Systems and methods for secure transaction management and electronic rights protection

• US 8,291,238 B2
• Filed: 07/12/2007
• Issued: 10/16/2012
• Est. Priority Date: 08/30/1996
• Status: Expired due to Fees

• Current Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Original Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Inventors: Ginter, Karl L., Shear, Victor H., Sibert, W. Olin, Spahn, Francis J., Van Wie, David M.
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US11/879,202
• Publication Number:
  US 20080052541A1
• Time in Patent Office: 1,923 Days
• Field of Search: 713164-167, 713/187, 713/189, 713193-194, 726 26- 30
• US Class Current: 713/189
• CPC Class Codes: G06F 21/1078 Logging; Metering
• CPC Class Codes: G06F 21/1082 Backup or restore
• CPC Class Codes: G06F 21/109 by using specially-adapted hardware at the client
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/608 Secure printing
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/725 operating on a secure reference time value
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 21/86 Secure or tamper-resistant housings
• CPC Class Codes: G06F 21/87 by means of encapsulation, e.g. for integrated circuits
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: G06F 2221/2137 : Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2141 : Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2143 : Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 2221/2147 : Locking files
• CPC Class Codes: G06F 2221/2149 : Restricted operating environment
• CPC Class Codes: G06F 2221/2151 : Time stamp
• CPC Class Codes: G06Q 10/10 : Office automation; Time management
• CPC Class Codes: G06Q 20/02 : involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/06 : Private payment circuits, e.g. involving electronic currency used among participants of a common payment scheme
• CPC Class Codes: G06Q 20/12 : specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/1235 : with control of digital rights management [DRM]
• CPC Class Codes: G06Q 20/24 : Credit schemes, i.e. "pay after"
• CPC Class Codes: G06Q 20/382 : insuring higher security of transaction
• CPC Class Codes: G06Q 30/06 : Buying, selling or leasing transactions
• CPC Class Codes: G07F 9/026 : for alarm, monitoring and auditing in vending machines or means for indication, e.g. when empty
• CPC Class Codes: H04L 2463/101 : applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 2463/102 : applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/00 : Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/04 : for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/104 : Grouping of entities
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04N 21/2347 : involving video stream encryption
• CPC Class Codes: H04N 21/2541 : Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/26613 : for generating or managing keys in general key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04
• CPC Class Codes: H04N 21/4405 : involving video stream decryption
• CPC Class Codes: H04N 21/4623 : Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/4627 : Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/8355 : involving usage data, e.g. number of copies or viewings allowed

Abstract

The present invention provides systems and methods for electronic commerce including secure transaction management and electronic rights protection. Electronic appliances such as computers employed in accordance with the present invention help to ensure that information is accessed and used only in authorized ways, and maintain the integrity, availability, and/or confidentiality of the information. Secure subsystems used with such electronic appliances provide a distributed virtual distribution environment (VDE) that may enforce a secure chain of handling and control, for example, to control and/or meter or otherwise monitor use of electronically stored or disseminated information. Such a virtual distribution environment may be used to protect rights of various participants in electronic commerce and other electronic or electronic-facilitated transactions. Secure distributed and other operating system environments and architectures, employing, for example, secure semiconductor processing arrangements that may establish secure, protected environments at each node. These techniques may be used to support an end-to-end electronic information distribution capability that may be used, for example, utilizing the “electronic highway.”

Claims

1. A secure processing unit comprising a processor and security-relevant components, the security-relevant components including:

an encryption/decryption engine;

a random number generator;

secure memory comprising a plurality of domains, wherein the processor is associated with a particular domain while executing a process;

secure processor mode-enabling hardware or software configured to cause the processor to enter a secure processor mode, the secure processor mode-enabling hardware or software including;

component-accessing hardware or software configured to provide the processor with access to at least a portion of the secure memory and the security-relevant components while the processor operates in the secure processor mode;

component-accessing hardware or software configured to prevent the processor from accessing memory other than the secure memory while the processor operates in the secure processor mode;

secure code execution hardware or software configured to cause the processor to fetch and execute instructions from the secure memory while the processor operates in the secure processor mode and the processor to fetch and execute instructions from other than the secure memory while the processor does not operate in the secure processor mode;

secure code execution hardware or software configured to prevent the processor, while executing the process, from directly accessing at least the portion of the secure memory outside the particular domain and to allow the processor to indirectly access the portion of the secure memory outside the particular domain by interfacing with an operating system function;

secure code execution hardware or software configured to prevent the processor from fetching and executing instructions from memory other than the secure memory while the processor operates in the secure processor mode and from the secure memory while the processor does not operate in the secure processor mode;

external access blocking hardware or software configured to block attempts to access at least the portion of the secure memory that originate from outside the secure processing unit; and

secure processor mode-disabling hardware or software configured to cause the processor to exit the secure processor mode, the secure processor mode-disabling hardware or software including hardware or software configured to block access to at least the portion of the secure memory and the security-relevant components and to provide access to at least the portion of memory other than the secure memory while the processor does not operate in the secure processor mode.

2. The secure processing unit of claim 1, in which the external access blocking hardware or software comprises hardware or software configured to block direct memory access (DMA) accesses.

3. The secure processing unit of claim 1, in which the secure code execution hardware or software comprises code authentication hardware or software configured to authenticate code modules.

4. The secure processing unit of claim 3, in which the code authentication hardware or software comprises hardware or software configured to block execution of a code module if the code module is not authenticated.

5. The secure processing unit of claim 3, in which the code authentication hardware or software comprises digital signature verification hardware or software configured to authenticate a code module by verifying a digital signature on the code module.

6. The secure processing unit of claim 1, in which the secure processor mode-disabling hardware or software comprises memory invalidation hardware or software configured to clear or invalidate one or more memory or register locations.

7. The secure processing unit of claim 1, in which the processor comprises a central processing unit (CPU), microprocessor, or microcontroller.

8. An electronic appliance, the electronic appliance comprising:

a secure processing unit, the secure processing unit comprising;

a processor;

internal memory comprising a plurality of domains, wherein the processor is associated with a particular domain while executing a process;

secure processor mode-enabling hardware or software configured to cause the processor to enter a secure processor mode, the secure processor mode-enabling hardware or software including;

accessing hardware or software configured to provide the processor with access to at least a portion of the internal memory while the processor operates in the secure processor mode;

accessing hardware or software configured to prevent the processor from accessing memory other than the internal memory while the processor operates in the secure processor mode;

secure code execution hardware or software configured to cause the processor to fetch and execute instructions from the internal memory while the processor operates in the secure processor mode and from other than the internal memory while the processor does not operate in the secure processor mode;

secure code execution hardware or software configured to prevent the processor, while executing the process, from directly accessing at least a portion of the internal memory outside the particular domain and to allow the processor to indirectly access the portion of the internal memory outside the particular domain by interfacing with an operating system function;

secure code execution hardware or software configured to prevent the processor from fetching and executing instructions from memory other than the internal memory while the processor operates in the secure processor mode and the processor to fetch and execute instructions from the internal memory while the processor does not operate in the secure processor mode;

external access blocking hardware or software configured to block attempts to access at least the portion of the internal memory that originate from outside the secure processing unit; and

secure processor mode-disabling hardware or software configured to cause the processor to exit the secure processor mode, the secure processor mode-disabling hardware or software including hardware or software configured to block access to at least the portion of the internal memory and provide access to at least the portion of memory other than the secure memory while the processor does not operate in the secure processor mode.

9. The electronic appliance of claim 8, further comprising one or more computer-readable mediums external to the secure processing unit, the computer-readable mediums storing at least rights management software comprising programming configured to apply one or more electronic controls to govern usage of an electronic content item, at least part of the programming designed to cause the secure processing unit to access information required for usage of the electronic content item.

10. The electronic appliance of claim 9, wherein the one or more electronic controls specify one or more permitted or prohibited uses of the electronic content item.

11. The electronic appliance of claim 10, in which at least one of the one or more electronic controls specifies at least one condition associated with a permitted use of the electronic content item.

12. The electronic appliance of claim 11, in which the at least one condition comprises an indication that the permitted use may be made only for a certain time period.

13. The electronic appliance of claim 11, in which the at least one condition comprises an indication that the permitted use may be exercised only by a certain user or class of users.

14. The electronic appliance of claim 11, in which the at least one condition comprises a requirement that auditing information be collected regarding the permitted use.

15. The electronic appliance of claim 8, further comprising:

a display;

a keyboard; and

a network connection.

16. The electronic appliance of claim 8, in which the electronic appliance is selected from a group consisting of:

a computer, a television set-top box, a pager, a telephone, and a video game player.

17. The electronic appliance of claim 9, in which the information required for usage of the electronic content item comprises a first cryptographic key, and in which a second cryptographic key is stored in the internal memory of the secure processing unit, the second cryptographic key being operable to directly or indirectly enable access to the first cryptographic key.

18. A processing unit comprising:

a processor;

internal memory comprising a plurality of domains, wherein the processor is associated with a particular domain while executing a process;

secure processor mode-enabling hardware or software configured to cause the processor to enter a secure processor mode, the secure processor mode-enabling hardware or software including;

accessing hardware or software configured to provide the processor with access to at least a portion of the internal memory while the processor operates in the secure processor mode;

accessing hardware or software configured to prevent the processor from accessing memory other than the internal memory while the processor operates in the secure processor mode;

secure code execution hardware or software configured to cause the processor to fetch and execute instructions from the internal memory while the processor operates in the secure processor mode and the processor to fetch and execute instructions from other than the internal memory while the processor does not operate in the secure processor mode;

secure code execution hardware or software configured to prevent the processor, while executing the process, from directly accessing at least a portion of the internal memory outside the particular domain and to allow the processor to indirectly access the portion of the internal memory outside the particular domain by interfacing with an operating system function;

secure code execution hardware or software configured to prevent the processor from fetching and executing instructions from memory other than the internal memory while the processor operates in the secure processor mode and from the internal memory while the processor does not operate in secure processor mode;

external access blocking hardware or software configured to block attempts to access at least the portion of the internal memory that originate from outside the secure processing unit; and

secure processor mode-disabling hardware or software configured to cause the processor to exit the secure processor mode, the secure processor mode-disabling hardware or software including hardware or software configured to block access to at least the portion of the internal memory and to provide access to at least the portion of memory other than the secure memory while the processor does not operate in the secure processor mode.

19. The processing unit of claim 18, in which the external access blocking hardware or software comprises hardware or software configured to block direct memory access (DMA) accesses.

20. The processing unit of claim 18, in which the secure code execution hardware or software comprises code authentication hardware or software configured to authenticate code modules.

21. The processing unit of claim 20, in which the code authentication hardware or software comprises hardware or software configured to block execution of a code module if the code module is not authenticated.

22. The processing unit of claim 20, in which the code authentication hardware or software comprises digital signature verification hardware or software configured to authenticate a code module by verifying a digital signature on the code module.

23. The processing unit of claim 18, in which the secure processor mode-disabling hardware or software comprises memory invalidation hardware or software configured to clear or invalidate memory or register locations.

24. The processing unit of claim 18, further comprising a tamper-resistant housing.

25. The processing unit of claim 18, in which the processing unit comprises an integrated circuit chip.

26. A processing unit comprising:

a processor;

internal memory comprising a plurality of domains, wherein the processor is associated with a particular domain while executing a process;

secure processor mode-enabling means for causing the processor to enter a secure processor mode, the secure processor mode-enabling means including;

means for providing the processor with access to at least a portion of the internal memory while the processor operates in the secure processor mode;

means for preventing the processor from accessing memory other than the internal memory while the processor operates in the secure processor mode;

means for causing the processor to fetch and execute instructions from the internal memory while the processor operates in the secure processor mode and the processor to fetch and execute instructions from other than the internal memory while the processor does not operate in the secure processor mode;

means for preventing the processor, while executing the process, from directly accessing at least a portion of the secure memory outside the particular domain and for allowing the processor to indirectly access the portion of the secure memory outside the particular domain by interfacing with an operating system function;

means for preventing the processor from fetching and executing instructions from memory other than the internal memory while the processor operates in the secure processor mode and from the internal memory while the processor does not operate in the secure processor mode;

secure processor external access blocking means for blocking attempts to access at least the portion of the internal memory that originate from outside the secure processor; and

secure processor mode-disabling means for causing the processor to exit the secure processor mode, the secure processor mode-disabling means including means for blocking access to at least the portion of the internal memory and for allowing access to memory other than the internal memory while the processor does not operate in the secure processor mode.

27. The processing unit of claim 26, in which the means for blocking attempts to access at least the portion of the internal memory comprises means for blocking direct memory access (DMA) accesses.

28. The processing unit of claim 26, in which the means for causing the processor to fetch and execute instructions comprises means for authenticating code modules.

29. The processing unit of claim 28, in which the means for authenticating code modules comprises means for blocking execution of a code module if the code module is not authenticated.

30. The processing unit of claim 28, in which the means for authenticating code modules comprises means for authenticating a code module by verifying a digital signature on the code module.

31. The processing unit of claim 26, in which the secure processor mode-disabling means comprises means for clearing or invalidating memory or register locations.

32. The processing unit of claim 26, further comprising a tamper-resistant housing means.

33. A system comprising:

a processor;

internal memory;

secure processor mode-enabling hardware or software configured to cause the processor to enter a secure processor mode, the secure processor mode-enabling hardware or software including;

hardware or software configured to provide the processor with access to at least a portion of a domain within the internal memory without interfacing with an operating system function while the processor operates in the secure processor mode, wherein the domain is associated with a process being executed by the processor;

hardware or software configured to provide the processor with access to at least a portion of the domain not associated with the process being executed by the secure processor, within the secure memory, by interfacing with an operating system function;

hardware or software configured to prevent the processor from accessing memory other than the internal memory while the processor operates in the secure processor mode;

secure processor mode-disabling hardware or software configured to cause the processor to exit the secure processor mode, the secure processor mode-disabling hardware or software including hardware or software configured to block access to at least a portion of the internal memory and to provide access to memory other than the internal memory while the processor is not operating in the secure processor mode; and

a computer-readable medium containing instructions that, when executed, perform the following steps;

entering a secure processor mode;

accessing, by the processor, through an operating system interface, at least the portion of the domain not associated with the process being executed by the processor, within the internal memory, while the processor is operating in the secure processor mode;

accessing, by the processor, at least the portion of the domain within the internal memory associated with the process being executed by the processor while the processor is operating in the secure processor mode;

blocking access, by the processor, to memory other than the internal memory while the processor is operating in the secure processor mode;

exiting the secure processor mode;

accessing, by the processor, at least the portion of memory other than the internal memory while the processor is not operating in the secure processor mode;

blocking access, by the processor, to the internal memory while the processor is not operating in the secure processor mode; and

blocking attempts to access at least the portion of the internal memory that originate from outside the processing unit.

34. The system of claim 33, the computer-readable medium further comprising instructions that, when executed, perform the following step:

retrieving at least one cryptographic key from the internal memory while the processor is operating in the secure processor mode.

35. The system of claim 34, the computer-readable medium further comprising instructions that, when executed, perform the following step:

decrypting a piece of electronic content using, at least in part, the at least one cryptographic key.

36. The system of claim 35, wherein the processing unit further comprises hardware or software configured to cause the processor to fetch and execute instructions from the internal memory and to prevent the processor from fetching and executing instructions from memory other than the internal memory while the processor operates in the secure processor mode, and wherein the step of using the processor to decrypt the piece of electronic content comprises fetching instructions from the internal memory and executing the instructions, the instructions being configured, when executed by the processor, to cause the processor to decrypt the piece of electronic content.

37. The system of claim 33, the computer-readable medium further comprising instructions that, when executed, perform the following steps:

fetching from the internal memory, while the processor is operating in the secure processor mode, rights management programming; and

executing the rights management programming to govern use of a piece of electronic content stored in memory external to the processing unit.

38. The system of claim 37, in which the rights management programming comprises instructions that, when executed by the processor, are configured to cause the processor to selectively grant a request to use the piece of electronic content in accordance with one or more controls associated with the piece of electronic content, the one or more controls specifying one or more permitted or prohibited uses of the piece of electronic content.

39. The system of claim 38, in which at least one of the one or more electronic controls specifies at least one condition associated with a permitted use of the piece of electronic content.

40. The system of claim 39, in which the at least one condition comprises an indication that the permitted use may be made only for a certain time period.

41. The system of claim 39, in which the at least one condition comprises an indication that the permitted use may be exercised only by a certain user or class of users.

42. The system of claim 39, in which the at least one condition comprises a requirement that auditing information be collected regarding the permitted use.