Abstract: A method and system for attaching a title key to encrypted content for synchronized transmission to, or storage by, a recipient is provided. Specifically, under the present invention, an elementary media stream is parceled into content units that each include a content packet and a header. The content packets are encrypted with one or more title keys. Once the content packets have been encrypted, the title keys are themselves encrypted with a key encrypting key. The encrypted title keys are then attached to the corresponding encrypted content packets for synchronized transmission to a recipient.

Abstract: A system, method, and computer program product enabling individual user devices to authenticate and validate a digital message sent by a distribution center, without requiring transmissions to the distribution center. The center transmits the message with an appended modulus that is the product of two specially selected primes. The transmission also includes an appended authentication value that is based on an original message hash value, a new message hash value, and the modulus. The new message hash value is designed to be the center's public RSA key; a corresponding private RSA key is also computed. Individual user devices combine a digital signet, a public modulus, preferably unique hardware-based numbers, and an original message hash to compute a unique integrity value K. Subsequent messages are similarly processed to determine new integrity values K?, which equal K if and only if new messages originated from the center and have not been corrupted.

Abstract: A method and system for attaching a title key to encrypted content for synchronized transmission to, or storage by, a recipient is provided. Specifically, under the present invention, an elementary media stream is parceled into content units that each include a content packet and a header. The content packets are encrypted with one or more title keys. Once the content packets have been encrypted, the title keys are themselves encrypted with a key encrypting key. The encrypted title keys are then attached to the corresponding encrypted content packets for synchronized transmission to a recipient.

Abstract: A system, method and computer readable medium for providing secure IP-based streaming in a format independent manner is disclosed. The method on a content mastering system begins with an encoded media file consisting of content data and associated metadata. First, the metadata is read from the encoded media file. Next, the encoded media file including the content data and the associated metadata is encrypted. Then, in a streaming server system, the encoded/encrypted media file is divided into more than one data packet, streamed in accordance with one or more parameters in the metadata. Each data packet includes a portion of the encoded/encrypted media file and an offset value corresponding to a location within the encoded/encrypted media file. The data packets are then streamed to a client information processing system (i.e., the client) over a network.

Abstract: A method for verifying the integrity of a media key block (MKB) by storing validation data in a validation area of a medium, such as a DVD-R or a DVD-RW. In one embodiment, validation data comprises a hash function on a media key block. In another embodiment, validation data comprises the Verification Data field of an MKB's Verify Media Key Record.

Abstract: A method, system and program product for managing a size of a key management block (KMB) during content distribution is provided. Specifically, a first KMB corresponding to a first subtree of devices is received along with content as encrypted with a title key. If a size of the first KMB exceeds a predetermined threshold, a second subtree will be created. A second KMB corresponding to the second subtree of devices will then be generated. The second KMB contains an entry revoking the entire first subtree of devices and, as such, is smaller than the first KMD. Any compliant devices from the first subtree are migrated to the second subtree.

Abstract: An external module loads into an entity's memory and is transformed by two functions. These are namely, the STOMP function and the UNSTOMP function. One or both of these functions is based on the actual code that is found in a legitimate version of the external module. The STOMP-UNSTOMP pair produces an external module that works differently if even a single byte of code in the external module has been changed by an attacker. The STOMP transforms the external module and makes it temporarily unusable whilst conversely, the UNSTOMP repairs the damage and makes it workable again. Thus, if the module is not authentic, the pairing between the STOMP and UNSTOMP is broken. Therefore, a patched module from a hacker remains unusable since the STOMP and UNSTOMP transformations do not produce a working external module. Because of the STOMP and UNSTOMP technique, an application is secure because if an external module is free from tampering then the application executes normally.

Abstract: A method for verifying the integrity of a media key block (MKB) by storing validation data in a validation area of a medium, such as a DVD-R or a DVD-RW. In one embodiment, validation data comprises a hash function on a media key block. In another embodiment, validation data comprises the Verification Data field of an MKB's Verify Media Key Record.

Abstract: A method for verifying the integrity of a media key block (MKB) by storing validation data in a validation area of a medium, such as a DVD-R or a DVD-RW. In one embodiment, validation data comprises a hash function on a media key block. In another embodiment, validation data comprises the Verification Data field of an MKB's Verify Media Key Record.

Abstract: A method for verifying the integrity of a media key block (MKB) by storing validation data in a validation area of a medium, such as a DVD-R or a DVD-RW. In one embodiment, validation data comprises a hash function on a media key block. In another embodiment, validation data comprises the Verification Data field of an MKB's Verify Media Key Record.

Abstract: A method, system and program product for managing a size of a key management block (KMB) during content distribution is provided. Specifically, a first KMB corresponding to a first subtree of devices is received along with content as encrypted with a title key. If a size of the first KMB exceeds a predetermined threshold, a second subtree will be created. A second KMB corresponding to the second subtree of devices will then be generated. The second KMB contains an entry revoking the entire first subtree of devices and, as such, is smaller than the first KMD. Any compliant devices from the first subtree are migrated to the second subtree.

Abstract: The present invention provides a method, system and program product for modifying content usage conditions during broadcast content distribution. Specifically, the present invention allows protected (e.g., encrypted, secured, etc.) content to be received along with content usage conditions, an encrypted combination of the content usage conditions and a title key (e.g., a MAC), and a key management block. Using the key management block, a key encrypting key can be determined for decrypting the combination. Once the combination is decrypted, the content usage conditions can be modified (e.g., edited, added to, etc.).

Abstract: A method and system for attaching a title key to encrypted content for synchronized transmission to, or storage by, a recipient is provided. Specifically, under the present invention, an elementary media stream is parceled into content units that each include a content packet and a header. The content packets are encrypted with one or more title keys. Once the content packets have been encrypted, the title keys are themselves encrypted with a key encrypting key. The encrypted title keys are then attached to the corresponding encrypted content packets for synchronized transmission to a recipient.

Abstract: A system, method and computer readable medium for providing secure IP-based streaming in a format independent manner is disclosed. The method on a content mastering system begins with an encoded media file consisting of content data and associated metadata. First, the metadata is read from the encoded media file. Next, the encoded media file including the content data and the associated metadata is encrypted. Then, in a streaming server system, the encoded/encrypted media file is divided into more than one data packet, streamed in accordance with one or more parameters in the metadata. Each data packet includes a portion of the encoded/encrypted media file and an offset value corresponding to a location within the encoded/encrypted media file. The data packets are then streamed to a client information processing system (i.e., the client) over a network.

Abstract: A method to delivery encrypted digital content to a end user system for playing the content comprising the steps of: reading from a computer readable medium metadata which has previously associated with the content. A user selects from the metadata associated content to decrypt and the end user system establishes a secure connection with an authorization authority for decrypting the content. The end user system receives a secure container containing the decrypting key for decrypting at least part of the previously encrypted content as permitted. The system creates a secure container using the encrypting key from a clearing house, wherein the secure container has an encrypting key therein from the end user system; transferring the secure container to the clearing house for authentication of permission to decrypt the content.

Abstract: A method to delivery encrypted digital content to a end user system for playing the content comprising the steps of: reading from a computer readable medium metadata which has previously associated with the content. A user selects from the metadata associated content to decrypt and the end user system establishes a secure connection with an authorization authority for decrypting the content. The end user system receives a secure container containing the decrypting key for decrypting at least part of the previously encrypted content as permitted. The system creates a secure container using the encrypting key from a clearing house, wherein the secure container has an encrypting key therein from the end user system; transferring the secure container to the clearing house for authentication of permission to decrypt the content.

Abstract: In one aspect of the invention is a method for discouraging unauthorized redistribution of protected content. Content is bound to a customer I.D. associated with a customer requesting the content, such that the customer I.D. is needed to access the content.

Abstract: A method for verifying the integrity of a media key block (MKB) by storing validation data in a validation area of a medium, such as a DVD-R or a DVD-RW. In one embodiment, validation data comprises a hash function on a media key block. In another embodiment, validation data comprises the Verification Data field of an MKB's Verify Media Key Record.

Abstract: A method for verifying the integrity of a media key block (MKB) by storing validation data in a cutting area of a medium, such as a DVD-R or a DVD-RW. In one embodiment, validation data comprises a hash function on a media key block. In another embodiment, validation data comprises the Verification Data field of an MKB's Verify Media Key Record.

Abstract: A method of managing keys used by a digital content player on a computer system. According to the method, digital content data encrypted with a first encrypting key is decrypted using a first decrypting key, and re-encrypted using a second encrypting key. A second decrypting key is encrypted using a third encrypting key to produce an encrypted second decrypting key. In one preferred method, an encrypted first decrypting key that was encrypted using a fourth encrypting key is received, and the encrypted first decrypting key is decrypted using a fourth decrypting key to reproduce the first decrypting key. A digital content player for use on a computer system is also provided. The content player includes a decrypter that decrypts digital content data, which was encrypted with a first encrypting key, using a first decrypting key so as to produce the content data. An encrypter re-encrypts the content data using a second encrypting key and encrypts a second decrypting key using a third encrypting key.