Secure authorization for accessing content on a shareable device

• US 9,736,140 B1
• Filed: 04/25/2016
• Issued: 08/15/2017
• Est. Priority Date: 02/14/2013
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Wu, Huahui, Catania, Nicolas, Condra, Curtis Gerald
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): Zarrineh, Shahriar
• Application Number:
  US15/137,697
• Time in Patent Office: 477 Days
• Field of Search: 726 4
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/126 the source of the received data

Abstract

Described is a process for securely authorizing access to media content from a first device to a second device. Access to content may be authorized by performing authentication from the first device. Information used for authentication (e.g. login information) is not shared with the second device. Instead, a token may be used to authenticate the second device. The authorization process may be done in a secure manner by sharing only the generated token with the second device. Authentication information may not be derived from the token, and accordingly, even if the second device is not secure or the token is exposed, authentication information remains secure.

Claims

1. A system for authorizing access to media content, comprising:

a database;

communications circuitry configured to connect to a first device and a second device; and

one or more processors coupled to the database and the communications circuitry, the one or more processors separate from the first device and the second device, the first device separate from the second device, the one or more processors configured to;

authorize access to the media content by the second device;

receive, from the second device, a first identification of the first device;

generate, after authorization of access to the media content by the second device, a token, the token associated with the first identification;

store, in the database, the first identification and a copy of the token;

send the token to the second device;

receive, from the first device, the token and a second identification of the first device, the token having been received by the first device from the second device;

retrieve, from the database and using the token received from the first device, the first identification; and

authorize access to the media content by the first device in response to a result of a comparison of the first identification and the second identification being that the second identification identifies the first device.

2. The system of claim 1, wherein the one or more processors are configured to generate the token in a manner that prevents authentication information of a user of the second device from being derived from the token.

3. The system of claim 1, wherein the one or more processors are further configured to receive, from the second device, a request to delegate access to the media content to the first device, the request including the first identification of the first device.

15. The system of claim 1, wherein the one or more processors are configured to disable access to the media content by the second device in response to authorization of access to the media content by the first device.

4. A non-transitory computer-readable medium storing computer code for controlling one or more processors, the computer code including instructions to cause the one or more processors to:

authorize access to the media content by the second device;

receive, from a second device, a first identification of a first device;

generate, after authorization of access to the media content by the second device, a token, the token associated with the first identification;

store, in a database, the first identification and a copy of the token;

send the token to a second device;

receive, from the first device, the token and a second identification of the first device, the token having been received by the first device from the second device;

retrieve, from the database and using the token received from the first device, the first identification; and

authorize access to the media content by the first device in response to a result of a comparison of the first identification and the second identification being that the second identification identifies the first device,

wherein the one or more processors are separate from the first device and the second device, and wherein the first device is separate from the second device.

5. The non-transitory computer-readable medium of claim 4, wherein the instructions to generate the token include instructions to generate the token in a manner that prevents authentication information of a user of the second device from being derived from the token.

6. The non-transitory computer-readable medium of claim 4, further comprising instructions to cause the one or more processors to receive, from the second device, a request to delegate access to the media content to the first device, the request including the first identification of the first device.

16. The non-transitory computer-readable medium of claim 4, further comprising instructions to cause the one or more processors to disable access to the media content by the second device in response to authorization of access to the media content by the first device.

7. A system for accessing media content, comprising:

communications circuitry configured to connect to a device, a first server, and a second server; and

one or more processors coupled to the communications circuitry, the one or more processors separate from the device, the first server, and the second server, the device separate from the first server and the second server, the first server separate from the second server, the one or more processors configured to;

receive, from the device, a token, the token having been generated by the first server after the first server has authorized access to the media content by the device, the token associated with a first identification of the one or more processors, the first identification having been provided to the first server by the device;

send, to the first server, the token and a second identification of the one or more processors;

receive, from the first server, an authorization to access the media content, the authorization having been determined by the first server based on a result of a comparison of the first identification and the second identification being that the second identification identifies the one or more processors, the first identification having been retrieved from a database by the first server using the token;

send, to the second server at predefined times, the token; and

receive, from the second server, a response indicative of a status of a right to access the media content.

8. The system of claim 7, wherein the token is generated in a manner that prevents authentication information of a user of the device from being derived from the token.

9. The system of claim 7, wherein the communications circuitry and the one or more processors are further configured to pair the one or more processors with the device.

10. The system of claim 7, wherein the communications circuitry is further configured to connect to a third server, and the one or more processors are further configured to obtain the media content from the third server.

17. The system of claim 9, wherein the communications circuitry and the one or more processors are further configured to pair the one or more processors with the device via at least one of a short range communication protocol, a local network connection, or a cellular data network.

11. A non-transitory computer-readable medium storing computer code for controlling one or more processors, the computer code including instructions to cause the one or more processors to:

receive, from a device, a token, the token having been generated by a first server after the first server has authorized access to the media content by the device, the token associated with a first identification of the one or more processors, the first identification having been provided to the first server by the device;

send, to the first server, the token and a second identification of the one or more processors;

receive, from the first server, an authorization to access the media content, the authorization having been determined by the first server based on a result of a comparison of the first identification and the second identification being that the second identification identifies the one or more processors, the first identification having been retrieved from a database by the first server using the token;

send, to the second server at predefined times, the token; and

receive, from the second server, a response indicative of a status of a right to access the media content,

wherein the one or more processors are separate from the device, the first server, and the second server, the device is separate from the first server and the second server, and the first server is separate from the second server.

12. The non-transitory computer-readable medium of claim 11, wherein the token is generated in a manner that prevents authentication information of a user of the device from being derived from the token.

13. The non-transitory computer-readable medium of claim 11, further comprising instructions to cause the one or more processors to pair at least one of the one or more processors with the device.

14. The non-transitory computer-readable medium of claim 11, further comprising instructions to cause the one or more processors to obtain the media content from a third server.

18. The non-transitory computer-readable medium of claim 13, further comprising instructions to cause the one or more processors to pair the at least one of the one or more processors with the device via at least one of a short range communication protocol, a local network connection, or a cellular data network.