Domain-based digital-rights management system with easy and secure device enrollment

• US 7,899,187 B2
• Filed: 11/27/2002
• Issued: 03/01/2011
• Est. Priority Date: 11/27/2002
• Status: Active Grant

• Current Assignee: Google Technology Holdings LLC (Alphabet Inc.)
• Original Assignee: Motorola Mobility, Inc. (Lenovo Group Ltd.)
• Inventors: Puhl, Larry, Dabbish, Ezzat A., Vogler, Dean, Messerges, Thomas
• Primary Examiner(s): Dada; Beemnet W
• Application Number:
  US10/306,494
• Publication Number:
  US 20040103312A1
• Time in Patent Office: 3,016 Days
• Field of Search: 380277-279, 380/270, 380/281, 380/282, 380/283, 713/156, 713/155, 713/164, 713/167, 713/171, 713/172
• US Class Current: 380/279
• CPC Class Codes: G06F 21/1012 to domains
• CPC Class Codes: G06F 21/109 by using specially-adapted hardware at the client
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833

Abstract

New devices (101) are added to an existing domain by obtaining domain information (e.g., domain name and private domain password) from devices (101) already in the domain that preferably are in close proximity. Once the domain information has been transferred from the device already in the domain to the device being added to the domain, the device being added to the domain contacts a key issuer (105) to complete its registration into the domain. The key issuer returns a DRM domain private key (206) as well as a DRM certificate (202). Both are utilized by the device to obtain and render digital content (204).

Claims

1. A method for registering a new device as part of a domain of devices, which share rights associated with a common account, for use in accessing protected digital content within a digital-rights management system, the method comprising the steps of:

receiving domain information corresponding to the domain of devices from a device existing within the domain of devices;

providing the domain information to a key issuer, which is separate from the domain of devices, causing the key issuer to issue a private key to the new device, wherein the private key is based on the domain information and is utilized by all devices within the domain of devices; and

receiving the private key from the key issuer for use in accessing the protected digital content within the digital-rights management system.

2. The method of claim 1 wherein the step of receiving the domain information from the device existing within the domain of devices comprises the step of receiving a domain name and a domain password from the device.

3. The method of claim 1 wherein the step of receiving the domain information from the device existing within the domain of devices comprises the step of receiving domain information for the device existing within a domain of devices, all devices within the domain sharing account information.

4. The method of claim 1 wherein the step of receiving the domain information from the device existing within the domain of devices comprises the step of receiving the domain information over a short range link.

5. The method of claim 1 further comprising the steps of:

determining if the domain information was received over a short-range link; and

not accepting the domain information if the domain information was not received over the short-range link.

6. The method of claim 1 further comprising the step of:

utilizing the private key to decrypt a second encryption key, the second encryption key utilized to decrypt digital content.

17. The method of claim 5 wherein not accepting the domain information if the domain information was not received over the short-range link includes not accepting the domain information if the domain information was not received from a device within the domain of devices, which is physically near the new device receiving the domain information, when the domain information is received.

7. A method for registering a new device as part of a domain of devices, which share rights associated with a common account, for use in accessing protected digital content, within a digital-rights management system, the method comprising the steps of:

receiving domain information corresponding to the domain of devices from a device existing within the domain of devices;

determining if the information was received over a short-range communication link;

accepting the domain information only if the information was received over the short-range communication link from another device within the domain of devices;

providing the domain info to a key issuer causing the key issuer to issue a private key and a certificate to the new device, wherein the private key and the certificate are based on the domain information; and

receiving the private key and the certificate from the key issuer for use in accessing the protected digital content within the digital-rights management system.

8. The method of claim 7 further comprising the steps of:

providing the certificate to a rights issuer;

receiving an encrypted encryption key from the rights issuer; and

utilizing the private key to decrypt the encrypted encryption key.

9. The method of claim 8 further comprising the step of:

utilizing the encryption key to decrypt digital content.

16. The method of claim 7 wherein accepting the domain information only if the information was received over the short-range communication link from another device within the domain of devices includes accepting the domain information only if the information was received from another device within the domain of devices, which is physically near the new device receiving the domain information, when the domain information is received.

10. An apparatus comprising:

communication circuitry receiving domain information from a device existing within a domain of devices, which share rights associated with a common account, for use in accessing protected digital content within a digital-rights management system;

storage for storing the domain information; and

logic circuitry for providing the domain information to a key issuer, which is separate from the domain of devices, causing the key issuer to issue a private key for use in accessing protected digital content to the apparatus, wherein the private key is based on the domain information and is utilized by all devices within the domain of devices.

11. The apparatus of claim 10 wherein the domain information comprises a domain name and a domain password.

12. The apparatus of claim 10 wherein the domain of devices share account information.

13. The apparatus of claim 10 wherein the logic circuitry determines if the domain information was received via short-range communication, and accepts the domain information only if the domain information was received via short-range communication from a device within the domain of devices.

14. The apparatus of claim 10 wherein the private key is utilize to decrypt a second encryption key, and the second encryption key is utilized to decrypt digital content.

15. The apparatus of claim 13 wherein the logic circuitry is adapted to accept the domain information only if the domain information was received from a device within the domain of devices, which is physically near the apparatus, when the domain information is received.