Abstract: A scalable access filter that is used together with others like it in a virtual private network to control access by users at clients in the network to information resources provided by servers in the network. Each access filter use a local copy of an access control database to determine whether an access request made by a user. Changes made by administrators in the local copies are propagated to all of the other local copies. Each user belongs to one or more user groups and each information resource belongs to one or more information sets. Access is permitted or denied according to of access policies which define access in terms of the user groups and information sets.

Abstract: A content transmitting apparatus and the like which execute copy control of content more securely than conventional, and can count copy number correctly according to the situation, even in the case where content transfer is interrupted are provided. The content reproducing apparatus for transmitting content that is digital copyrighted work including a plurality of content blocks includes: the content reproducing unit which reads out content and the like from the DVD; the control unit which repeats, for each of the plurality of content blocks, transmitting in parallel with the content blocks, the copy control information indicating copy permission of the content, the content identification information identifying content, and the content status information indicating status of the content blocks in the overall content; the data building unit; the transmission unit; and the like.

Abstract: To provide a configuration in which a unit classification number corresponding to a content playback path is set based on various units. A unit classification number defining a playback path of content including encrypted data having different variations generated by encrypting a segment portion which forms the content by using a plurality of segment keys and encrypted content generated by encrypting a non-segment portion by a unit key is set based on various units, such as a content management unit and an index. In a CPS unit key file storing key generating information concerning CPS units as content management units, settings of unit classification numbers are indicated. Based on the CPS unit key file, a unit classification number to which content to be played back belongs can be obtained.

Abstract: The present invention relates to a method for transferring content to a device, the method including the steps of: receiving a request for content from the device; delivering a uniquely identifiable, ephemeral player to the device; and transferring content to the device, for presentation on the device by the player. The invention has particular application to digital rights management in respect of the distribution of audiovisual content such as film and television programs, advertisements and live event broadcasts over communication networks such as the Internet.

Abstract: A system and method of encrypting digital content in a digital container and securely locking the encrypted content to a particular user and/or computer or other computing device is provided. The system uses a token-based authentication and authorization procedure and involves the use of an authentication/authorization server. This system provides a high level of encryption security equivalent to that provided by public key/asymmetric cryptography without the complexity and expense of the associated PKI infrastructure. The system enjoys the simplicity and ease of use of single key/symmetric cryptography without the risk inherent in passing unsecured hidden keys. The secured digital container when locked to a user or user's device may not open or permit access to the contents if the digital container is transferred to another user's device. The digital container provides a secure technique of distributing electronic content such as videos, text, data, photos, financial data, sales solicitations, or the like.

Abstract: A content storage device comprises a content storage unit which stores master content with content handling information including conditions of copy limitations added thereto, content information management units which acquire to individually manage content information related to the conditions of the copy limitations from the content handling information added to the stored content in storing the master content, a content information provision unit which reads to provide management information in response to a request, and a copy limitation processing unit which determines the conditions of the copy limitations from the management information of the content information management unit in copy requesting of the master content and instructs execution of copy processing only when the conditions are satisfied, and updates the conditions of the copy limitations in accordance with instructing execution of the copy processing.

Abstract: A method, apparatus, and computer program product, responsive to receiving a data from a computing device connected to the computer in a cloud computing system or data center, identifies a criteria associated with the computing device, responsive to identifying the criteria, determines whether the data is authorized for transmission to a storage in the cloud computing system or data center, and responsive to determining that the data is authorized for transmission to the storage, forwards the data to the storage.

Abstract: An output control method for controlling copy operation for a digital broadcast program permitted to be recorded for one generation (copy one generation) with an improved operating convenience. A digital content and a plurality of types of copy control information for controlling the copies of the digital content are received, and in accordance with the copy control information, the digital content is output to a plurality of recording media connected through a network. If first information contained in the copy control information received indicates copy generation information to permit copies for one generation and second information contained in the copy control information indicates “limited number of copies permitted” mode permitting a predetermined number of copies, then the digital content is output to only one of the recording media in a state permitting copying up to the predetermined number.

Abstract: A method and system implementing software licensing management under machine virtualization are disclosed. According to one embodiment, a system comprises a virtual platform running on a physical machine; a binding agent running on a host operating system of the virtual platform; a license enforcement module running on a virtual machine instance of the virtual platform. The license enforcement module is in communication with the binding agent. The binding agent enforces a mutex lock to ensure that only a specified number of license enforcement modules are running on the physical machine.

Abstract: A device for playback (8) of content (2) in accordance with a license (4) comprises a processing unit (3) for accessing the license and for specifying usage information for the content. The processing unit is communicatively connected to a usage indicator (5) for providing a measure of usage and a communication unit (6). Usage information is set by the processing unit to allow usage of the content if the measure of usage has been communicated to a service provider (10) in accordance with instructions derived from the license, else usage of the content is forbidden.

Abstract: An automated system and method for piracy control based on user generated updates is described. The system and method described renders human intervention for piracy control superfluous and, therefore, is cost-effective, and consumes less time. The automated system and method for piracy control based upon update requests significantly reduces the number of update requests by pirated copies of the software, reduces the burden on the update server and smoothens the overall user experience for the legitimate users of the software.

Abstract: Methods, systems, and apparatuses for implementing shared-license software management are provided. Shared-license software management may be performed by generating a request for a license for running a process of a shared-license software application. The request is communicated to a license server, and the process is made available for scheduling an operation when a grant for the requested license is received from the license server, wherein the grant comprises a license quantum, which is an amount of central processing unit time for which the license has been granted to the process.

Abstract: An apparatus for enforcing a media stream delivery restriction uses a stream control service (SCS). The SCS is implemented in a distributed network, such as a CDN, in which a given media stream is delivered to authorized end users from multiple delivery servers, but where an authorized end user is associated with a single log-in identifier that is not intended to be shared with other end users. According to the method, an enforcement server of the SCS identifies first and second copies of the given media stream associated with the single log-in identifier being delivered from multiple delivery servers. It then issues message to terminate delivery of the given media stream from at least one of the multiple delivery servers.

Abstract: A computer-implemented method, system, and/or computer program mediates a co-editing session for a document. After establishing a co-editing session for a first user and a second user to co-edit a document, a first modification of the document is received from the first user. A second modification of the document, which eliminates the first modification, is subsequently received from the second user. In response to a quantity of subsequent modifications, after the first and second modifications, exceeding a predetermined value, an action is initiated to prevent further modifications to the document.

Abstract: A method of maintaining a version counter indicative of a version of memory content stored in a processing device. The method comprises selectively operating the device in a first or second mode. Access to the first mode is limited to authorized users and controlled separately from access to the second mode. In the first mode at least an initial integrity protection value is generated for cryptographically protecting an initial counter value of said version counter during operation of the processing device in the second mode; wherein the initial counter value is selected from a sequence of counter values, and the initial integrity protection value is stored as a current integrity protection value in a storage medium. In the second mode, a current counter value is incremented to a subsequent counter value; wherein incrementing includes removing the current integrity protection value from said storage medium.

Abstract: A system and method of providing universal digital rights management system protection is described. One feature of the invention concerns systems and methods for repackaging and securing data packaged under any file format type, compression technique, or digital rights management system. Another feature of the invention is directed to systems and methods for securing data by providing scalability through the use of modular data manipulation software objects.

Abstract: A method for using time from a trusted host device is disclosed. In one embodiment, an application on a memory device receives a request to perform a time-based operation from an entity authenticated by the memory device, wherein the entity is running on a host device. The application selects time from the host device instead of time from a time module on the memory device to perform the time-based operation and uses the time from the host device to perform the time-based operation. Other embodiments are disclosed, and each of the embodiments can be used alone or together in combination.

Abstract: A broadband gateway, which enables communication with a plurality of devices, handles at least one physical layer connection to at least one corresponding network access service provider. Security boundaries such as conditional access (CA) and/or digital right management (DRM) boundaries associated with the broadband gateway are identified based on security profiles associated with the plurality of devices and/or a service from networks. The identified security boundaries are utilized to determine or negotiate CA information for content access for the service. The received content may be distributed according to the determined CA information and the security profiles of the corresponding devices. The broadband gateway may be automatically and dynamically configured based on the identified security boundaries to secure content distribution to the devices.

Abstract: A digital content protection apparatus and method for digital rights management (DRM) are provided in which a content file including a plurality of content parts is imported such that a header is included which stores location information required for decoding each of the content parts. Therefore, the number of content parts constituting the content file can be recognized, and a license that is required for the use of each of the content parts can be acquired by analyzing header information without necessitating the parsing of the transport packets of the content file. Accordingly, preparation time for using content can be reduced.

Abstract: A method, system, mediation server, client, and computer program for deleting a copied file in which a master file is duplicated while maintaining a certain level of security. A mediation server receives and stores a copied file in which a master file stored in a server is duplicated, generates private-key information and public-key information, and transmits the generated public-key information and the copied file to a client. The client receives and stores the copied file and the public-key information. In a case where the copied file is updated, the client encrypts difference information on the difference arising in the updating using the public-key information and transmits the difference information to the mediation server. The client determines whether the condition for being secure is satisfied when a process for updating the copied file becomes possible. When determining that the condition is not satisfied, the client deletes the copied file.

Abstract: A recording medium comprises an IC chip including circuitry configured to record data of one or more kinds of software, transmit and receive information to and from an external apparatus without contacting the external apparatus, and communicate with the external apparatus and execute mutual authentication processing for permitting access to the recorded information. The data recorded on the circuitry includes identification information for respective kinds of software recorded on a recording surface of the recording medium, key information necessary for installation of the respective kinds of software, and usage control information indicating a number of installations available for installation of the respective kinds of software. The key information is readout to the external apparatus and the usage information is rewritten by the external apparatus only when mutual authentication is correctly performed between the IC chip and the external apparatus.

Abstract: A method and system process a document having attached thereto a set of digital rights specifications, the digital rights specifications specifying constraints on the processing of the document. A workflow controller selects candidate devices, for processing the document, from a plurality of devices and determines, for each candidate device, that the device meets the digital rights specifications requirements. A set of devices are assigned to process the document from the set of devices that meet the digital rights specifications constraints. The workflow controller detects a failed device included in the assigned set of devices to process the document and determines potential candidate devices to replace the failed device. For each potential candidate device, it is determined if the potential candidate device meets the digital rights specifications requirements. A device that meets the digital rights specifications constraints is assigned to replace the failed device.

Abstract: Embodiments of the present disclosure provide for upgrades and synchronization of applications installed on a device, such as a mobile device. In one embodiment, a device may include applications purchased and downloaded via a content management system. The device maintains a list or database of applications that are authorized for each device. This list is also replicated in a remote cache that is maintained by an archive host. The device may then synchronize and upgrade these applications across multiple platforms, such as one or more computers that can be coupled to the device or the archive host. The archive host allows for files of the application be provided back to the device. Upon installation, the device can then confirm the authorization and identity of the newly installed application.

Abstract: A method and system for capacity licensing are disclosed. According to one embodiment, a computer implemented method comprises receiving a capability request from a device, sending a capability response to the device, the capability response comprising a serving of license rights. A deduction record is stored, the deduction record deducting a license from a license pool. An information request is received from the device, and an information response is sent.

Abstract: An approach is provided for relaying media and creating new content from the media via a social network. Audio content is caused to be received from one of a plurality of devices. The one device is associated with a member of a first list of contacts. New audio content is generated based on the received audio content. The new audio content is caused, at least in part, to be transmitted to another one of the devices. The other one device is associated with a member of a second list of contacts.

Abstract: A computing device detects a command to perform a print screen operation. On detecting the command to perform the print screen operation, the computing device identifies a file associated with a displayed application window. The computing device determines whether the file contains confidential information. Upon determining that the file contains confidential information, the computing device performs an action to enforce a data loss prevention policy.

Abstract: A method distributes personalized circuits to one or more parties. The method distributes a generic circuit to each party, encrypts a unique personalization value using a secret encryption key, and transmits each encrypted personalization value to the corresponding party. Each party then stores the encrypted personalization value in their circuit. The stored encrypted personalization value allows a piece of software to be properly executed by the circuit. A semiconductor integrated circuit is arranged to execute a piece of software that inputs a personalization value as an input parameter. The circuit comprises a personalization memory arranged to store an encrypted personalization value; a key memory for storing a decryption key; a control unit comprising a cryptographic circuit arranged to decrypt the encrypted personalization value using the decryption key; and a processor arranged to receive the decrypted personalization value and execute the software using the decrypted personalization value.

Abstract: A device is provided for securely transferring digital data between at least one first computer system and at least one second computer system, including a controller that connects to at least one data store, a first transfer device connected to the controller and that receives the digital data from the first computer system and sends the data to the controller, a second transfer device connected to the controller and that receives the digital data from the controller and sends the data to the second computer system, and which is managed independently from the first transfer device. A corresponding transfer method and media containing a computer program are also provided.

Abstract: A method responsive to receiving a data from a computing device connected to the computer in a cloud computing system or data center, identifies a criteria associated with the computing device, responsive to identifying the criteria, determines whether the data is authorized for transmission to a storage in the cloud computing system or data center, and responsive to determining that the data is authorized for transmission to the storage, forwards the data to the storage.

Abstract: A new system for information sharing is described which uses human judgement to accelerate the flow of information, while simultaneously applying brakes to restrict the velocity. This combination results in a system where information is shared judiciously while minimizing the likelihood of information leakage or information overload. A built in monitor allows for the detection over time of sharing characteristics. Information in this system is stored on a server, however, is optionally encrypted in a fashion that makes it impossible for the server to actually see the information. Further innovations are also described including the ability to overlay incentive mechanisms to facilitate appropriate information sharing, and the notion of introducing automated bots into the system to augment human filter based information sharing.

Abstract: A method and apparatus for provisioning a subscription product is disclosed. The method comprises receiving a request for a subscription product; retrieving a profile and at least one subscription associated with the profile, wherein the at least one subscription comprises a plurality of subscription details; validating the plurality of subscription details; retrieving product data for the subscription product based on the validated subscription details; determining a dominant subscription product when there are at least two subscriptions associated with the profile; and sending the product data for the dominant subscription product, wherein the product data enables activation of a product license.

Abstract: A system is disclosed for identifying and preventing non-compliant uses of any portion of source code or other protected content. The system includes at least one processor and a memory storing instructions that cause the system to scan files located at a source location for excerpts of protected source code. The instructions may cause the system to create a temporary clone detection structure for the files at the source location. The instructions may cause the system to use the temporary clone structure and a pre-calculated clone structure for source code files in a protected code location, to identify code clones, and to generate data used to alert a user that the source location includes portions of source code from the protected code location. When clones are found, the instructions may optionally cause the system to prevent the copying of the files containing the code clones.

Abstract: A content exporting and reproducing method includes i) a content export step of encrypting a decryption key for content, that is used for decrypting the encrypted content, by using an encryption key for decryption key, recording the encrypted decryption key for content in the portable recording medium, and exporting the encrypted content sequentially to the portable recording medium, and ii) a content reproduction step of reading out the encrypted decryption key for content from the portable recording medium, decrypting the encrypted decryption key for content by using a decryption key for decryption key, reading out the encrypted content that has been exported to the portable recording medium, and decrypting the encrypted content that is read out from the portable recording medium, by using the decrypted decryption key for content to reproduce the content, while the encrypted content is exported to the portable recording medium sequentially.

Abstract: Dynamic licensing improves the utilization of licenses available within a computer network. License sinks, such as gateways, within a computer network may request licenses from a license source. The license source may be provisioned with a number of licenses from a secure fob plugged into the license source. If the license source has the number of licenses requested from the license sink, the license source may assign the licenses to the license sink. After a certain period of time, the license sink may renew the licenses or let the licenses return to the license source to be assigned to another license sink. The license requests may be passed through the network, including through a proxy and/or a relay, to a license server provisioned with licenses. Dynamic licensing software may execute as a service on each of the license sources and license sinks to pass dynamic licensing messages between devices.

Abstract: Embodiments provide a method and device for distributing an electronic document. The electronic document possesses first authorized copies information used to record a first number of authorized copies for the electronic document a local user may distribute. Every time the electronic document is distributed to a user, second authorized copies information is sent to the user, which second authorized copies information is used to record a second number of authorized copies for the electronic document the user may distribute, and the second number of authorized copies is less than or equal to the first number of authorized copies currently recorded in the first authorized copies information.

Abstract: Partial access to electronic documents and aggregation for secure document distribution is disclosed. The embodiments herein relate to providing access to electronic documents and, more particularly, to providing access to portions of electronic documents and aggregating such portions in secure document distribution environment. Existing document distribution mechanisms do not provide means to access partial documents based on the attributes such as roles of the agents within an organization, location of access, time of access, device ID and so on. The disclosed method allows agents to access partial contents of documents based on the attributes. Meta data tags are attached to the documents in order to control the access of the documents by the defined attributes.

Abstract: Systems and methods are described for applying digital rights management techniques to manage zones in electronic content. In one embodiment, zones are defined in a piece of electronic content, and a license is associated with the electronic content that indicates how the zones are to be accessed or otherwise used. A digital rights management engine governs access to or other use of the zoned content in accordance with the license.

Abstract: Methods, apparatus, and computer-accessible storage media for controlling export of snapshots to external networks in service provider environments. Methods are described that may be used to prevent customers of a service provider from downloading snapshots of volumes, such as boot images created by the service provider or provided by third parties, to which the customer does not have the appropriate rights. A request may be received from a user to access one or more snapshots, for example a request to export the snapshot or a request for a listing of snapshots. For each snapshot, the service provider may determine if the user has rights to the snapshot, for example by checking a manifest for the snapshot to see if entries in the snapshot manifest belong to an account other than the customer's. If the user has rights to the snapshot, the request is granted; otherwise, the request is not granted.

Abstract: A computer program product for secure key management is provided. The computer program product includes a tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for creating a token and populating the token with key material, and binding key control information to the key material. The key control information includes information relating to usage of the key material populating one or more key usage fields that define attributes that limit actions that may be performed with the key material.

Abstract: An information processing device includes: a memory having a protected area which is a data recording area in which access restriction is set; and a data processing unit that determines accessibility in response to a request for accessing the protected area from an access requesting device, wherein the data processing unit verifies a device certificate received from the access requesting device and determines accessibility to the protected area based on access control information recorded in the device certificate.

Abstract: A secure document printing system is provided. A policy server is used to define access rules for a document, and select individual users and/or groups that will have access to the document. The policy server stores the access rules along with a document decryption key. The policy server's name and address are packed in the document, and then encrypted and sent to a print server which stores it for later access. A recipient is notified that the document resides on a particular print server. The print server retrieves the specified document, contacts the policy server named in the document, and requests the document decryption key and access rules for the user, print server, and document from the policy server which replies with the related decryption key and access rules. The print server decrypts the document and prints the document based on the access rules.

Abstract: Provided is an apparatus and method of securely moving security data. An apparatus for securely moving security stored in a first apparatus to a second apparatus, includes a status setting unit which set status information of the security data to a disabled state; a data providing unit which creates a copy of the security data and determines whether the created copy can be transmitted to the second apparatus; and a data deleting unit which deletes the security data when the copy is completely transmitted.

Abstract: A service management apparatus is provided that allows management of a shared license among devices, including a user storage unit storing a user and at least one associated terminal; a license information storage unit storing a license including a terminal to be permitted to use a predetermined service and license information for identifying a setting limitation; a setting request reception unit receiving a setting request for the license including information for identifying the terminal that has issued the setting request and the user; an associated terminal identification processing unit identifying the terminal that is associated with the user included in the request; a license identification processing unit identifying the license that each terminal to be identified is permitted to use and is settable to the terminal that has issued the request; and a license setting processing unit setting the identified license to the terminal that has issued the request.

Abstract: The present invention relates generally to processing audio or video content. One claim recites an apparatus comprising: electronic memory for storing media representing audio or video content; and an electronic logic processor. The electronic processor is programmed for: embedding a protect watermark in the media, the protect watermark providing an indication that the media is protected; embedding a rights watermark in the media, the rights watermark providing an indication of user rights associated with rendering the audio or video content, in which the protect watermark is more difficult to remove from the media relative to the rights watermark; and reproducing the audio or video content after said embedding a protect watermark in the media and embedding a rights watermark in the media. Other claims and combinations are provided as well.

Abstract: The present invention relates to a device having a first determining unit configured to determine whether version information included in a two-dimensional code included in an input image is version information that is supported by the device and a second determining unit configured to determine to prohibit printing of the input image when the included version information is determined to be version information that is not supported by the device or to determine whether to permit or prohibit printing of the input image based on information other than the version information included in the two-dimensional code when the included version information is determined to be version information that is supported by the device. With this arrangement, it is possible to execute processing in accordance with version information included in a two-dimensional code.

Abstract: A method, apparatus and computer program product for providing one-time programs is presented. A program to be converted to a new program having a predetermined lifetime is identified. The program is compiled to produce the new program having a predetermined lifetime and wherein the new program having a predetermined lifetime is guaranteed to only have the predetermined lifetime.

Abstract: A system and method for managing licensing of virtual environment applications. A licensing module of a first installed virtual environment application detects installation of affiliated applications and gives them a group licensing key for passing it to the licensing server. The licensing server derives licensing parameters of the affiliated applications from the group key and gives the licenses to the affiliated applications, in case of successful validation. The licensing system provides protection from un-authorized copying of the applications. If an affiliated virtual environment application is copied (or moved) to another hardware node without its virtual environment, the licensing server will not give the license activation key to this virtual environment application.

Abstract: Systems and methods for site-dependent embedded media playback manipulation whereby a media owner can enable limited embedding on non-owned or non-monetized websites to direct traffic to a more valuable location. The content owner can specify sets of internet locations with associated sets of rules governing content playback criteria as well as restrictions based upon user categorizations. A playback restriction system consists of a media delivery system and a playback rules system. The media delivery system controls the delivery of the media file with embedded restrictions. The playback rules system controls the nature of the restrictions and the rules of when they are applied. Users will be directed to the location of a more valuable website where the media can be viewed with a less restrictive set of rules.

Abstract: A computer program product for secure key management is provided. The computer program product includes a tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for creating a token and populating the token with key material, and binding key control information to the key material. The key control information includes information relating to management of the key material populating one or more key management fields that define attributes that limit distribution of the key material.

Abstract: According to the type of each of a plurality of external input interfaces, it is decided whether digital watermark information is to be detected from data entered via the external input interface. Digital watermark information is not detected from data entered via the external input interface and from which it has been decided not to detect any digital watermark information, but the data is recorded. Thus, there can be provided a data recording apparatus which is not applied with a any heavy load owing to the omission of any unnecessary detection of digital watermark information.