System and methods for assignation and use of media content subscription service privileges

• US 8,327,152 B2
• Filed: 08/23/2010
• Issued: 12/04/2012
• Est. Priority Date: 05/30/2003
• Status: Expired due to Fees

• Current Assignee: Apple Inc.
• Original Assignee: Privaris, Inc.
• Inventors: Russell, David C., Johnson, Barry W., Olvera, Kristen R.
• Primary Examiner(s): Parthasarathy, Pramila
• Application Number:
  US12/861,121
• Publication Number:
  US 20100318803A1
• Time in Patent Office: 834 Days
• Field of Search: None
• US Class Current: 713/186
• CPC Class Codes: G06F 16/51 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 18/22 Matching criteria, e.g. proximity measures
• CPC Class Codes: G06F 21/1076 Revocation
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06V 40/13 Sensors therefor
• CPC Class Codes: G06V 40/1365 Matching; Classification
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04N 21/25875 involving end-user authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; arrangements for secret or secure communication including means for verifying the identity or authority of a user of the system H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/4415 using biometric characteristics of the user, e.g. by voice recognition or fingerprint scanning cryptography using biological data H04L9/3231; authentication in networks using biometric H04L63/0861

Abstract

This invention describes a system and methods for media content subscription service distribution; typical services include cable television, premium content channels, pay-per-view, XM radio, and online mp3 services. Subscribers use portable electronic devices to store digital certificates certifying the subscriber'"'"'s privileges and an assigned public key. The devices can communicate with specially enabled televisions, radios, computers, or other media presentation apparatuses. These, in turn, can communicate with central databases owned by the provider, for verification purposes. Methods of the invention describe media content subscription service privilege issuing and use. The invention additionally describes methods for protecting media content transmitted to users with a variety of encryption schemes. The invention also comprises methods for subscribed users to bestow a subset of their privileges to a number of secondary users, with appropriate permission from the media content subscription service provider.

Claims

1. A method, comprising:

receiving, at a media device, a first certificate associated with a first user from a personal identification device after the first user is biometrically-authenticated at the personal identification device, the first certificate having a subscription privilege associated with the first user;

sending a string from the media device to the personal identification device such that the personal identification device encrypts the string using a private key uniquely associated with the first certificate and sends the encrypted string to the media device;

decrypting, at the media device, the encrypted string to verify an authenticity of the first certificate when the decrypted string matches the string;

receiving, at the media device, a second certificate from the personal identification device after the first user is biometrically-authenticated at the personal identification device, the second certificate being associated with a second user and having a plurality of subscription privileges including the subscription privilege, the first certificate being based on the second certificate; and

receiving, at the media device, media from a media provider based on the first certificate after the second certificate is received at the media device and the first certificate is verified, the media provider preventing the media associated with the first certificate from being sent to the media device until the second certificate is received at the media device and the first certificate is verified.

2. The method of claim 1, further comprising:

verifying, at the media device, an authenticity of the first certificate received from the personal identification device.

3. The method of claim 1, wherein the personal identification device is a first personal identification device associated with the first user, the method further comprising:

receiving, at the media device, the second certificate from a second personal identification device associated with the second user after the second user is biometrically-authenticated at the second personal identification device; and

receiving, at the media device, media from the media provider based on the second certificate after the second certificate is received at the media device, the media provider preventing the media associated with the second certificate from being sent to the media device until the second certificate is received at the media device.

4. The method of claim 1, further comprising:

allowing, at the media device, output of the media associated with the first certificate received from a media provider, the media device being pre-registered with a subscription service of the media provider.

5. The method of claim 1, wherein the media device is associated with a third user, the media device being pre-registered with a subscription service of the media provider, the subscription service not including the subscription privilege of the first certificate.

6. The method of claim 1, further comprising:

verifying, at the media device, an authenticity of the second certificate received from the personal identification device, the media associated with the first certificate from the media provider is received at the media device after the first certificate and the second certificate is verified.

7. The method of claim 1, wherein the receiving the media includes receiving an encrypted media from the media provider, the media device storing a symmetric key uniquely associated with the first certificate and the media provider, the media device configured to use the symmetric key to decrypt the received encrypted media, the media device configured to output the decrypted media.

8. The method of claim 1, wherein the second user is a primary user of a subscription service of the media provider and the first user is a secondary user of the subscription service.

9. The method of claim 1, wherein the receiving the first certificate occurs concurrently with the receiving the second certificate.

10. The method of claim 1, wherein the receiving the first certificate includes receiving the first certificate without receiving biometric information associated with the first user, the media device not storing any biometric information associated with the first user.

11. The method of claim 1, wherein the subscription privilege of the first certificate is uniquely associated with a media channel.

12. The method of claim 1, wherein the personal identification device is in a first housing at a first location and the media device is in a second housing different from the first housing at the first location, the media provider is at a second location different from the first location.

13. A non-transitory processor-readable medium storing code representing instructions to cause a processor to perform a process, the code comprising code to:

authenticate, at a first personal identification device, a biometric input of a first user based on a biometric template of the first user stored at the first personal identification device, the first personal identification device storing a first certificate having a plurality of subscription privileges associated with the first user;

generate, at the first personal identification device, a second certificate associated with a second user based on the first certificate, the second certificate having at least one subscription privilege from the plurality of subscription privileges associated with the first user; and

send the first certificate and the second certificate from the first personal identification device to a second personal identification device associated with the second user such that the second user is permitted to access media associated with the at least one subscription privilege of the second certificate from a media provider based on the first certificate and the second certificate.

14. The non-transitory processor-readable medium of claim 13, the code further comprising code to:

store the second certificate at the first personal identification device.

15. The non-transitory processor-readable medium of claim 13, the code further comprising code to:

receive, at the first personal identification device from the first user, a selection of the at least one subscription privilege from the plurality of subscription privileges associated with the first user for the second certificate before the second certificate is generated.

16. The non-transitory processor-readable medium of claim 13, wherein the first certificate excludes biometric information of the first user.

17. The non-transitory processor-readable medium of claim 13, wherein the first personal identification device does not store any biometric information associated with the second user.

18. The non-transitory processor-readable medium of claim 13, the code further comprising code to:

generate, at the first personal identification device, a private key uniquely associated with the second user, the private key being stored at the first personal identification device.

19. A non-transitory processor-readable medium storing code representing instructions to cause a processor to perform a process, the code comprising code to:

authenticate, at a personal identification device at a first location, a biometric input of a first user based on a biometric template of the first user stored at the personal identification device;

send a first subscription privilege associated with the first user from the personal identification device to a first media device at the first location when the biometric input of the first user is authentic such that the first media device outputs media associated with the first subscription privilege from a media provider only after receiving the first subscription privilege from the personal identification device;

authenticate, at the personal identification device at a second location, a biometric input of a second user based on a biometric template of the second user stored at the personal identification device; and

send a second subscription privilege associated with the second user from the personal identification device to a second media device at the second location when the biometric input of the second user is authentic such that the second media device outputs media associated with the second subscription privilege from the media provider only after receiving the second subscription privilege from the personal identification device.

20. The non-transitory processor-readable medium of claim 19, the code further comprising code to:

send the first subscription privilege from the personal identification device to the second media device at the second location when the biometric input of the second user is authentic such that the second media device outputs media associated with the second subscription privilege from the media provider only after receiving the first subscription privilege and the second subscription privilege from the personal identification device.

21. The non-transitory processor-readable medium of claim 19, wherein the first media device is associated with a subscription of the first user and the second media device is associated with a subscription of a third user.

22. The non-transitory processor-readable medium of claim 19, wherein the first user is a primary user of a subscription service of the media provider and the second user is a secondary user of the subscription service.

23. The non-transitory processor-readable medium of claim 19, wherein the first subscription privilege is configured to permit full access to the media from the media provider associated with the first subscription privilege.

24. The non-transitory processor-readable medium of claim 19, wherein the second subscription privilege is configured to permit limited access to the media associated with the first subscription privilege from the media provider.