Method and system for digital rights management brokering and digital asset security transcoding

• US 7,822,685 B1
• Filed: 04/09/2003
• Issued: 10/26/2010
• Est. Priority Date: 04/09/2003
• Status: Expired due to Fees

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: O'Toole, James W. Jr.
• Primary Examiner(s): Hewitt, II; Calvin Loyd
• Assistant Examiner(s): SHERR, CRISTINA O
• Application Number:
  US10/411,819
• Time in Patent Office: 2,757 Days
• Field of Search: 705 51- 59, 705/44, 705/39, 380/23, 361/91, 713/185, 713/201
• US Class Current: 705/51
• CPC Class Codes: G06F 21/1078 Logging; Metering
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 40/03 Credit; Loans; Processing thereof

Abstract

A computer-implemented method and system for DRM brokering and digital asset security transcoding comprising utilizing a broker for converting content from one format into one or more alternative DRM-protected formats for distribution to end-users. The broker operates an escrow system for securing and tracking the content and information about the content and encryption keys associated with a plurality of DRM content formats. The broker further provides a common inter-DRM log format for receiving usage transaction logs and payment logs associated with transcoding and distribution the content in one or more DRM-protected content formats.

Claims

1. A method, comprising:

receiving, by a DRM Broker computer, original content to be protected with a predetermined DRM (Digital Rights Management) scheme;

identifying a publisher from a plurality of different publishers by inspecting the original content prior to a first DRM encryption, the identified publisher being associated with the original content;

comparing the identified publisher to a key-escrow database, the key-escrow database mapping the plurality of different publishers to different DRM encryption formats and associating the different DRM encryption formats with one or more of a plurality of encryption keys;

selecting a first DRM encryption format based on an identity of the identified publisher;

transcoding the original content, at the DRM Broker computer using the selected first DRM encryption format, the transcoding producing a first DRM encrypted instance of the original content;

selecting a second DRM encryption format according to the comparison of the identified publisher to the key-escrow database, wherein the second DRM encryption format is different from the first DRM encryption format;

additionally transcoding the original content, at the DRM Broker computer using the second DRM encryption format, the additional transcoding producing a second different DRM encrypted instance of the original content;

tracking encryption keys selected from the plurality of encryption keys associated with each of the first and second DRM encryption formats; and

attaching, by the DRM Broker computer, meta-data to the first DRM encrypted instance of the original content and the second DRM encrypted instances of the original content, the meta-data including;

an identity of the DRM broker computer conducting the transcodings and an identity of the key-escrow database.

2. The method of claim 1, wherein the method further comprises distributing both differently DRM encrypted instances of the original content over a packet switched network.

3. The method of claim 2, wherein the original content is received in an original DRM encrypted format over the packet switched network the method further comprising:

decrypting the original DRM encryption format before performing the transcodings.

4. The method of claim 3, wherein the key-escrow database also maps different key-management policies to the different publishers, the key-management policies corresponding to keys that are used to sign licenses for the original content, and the method further comprises:

identifying one of the key-management policies according to the comparison of the identified publisher to a key-escrow database; and

managing ones of the keys that are associated with the first and second DRM encrypted instances according to the identified key-management policies.

5. The method of claim 4, wherein the key-escrow database also maps different key storage options to the different publishers, the different key-storage options consisting only of local storage of the keys and remote storage of the keys, and the method further comprises:

selecting between local and remote storage of the associated keys according to the comparison of the identified publisher to a key-escrow database; and

storing the keys according to the selection.

6. The method of claim 5, further comprising generating a common inter-DRM log format for receiving usage transaction logs and payment logs associated with the distribution of the differently DRM encrypted instances of the original content.

7. The method of claim 1, wherein the meta-data further includes information pertaining to the publisher of the original content;

and

the key-escrow database further comprises;

a first table for mapping each of the plurality of different publishers to different DRM encryption formats, publishing policies and respective keys; and

a second table for mapping discrete elements of content provided by a particular publisher of the plurality of different publishers to particular DRM encryption formats and key-management policies.

8. The method of claim 7, wherein the DRM broker computer distributes the differently DRM encrypted instances of the original content, and wherein licensing information for the differently DRM encrypted instances of the original content is provided by a third-party auditor operating a license-signing system.

9. The method of claim 8, wherein the third party auditor maintains a transaction log and provides access to the transaction log for auditing the DRM broker computer.

10. The method of claim 9, wherein the key-escrow database comprises a computerized key-escrow database system.

11. A system, comprising:

means for receiving, original content to be protected with a predetermined DRM (Digital Rights Management) scheme;

means for identifying a publisher from a plurality of publishers as being associated with received original content by inspecting the received original content prior to a first DRM encryption, to identify the publisher from a plurality of different publishers, the identified publisher being associated with the received original content;

means for comparing the identified publisher to a key-escrow database, the key-escrow database including a means for mapping the plurality of different publishers to different DRM encryption formats and associating one or more encryption keys with each of the different DRM encryption formats;

means for selecting a first DRM encryption format according to the comparison of the identified publisher;

means for transcoding the original content using the first DRM encryption format to produce a first DRM encrypted instance of the original content;

means for selecting a second DRM encryption format according to the comparison of the identified publisher, wherein the second DRM encryption format is different from the first DRM encryption format;

means for additionally transcoding the original content using the second DRM encryption format, the additional transcoding producing a second DRM encrypted instance of the original content;

means for outputting the differently DRM encrypted instances of the original content, wherein the means for outputting includes a DRM broker computer;

means for tracking encryption keys associated with the first and second DRM encryption formats according to the comparison of the identified publisher; and

means for attaching meta-data to the first and second DRM encrypted instances of the original content, the meta-data identifying;

the means for outputting the first and second DRM encrypted instances of the original content including the DRM broker computer and the key-escrow database, the meta-data including;

an identity of the DRM broker computer conducting the transcodings and an identity of the key-escrow database.

12. The system of claim 11, wherein the means for receiving, the mapping means, the tracking means, the identifying means, the means for comparing, the selecting means, the transcoding means, the outputting means and the attaching means are implemented in one or more computers separated from the publishers via an intervening packet switched network such that the computers operate as a remote trusted DRM-encryption proxy for the publishers.

13. The system of claim 12 wherein the system addresses DRM fragmentation by allowing the publishers to provide the protected original content to a plurality of customers that each conform to different DRM standards.

14. The system of claim 11, further comprising means for generating a common inter-DRM log format for receiving usage transaction logs and payment logs associated with transcoding the original content using the selected DRM encryption formats.

15. The system of claim 14, further comprising:

means for selecting a key-management policy from a plurality of different key management policies according to the identified publisher; and

means for associating the selected key management policy with the differently DRM encrypted instances of the original content.

16. The system of claim 12 further comprising:

means for determining whether the received original content includes publisher-formatted DRM encryption that is different than the selectable DRM encryption formats;

means for determining whether the included publisher-formatted DRM encryption is vulnerable to known attacks; and

means for attacking the publisher-formatted DRM encryption when vulnerable, the attacking means removing the publisher-formatted DRM encryption from the content prior to transcoding.

17. A non-transitory computer-useable medium having computer-executable instruction code embodied thereon for causing a computer system to execute a computer-implemented method for brokering DRM-protected content and for digital asset security transcoding stored thereon, the method comprising:

operating an escrow system at a DRM broker computer, the escrow system for tracking a plurality of encryption keys each associated with respective ones of a plurality of DRM-protected content formats;

receiving original content at the DRM broker computer, the DRM broker computer for transcoding the original content into a plurality of instances of DRM-protected content formats;

identifying a publisher of the original content from a plurality of different publishers by inspecting the original content prior to transcoding the original content into the plurality of DRM-protected content formats, the identified publisher being associated with the first original content;

determining one or more different authorized DRM-protected content formats associated with the identified publisher by comparing the identified publisher in a key-escrow database, the key-escrow database for mapping the plurality of different publishers to a plurality DRM-protected content formats, wherein each publisher is associated with two or more of the DRM-protected content formats;

selecting a first DRM encryption format according to the comparison of the identified publisher in the key-escrow database;

transcoding the original content, at the DRM Broker computer using the selected first DRM encryption format, the transcoding producing a first DRM encrypted instance of the original content;

a second DRM encryption format according to the comparison of the identified publisher in the key-escrow database, wherein the second DRM encryption format is different from the first DRM encryption format; and

additionally transcoding the original content, at the DRM Broker computer using the second DRM encryption format, the additional transcoding producing a second DRM encrypted instance of the original content, wherein the second DRM encrypted instance of the original content is different from the first DRM encrypted instance of the original content;

tracking encryption keys associated with the first and second DRM encryption formats indicated in the key-escrow database; and

attaching by the DRM Broker computer, meta-data to the first and second instances of DRM-protected original content, the meta-data identifying;

the DRM broker computer operating the escrow system and the key-escrow database, the meta-data including;

an identity of the DRM broker computer conducting the transcodings and an identity of the key-escrow database.

18. The non-transitory computer-useable medium of claim 17, wherein the computer-executable instruction code embodied therein causes the computer system to perform transcoding the original content into the first and second instances of DRM-protected original content, the original content comprising DRM-protected and non-DRM-protected content.

19. The non-transitory computer-useable medium of claim 17, wherein the computer-executable instruction code embodied therein causes the computer system to further perform tracking content information comprising a plurality of DRM formats, a plurality of content and a plurality of licensed users of the content.

20. The non-transitory computer-useable medium of claim 17, wherein the key-escrow database is further for mapping attributes of the plurality of DRM formats to the original content and licensed users of the original content.