Systems and methods of secure data exchange

• US 9,762,553 B2
• Filed: 01/12/2017
• Issued: 09/12/2017
• Est. Priority Date: 04/23/2014
• Status: Active Grant

• Current Assignee: IntraLinks Incorporated (SS&C Technologies Holdings Incorporated)
• Original Assignee: IntraLinks Incorporated (SS&C Technologies Holdings Incorporated)
• Inventors: Ford, Christopher Todd, Acharya, Visal Chandrakant, Anstey, Richard David, Awan, Wasif Qayyum, Azmi, Amir M., Azuma, Selom Harry, Callison, Wade Michael, Cazalot, Clement, Choudhary, Mayank, Cleary, Peter W., Dsilva, Benedict Robert, Ertunc, Fuat, Genzer, Simon, Giudice, John William, Gordon, Douglas McLean, Gorin, Jonathan, Hakhinian, Mushegh, Held, John, Hovsepian, Ronald W., Kannan, Ganesh, Landy, John, Lindsay, David Scott, Lirio, Dario R., Mahajan, Himali, Mangez, Olivier, McCarthy, Kevin L., McNulty, Kevin, Meyer, Jerry Lee, Miharia, Anupam, Miroslav, Constantin, Mitchell, Andrew James, Mittermaier, Uli P., Morparia, Harshal, Negrea, Alex, Nikolayeva, Yana, Parimi, Madhavi, Porzio, Matthew A., Purohit, Vedang Shailesh, Rozin, Liviu, Sappor, Godsway, Schwartz, Glenn, Siddiqui, Fahim, Swamy, Nanu, Tearnen, Paul, Toyloy-Mattera, Karla, Velamoor, Sudhakar, Vora, Margin, Waluk, Michael Joseph, Weiblen, Charlie, Wenzel, Peter, Wong, Jeffery Chi, Yip, Tony, Ghafoor, Khurram
• Primary Examiner(s): Hailu, Teshome
• Application Number:
  US15/405,260
• Publication Number:
  US 20170142076A1
• Time in Patent Office: 243 Days
• Field of Search: 726 28
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/1063 Personalisation
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

In embodiments of the present invention improved capabilities are described for managing digital rights management (DRM) protected content sharing in a networked secure collaborative computer data exchange environment through a secure exchange facility managed by an intermediate organizational entity amongst users of a plurality of other organizational entities, wherein computer data content and access rights for the computer data content is shared between a first and second user, the computer data content and access rights for the computer data content are transformed into a DRM protected computer data content through communications with a DRM engine, wherein the DRM engine is selected based on a content type of the computer data content, and the DRM engine is provided by an entity other than the intermediate organizational entity and other than any of the plurality of other organizational entities.

Claims

1. A method for managing digital rights management (DRM) protected content sharing in a networked secure collaborative computer data exchange environment, the method comprising:

establishing, by a secure exchange facility managed by an intermediate organizational entity, a user login data authentication procedure that allows user access through at least one client computing device to the secure exchange facility, where communication between the secure exchange facility and the at least one client computing device is through a communications network;

receiving computer data content and at least one indicator of access rights for the computer data content from a first client computing device of a first user associated with a first organizational entity, wherein the secure exchange facility permits sharing access to the computer data content by at least a second user associated with a second organizational entity based on the at least one indicator of access rights, wherein the second organizational entity is a distinct entity from the first organizational entity;

transforming the computer data content and the at least one indicator of access rights into DRM protected computer data content through communications with a DRM engine, wherein the DRM engine is selected based on a content type of the computer data content, and wherein the DRM engine is provided by an entity distinct from the intermediate organizational entity and any other organizational entity that accesses content shared through the secure exchange facility; and

granting, by the secure exchange facility, shared access to the DRM protected computer data content to at least the second user;

receiving, by the secure exchange facility from a second client computing device of the second user, a request for download of the computer data content;

transmitting the DRM protected computer data content to the second client computing device, wherein each time an access is requested to the DRM protected computer data stored on the second client computing device the second client computing device is required to request access permission from the DRM engine;

receiving, from the DRM engine, a request for access rights to the DRM protected computer data content as a result of the second client computing device requesting access permission from the DRM engine to the DRM protected computer data content; and

providing the DRM engine with updated access rights for the DRM protected computer data content as a result of a received updated indicator of access rights to the secure exchange facility from the first client computing device, wherein the second client computing device is granted access to the DRM protected computer data content by the DRM engine as determined by the updated indicator of access rights,

wherein the first client computing device provides the updated indicator of access rights to the secure exchange facility as a result of the secure exchange facility requesting an update of access rights from the first client computing device as a result of the secure exchange facility receiving the request for access rights from the DRM engine.

2. The method of claim 1, wherein the step of transforming comprises translating the indicator of access rights into a format recognizable by the DRM engine.

3. The method of claim 2, wherein the translated access rights are provided by the DRM engine to the second client computing device where the translated access policies are enforced in managing any potential access to the DRM protected computer data content.

4. The method of claim 3, wherein the translated access rights are enforced by a DRM agent resident on the second client computing device.

5. The method of claim 1, wherein receiving the request for access rights from the DRM engine comprises user credentials for authentication.

6. The method of claim 1, wherein the step of transforming comprises the secure exchange facility encrypting the computer data content.

7. The method of claim 6, wherein an encryption protocol utilized in the encrypting is determined by the secure exchange facility based on a type of the received computer data content.

8. The method of claim 6, wherein the encrypted computer data content is registered at the DRM engine.

9. The method of claim 1, wherein the DRM engine is selected from a plurality of DRM engines.

10. A system for managing digital rights management (DRM) protected content sharing in a networked secure collaborative computer data exchange environment, the system comprising:

a secure exchange facility managed by an intermediate organizational entity, wherein a user login data authentication procedure is established that allows user access through at least one client computing device to the secure exchange facility, where communication between the secure exchange facility and the at least one client computing device is through a communications network,

wherein the secure exchange facility is adapted to receive, transform, and grant access to computer data content in relation to at least one indicator of access rights for the computer data content from a first client computing device of a first user associated with a first organizational entity, wherein the secure exchange facility permits sharing access to the computer data content by at least a second user associated with a second organizational entity based on the at least one indicator of access rights, wherein the second organizational entity is a distinct entity from the first organizational entity,

wherein transforming the computer data content and the at least one indicator of access rights into DRM protected computer data content is implemented through communications with a DRM engine, wherein the DRM engine is selected based on a content type of the computer data content, and wherein the DRM engine is provided by an entity distinct from the intermediate organizational entity and any other organizational entity that accesses content shared through the secure exchange facility,

wherein the secure exchange facility receives from a second client computing device of the second user a request for download of the computer data content,

wherein the DRM protected computer data content is transmitted to the second client computing device, wherein each time an access is requested to the DRM protected computer data stored on the second client computing device the second client computing device is required to request access permission from the DRM engine,

wherein a request for access rights to the DRM protected computer data content is received from the DRM engine as a result of the second client computing device requesting access permission from the DRM engine to the DRM protected computer data content,

wherein the DRM engine is provided with updated access rights for the DRM protected computer data content as a result of a received updated indicator of access rights to the secure exchange facility from the first client computing device,

wherein the second client computing device is granted access to the DRM protected computer data content by the DRM engine as determined by the updated indicator of access rights, and

wherein the first client computing device provides the updated indicator of access rights to the secure exchange facility as a result of the secure exchange facility requesting an update of access rights from the first client computing device as a result of the secure exchange facility receiving the request for access rights from the DRM engine.

11. The system of claim 10, wherein the step of transforming comprises translating the indicator of access rights into a format recognizable by the DRM engine.

12. The system of claim 11, wherein the translated access rights are provided by the DRM engine to the second client computing device where the translated access policies are enforced in managing any potential access to the DRM protected computer data content.

13. The system of claim 12, wherein the translated access rights are enforced by a DRM agent resident on the second client computing device.

14. The system of claim 10, wherein receiving the request for access rights from the DRM engine comprises user credentials for authentication.

15. The system of claim 10, wherein the step of transforming comprises the secure exchange facility encrypting the computer data content.

16. The system of claim 15, wherein an encryption protocol utilized in the encrypting is determined by the secure exchange facility based on a type of the received computer data content.

17. The system of claim 15, wherein the encrypted computer data content is registered at the DRM engine.

18. The system of claim 10, wherein the DRM engine is selected from a plurality of DRM engines.