Method and apparatus for secure content delivery over broadband access networks

• US 7,707,641 B2
• Filed: 01/30/2006
• Issued: 04/27/2010
• Est. Priority Date: 11/16/1998
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Softricity (Microsoft Corporation)
• Inventors: Eichin, Mark W., Schmeidler, Yonah, Atkins, Derek, Rostcheck, David J.
• Primary Examiner(s): Vu; Kimyen
• Assistant Examiner(s): PATEL, NIRAV B
• Application Number:
  US11/343,272
• Publication Number:
  US 20060272023A1
• Time in Patent Office: 1,548 Days
• Field of Search: 726 26- 33, 380200-203, 705/50, 705/51, 705/57, 705/59, 705/71, 725/28, 725/31, 709/229, 709223-225, 709/203, 713/193, 713/189, 713/165, 713/167, 717/100, 717/127, 717/120, 717/124, 717/126, 717/136, 717139-142, 717/167, 717/168, 717/171, 717174-178
• US Class Current: 726/26
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: Y10S 707/99931 Database or file accessing

Abstract

A system for secure delivery of on-demand content over broadband access networks utilizes a pair of servers of security mechanisms to prevent client processes from accessing and executing content without authorization. A plurality of encrypted titles are stored on a content server coupled to the network. An access server also coupled to the network contains the network addresses of the titles and various keying and authorization data necessary to decrypt and execute title. A client application executing on a user'"'"'s local computer system is required to retrieve the address, keying and authorization data from the access server before retrieving a title from the content server and enabling execution of the title on a user'"'"'s local computer system.

Claims

1. A method for creating an activator for processing a content title into executable form, comprising:

generating, by a computer system, an activator, the activator including cryptographic data for decrypting content title data, the cryptographic data is encoded in obfuscated bytecode to inhibit unauthorized extraction of the cryptographic data, wherein the obfuscated bytecode implements executable instructions for decrypting content title data and the obfuscated bytecode is consumable by a bytecode interpreter that is configured to interpret and execute the obfuscated bytecode to obtain the cryptographic data for decrypting the content title data;

adding authorization data to the activator, the authorization data identifying a time period in which the content title remains in an executable form;

sending the generated activator in the form of the obfuscated bytecode to a client; and

sending the content title data to the client, the content title data including a downloadable file system that includes files associated with the content and simulated registry values, wherein the content is configured to be executed by using the files stored in the downloadable file system and using the simulated registry values to simulate an installation of the content in a client file system.

2. The method of claim 1, further comprising:

creating a token authorizing the client system to access the content title stored on the content server; and

storing the token with the activator at a location.

3. The method of claim 2, wherein the activator is valid for a single use.

4. The method of claim 1, further comprising:

creating a token authorizing the client system to access a content title stored on the content server.

5. The method of claim 1, wherein the activator is valid for a single use.

6. A method, comprising:

receiving by a client computer system, an activator, said activator providing cryptographic data for decrypting content title data, said cryptographic data embedded in obfuscated bytecode to inhibit unauthorized extraction of the cryptographic data, said obfuscated bytecode implements executable instructions for decryption of content data;

receiving authorization data, the authorization data identifying a time period in which the content title remains in executable form;

receiving the content title data, the content title data including content, a downloaded file system, and simulated registry values for an executing instance of the content;

executing a virtual machine, the virtual machine including executable instructions for interpreting and executing obfuscated bytecode;

executing, by the virtual machine, the accessed activator in the form of the obfuscated bytecode to generate the cryptographic data for decrypting content title data;

decrypting the content title data using the generated cryptographic data;

mounting the downloaded file system;

executing, by using information stored in the downloaded file system, the content;

intercepting an operating system request for a registry value associated with the execution of the content; and

sending a simulated registry value to the operating system thereby simulating an instillation of the content on the client.

7. The method of claim 6, further comprising:

receiving a token that allows the client system to access a content title stored on the content server.

8. The method of claim 7, wherein the activator is valid for a single use.

9. The method of claim 6, wherein the activator is valid for a single use.

10. A method comprising:

generating, by a computer system, an activator, the activator including cryptographic data for content title data in obfuscated bytecode to inhibit unauthorized extraction of the cryptographic data, wherein the obfuscated bytecode implements executable instructions for decrypting content title data, the obfuscated bytecode consumable by a virtual machine that is configured to interpret and execute the obfuscated bytecode to obtain the cryptographic data for decrypting the content title data;

storing the generated activator in the form of the obfuscated bytecode;

wherein the activator includes authorization data, the authorization data identifying a time period in which the content title remains in executable form, said generated cryptographic data being valid only for the identified time period;

wherein the content title data includes content, a downloadable file system that includes files associated with the content, and simulated registry values; and

wherein the content is configured to be executed by using the files stored in the downloadable file system and using the simulated registry values to simulate an instillation of the content in a client file system.

11. The method of claim 10, further comprising:

creating a token authorizing the client system to access a content title stored on the content server; and

storing the token with the activator at a location on the computer network accessible by the client system.

12. The method of claim 11, wherein the activator is valid for a single use.

13. The method of claim 10, wherein the activator is valid for a single use.