Method and system for verifying entitlement to access content by URL validation

• US 8,984,284 B2
• Filed: 05/10/2013
• Issued: 03/17/2015
• Est. Priority Date: 01/26/2009
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Purdy, Gregor N. Sr., Kinnis, Tony F.
• Primary Examiner(s): Zecher, Dede
• Assistant Examiner(s): Almamun, Abdullah
• Application Number:
  US13/892,054
• Publication Number:
  US 20130246278A1
• Time in Patent Office: 676 Days
• Field of Search: 726/7, 726/30, 726/31, 713/160, 707/606, 725/112
• US Class Current: 713/160
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: G06Q 20/1235 with control of digital rights management [DRM]
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps

Abstract

Aspects include a mechanism of entitling users to transacted-for digital content access, indicating download authorization with discrete authentication URLs, and validating download attempts using each such URL. The authentication mechanism comprises producing an encrypted string included in a URL provided to a user. The encrypted string comprises transaction identifier information, and information about the transacted-for entitlement. When a user wishes to exercise the transacted-for entitlement, the user activates the URL, which is resolved to a location that has/can obtain access to the key(s) used in producing the encrypted string, decrypt the string, and use the information in it to validate the URL and the entitlement. The validation can use data retrieved from a database, using the transaction identifier as a key. The entitlement information included in the now-decrypted string can be compared with the prior download information.

Claims

1. A method comprising:

performing a transaction between a client device and a transaction system for purchase of user-specific rights to digital content delivered electronically;

providing, to the client device, a resource address for accessing the digital content based on an authorization to exercise the user-specific rights, wherein the resource address comprises an encrypted string that represents, upon decryption, rights information associated with the user-specific rights, wherein the rights information specifies a maximum number of authorized downloads available to the user; and

providing, to the client device, access to the digital content identified by the resource address, based on the rights information in response to a successful validation of a user request to exercise the user-specific rights.

2. The method of claim 1, further comprising:

accessing a record using the resource address to obtain information indicative of prior consumption of the user-specific rights, and comparing the information with the user-specific rights in the validation of a user request to exercise the user-specific rights.

3. The method of claim 1, wherein the digital content is stored in a Content Delivery Network (CDN) that is independent from the transaction system.

4. The method of claim 3, further comprising:

accepting the user request from the user at the CDN;

forwarding the encrypted string to a system controlled by an operator of the transaction system for validation; and

providing a private resource address for accessing digital content.

5. The method of claim 1, wherein the resource address is made accessible to the client device by at least one of an electronic message and a web page, in response to completion of the transaction, wherein the resource address is a uniform resource locator.

6. The method of claim 1, wherein the resource address comprises a purchase completion time stamp indicating the time the transaction completed.

7. The method of claim 6, wherein the purchase completion time stamp is utilized during the validation to determine whether the purchase occurred within a time limit.

8. The method of claim 2, wherein the record and the maximum number of authorized downloads are utilized during the validation to determine whether the maximum number of authorized downloads has been reached, wherein the record includes information indicative of a number of prior downloads initiated using the resource address.

9. The method of claim 1, wherein the encrypted string is based on at least one bit of random data, a unique transaction identifier information and rights information.

10. The method of claim 1, wherein a control function configured to generate additional user-specific rights to the digital content is accessible to the user when the client device request is received after the maximum number of authorized downloads has been reached.

11. The method of claim 1, wherein the resource address for accessing the digital content includes a start byte representing a download resumption point.

12. The method of claim 11, wherein information indicative of a number of prior downloads initiated using the resource address is unchanged when the start byte is identified in the resource address.

13. A non-transitory computer-readable storage medium storing instructions which, when executed by a computing device, cause the computing device to perform steps comprising:

providing, to a client device, a resource address for accessing the digital content based on an authorization to exercise user-specific rights, wherein the resource address comprises an encrypted string that represents, upon decryption, rights information associated with the user-specific rights, wherein the rights information specifies a maximum number of authorized downloads available to the user; and

providing, to the client device, access to the digital content identified by the resource address, based on the rights information in response to a successful validation of a user request to exercise the user-specific rights.

14. The non-transitory computer-readable storage medium of claim 13, wherein a control function configured to generate additional user-specific rights to the digital content is accessible to the user when the client device request is received after the maximum number of authorized downloads has been reached.

15. The non-transitory computer-readable storage medium of claim 13, wherein the resource address for accessing the digital content includes a start byte representing a download resumption point.

16. The non-transitory computer-readable storage medium of claim 13, wherein information indicative of a number of prior downloads initiated using the resource address is unchanged when the start byte is identified in the resource address.

17. A system comprising:

a processor;

a memory coupled to the processor;

a first module configured to provide, to a client device, a resource address for accessing the digital content based on an authorization to exercise user-specific rights, wherein the resource address comprises an encrypted string that represents, upon decryption, rights information associated with the user-specific rights, wherein the rights information specifies a maximum number of authorized downloads available to the user; and

a second module configured to provide, to the client device, access to the digital content identified by the resource address, based on the rights information in response to a successful validation of a user request to exercise the user-specific rights.

18. The system of claim 17, wherein the resource address is a uniform resource locator.

19. The system of claim 17, wherein the resource address for accessing the digital content includes a start byte representing a download resumption point.

20. The system of claim 17, wherein information indicative of a number of prior downloads initiated using the resource address is unchanged when the start byte is identified in the resource address.