Abstract:
A process composes a content license for a set of content. The content license has a static portion and a dynamic portion. Further, the process inserts a master key into the static portion. In addition, the process inserts a plurality of content rule sets of values into the dynamic portion and composes a unique content encryption key for each segment of content associated with one of the content rule sets of values as each of the content rule sets of values is sequentially received during recording of the content. The unique content encryption key is based on the master key and at least a subset of the content rule set of values for a corresponding segment of the content. The unique content encryption key is utilized for encryption of each segment of the content to generate a plurality of encrypted content segments for storage on the storage medium.
Abstract:
Method and apparatus for transferring protected content between digital rights management systems is described. One aspect of the invention relates to importing content from an upstream digital rights management (DRM) system into a device in a downstream DRM system. Data is received that associates at least one device in the downstream DRM system with a rights issuer module (RIM). Authenticity of the data is verified as originating from an entity in a trust hierarchy of the device. If the data is authentic and the device is one of the at least one device associated with the RIM, a ciphertext version of the content and a corresponding content license is accepted from the RIM.
Abstract:
A digital rights management method (250) and apparatus (10) for protecting digital content enables a flexible pricing model to be implemented that accounts for a subscriber's current subscription type. The digital rights management method (250) provides (251) a purchase option element for each protected digital content. This purchase option element includes specifying a set of content usage rules (which may or may not allow for the content to be saved persistently). The digital rights management method (250) also includes specifying (252) a cost for each protected digital content associated with the set of content usage rules. The digital rights management method (250) also includes specifying (253) a subscription group for the protected digital content associated with a set of content usage rules, which subscription group includes one or more subscription services and one or more associated incremental discounts for the protected digital content based on the one or more associated subscription services.
Abstract:
Described herein are embodiments that provide an approach to cryptographic key management for a digital rights management (DRM) architecture that includes multiple levels of key management for minimizing bandwidth usage while maximizing security for the DRM architecture. In one embodiment, there is provided a data structure for cryptographic key management that includes a public/private key pair and three additional layers of symmetric keys for authorizing access to a plurality of contents.
Abstract:
According to one embodiment of the invention, a free preview of a program can be provided to client computers in a multicasting system. This can allow viewers in the multicasting system to view a first portion of the program before deciding whether to order the program content. According to another embodiment, various distribution methods can be accomplished using encryption keys to distribute program content. According to yet another embodiment, an initial viewing period can be provided to allow negotiation of the encryption keys. According to another embodiment, rules and conditions for providing content in a multicasting environment can be utilized.
Abstract:
A session rights object and authorization data are used for defining a consumer's access right to a media content stream. The access rights are determined at a caching server (115) remotely located from the consumer (116) rather than locally at the end user site. In a first aspect, in a computing network having a content provider (102), a key distribution center, a caching server (115) and a client (116) a method for controlling client access to a real-time data stream from the caching server, is disclosed. The method includes receiving, by the client, a session rights object from a content provider, the session rights object defining access rules for accessing the real-time data stream; receiving, by the client, authorization data from the key distribution center, the authorization data defining the client's access rights to the real-time data stream; forwarding to the caching server the session rights object and the authorization data; comparing, by the caching server, the session rights object with the authorization data to determine client authorization; and if the client is authorized, streaming, by the caching server, the real-time data stream to the client.
Abstract:
According to one embodiment of the invention, a free preview of a program can be provided to client computers in a multicasting system. This can allow viewers in the multicasting system to view a first portion of the program before deciding whether to order the program content. According to another embodiment, various distribution methods can be accomplished using encryption keys to distribute progam content. According to yet another embodiment, an initial viewing period can be provided to allow negociation of the encryption keys. According to another embodiment, rules and conditions for providing content in a multicasting environment can be utilized.
Abstract:
According to one embodiment of the invention, a free preview of a program can be provided to client computers in a multicasting system. This can allow viewers in the multicasting system to view a first portion of the program before deciding whether to order the program content. According to another embodiment, various distribution methods can be accomplished using encyrption keys to distribute program content. According to yet another embodiment, an initial viewing period can be provided to allow negotiation of the encryption keys. According to another embodiment, rules and conditions for providing content in a multicasting environment can be utilized.
Abstract:
A method and system generates and distributes unique cryptographic device keys. The method includes generating at least a first device key and encrypting the first device key with a first encrypting key to produce a first encrypted copy of the device key. The method also includes encrypting the first device key with a second encrypting key to produce a second encrypted copy of the device key. The second encrypting key is different from said first encrypting key. The first and second encrypted copies of the device keys are associated with a device ID identifying a computing device being manufactured. The second encrypted copy of the device key is loaded onto the computing device. The first encrypted copy of the device key and the device ID with which it is associated are stored onto at least one server for subsequent use after the computing device has been deployed to a customer.
Abstract:
A method of authentication and authorization over a communication system is provided. The method performs a first authentication of a device based on a set of device identity and credentials. The first authentication includes creation of a first set of keying material. The method also includes performing a second authentication of a subscriber based on a set of subscriber identity and credentials. The second authentication includes creation of a second set of keying material. A set of compound key material is created with a key derivation mechanism that uses the first set of keying material and the second set of keying material. A binding token is created by cryptographically signing at least the device identity authenticated in the first authentication and the subscriber identity authenticated in the second authentication using the set of compound keying material. The signed binding token is exchanged for verification with an authenticating and authorizing party.