received at a localization hub. The localization hub is associated with a subscriber that is authorized to access the content. A credential is issued to the device. The credential demonstrates that the device is enrolled in the local area network and is authorized to receive the content.

Claims

1. A gateway for coupling a first private home network to a second different network, the gateway comprising:

a first interface to communicate with the first private home network;

a second different interface to communicate with the second different network, the second interface coupled to the first interface such that a network device located in the first private home network can exchange communications with the second network through the gateway; and

localization circuitry integrated into the gateway and coupled to the first and second interfaces, the localization circuitry configured to;

enroll the gateway in a network service by obtaining a credential from a provider device located outside the first private home network and then storing the credential on the gateway;

receive a request from the network device located in the first private home network to enroll in the network service for controlling access to DRM content;

verify that the requesting device is a member of the first private home network; and

issue the credential to the network device when membership is verified, said issuing of the credential allowing the network device to demonstrate possession of the credential to obtain access to the DRM content that is both located outside the first private home network and associated with the network service;

wherein the localization circuitry is further configured to verify membership by determining whether a first IP address for the network device belongs to a same IP address range as a second IP address for the gateway when both IP addresses identify a same subnet, and in addition to the address range verification, determining whether the network device has demonstrated knowledge of a same preshared credential; and

wherein the network device is at least one selected from a group of a household device, a mobile device, a visitor device and a foreign device.

2. The gateway of claim 1 wherein the issued credential is usable by the network device for obtaining a decryption key usable for decrypting the DRM content using the decryption key.

3. The gateway of claim 2 wherein the issued credential is usable by the network device for obtaining the decryption key from another device that is separate from the gateway.

4. The gateway of claim 1 wherein the credential identifies a name of a service provider that is a licensing authority for the DRM content.

5. The gateway of claim 1 wherein the credential identifies address information for locating a service provider to obtain a decryption key for the DRM content.

6. The gateway of claim 1 wherein the localization circuitry is further operable to, before issuing the credential, identify an input indicating that a user of the private home network has used an interactive voice response system to obtain authorization to access the DRM content using the network device.

7. A method for controlling access to DRM content associated with a network service using a hub, the hub having a localization circuitry, said method comprising:

receiving over a first interface of the hub a credential thereby enrolling the hub in the network service;

receiving over a second different interface of the hub a request to enroll a network device in the network service;

verifying that the network device is located in a network, the network being one for which the hub is a single point of entry and exit; and

issuing the credential to the network device when the network device is located in the network, said issuing of the credential allowing the network device to demonstrate possession of the credential to a remote device located outside the network for obtaining access to the DRM content;

wherein the localization circuitry is configured to verify membership by determining whether a first IP address for the network device belongs to same a IP address range as a second IP address for the hub when both IP addresses identify a same subnet, and in addition to the address range verification, determining whether the network device has demonstrated knowledge of a same preshared credential; and

wherein the network device is at least one selected from a group of a household device, a mobile device, a visitor device and a foreign device.

8. The method of claim 7 wherein issuing said credential to the network device allows the network device to demonstrate possession to obtain a decryption key from the remote device, the decryption key for decrypting and accessing the content.

9. The method of claim 7 wherein the credential is provided to the network device in response to a determination that the first IP address for the device and the second IP address for the hub are both administratively scoped by a same Dynamic Host Configuration Protocol (DHCP) server of the network.

10. The method of claim 7 wherein the hub transfers the credential to the network device according to the verification.

11. The method of claim 7 wherein the hub provides access to a wide area network for the network device.

12. The method of claim 7 wherein the hub is a client device located in the same network as the remote device.

13. The method of claim 7 further comprising the hub obtaining the credential from a same remote computer that provides a decryption key usable for decrypting the DRM content.

14. A system for controlling access to DRM content associated with a network service using a gateway, the gateway having a localization circuitry, said system comprising:

means for receiving a credential from a provider device located outside a private network, the credential for associating the network service with the gateway that is a single point of entry and exit for the private network;

means for receiving a request to enroll a network device in the network service;

means for determining whether the network device is part of the private network; and

means for issuing the credential to the network device when the network device is part of the private network, said issuing of the credential permitting the network device to transfer communications through the gateway and outside of the private network, the communications for demonstrating possession of the credential and obtaining access to the DRM content;

wherein the localization circuitry is configured to verify membership by determining whether a first IP address for the network device belongs to a same IP address range as a second IP address for the gateway when both IP addresses identify a same subnet, and in addition to the address range verification, determining whether the network device has demonstrated knowledge of a same preshared credential; and

wherein the network device is at least one selected from a group of a household device, a mobile device, a visitor device and a foreign device.

15. The system of claim 14 wherein said private network comprises a plurality of client devices, wherein one of said client devices comprises said gateway.

16. The system of claim 14 wherein the gateway couples the private network to a wide area network.