Abstract: The anonymity of a user at a client computer may be preserved when authenticating with an on-line service or content provider through the use of an anonymous and verifiable (i.e., “blind”) certificate set that is created by a certificate authority from a fixed-size set of PKI key pairs. The certificate authority randomly selects a subset of PKI key pairs to generate the blind certificate set where each certificate in the set includes a respective public key from the PKI key pair subset. The certificate authority also sends the private keys from the PKI key pair subset to the user. During authentication, the client computer is configured to randomly select a subset of one or more certificates from the set to present to the provider. The provider will encrypt content using the public keys in the subset of certificates and the client will decrypt the content with the corresponding private keys.

Abstract: A protocol is provided that permits a third-party key issuing entity to have its issued keys protected by an unrelated key protecting entity. In at least some embodiments, a trusted key protecting entity is injected, in a sense, in a conversation between the third-party key issuing entity and a client to which one or more keys are distributed. The trusted key protecting entity is able to apply various protections which, in at least some embodiments are unknown to the key issuing entity, to a distributed key which can then be used by the client to access protected content.

Abstract: In accordance with one or more aspects of the separating keys and policy for consuming content, content has a corresponding leaf license, and the leaf license has one or more associated root policy addenda. Each root policy addenda includes policy identifying when it is permissible to decrypt and consume the content, but excludes a content key to decrypt the content. The content can be decrypted and consumed only if the policy identifies that it is permissible to decrypt and consume the content.

Abstract: The anonymity of a user at a client computer may be preserved when authenticating with an on-line service or content provider through the use of an anonymous and verifiable (i.e., “blind”) certificate set that is created by a certificate authority from a fixed-size set of PKI key pairs. The certificate authority randomly selects a subset of PKI key pairs to generate the blind certificate set where each certificate in the set includes a respective public key from the PKI key pair subset. The certificate authority also sends the private keys from the PKI key pair subset to the user. During authentication, the client computer is configured to randomly select a subset of one or more certificates from the set to present to the provider. The provider will encrypt content using the public keys in the subset of certificates and the client will decrypt the content with the corresponding private keys.

Abstract: In accordance with one or more aspects, a license for content is retrieved, the license having been previously embedded in the content. A requested action is allowed to be performed with the content only if a standalone license, or both a leaf license and a root license, indicate that the action with the content is permissible. Leaf licenses and/or standalone licenses can be embedded by a source of the content and/or by a target device that receives the content. Additionally, licenses can include one or more rules indicating where a target device that receives the content is to store the licenses.

Abstract: In accordance with one or more aspects of the separating keys and policy for consuming content, content has a corresponding leaf license, and the leaf license has one or more associated root policy addenda. Each root policy addenda includes policy identifying when it is permissible to decrypt and consume the content, but excludes a content key to decrypt the content. The content can be decrypted and consumed only if the policy identifies that it is permissible to decrypt and consume the content.

Abstract: A protocol is provided that permits a third-party key issuing entity to have its issued keys protected by an unrelated key protecting entity. In at least some embodiments, a trusted key protecting entity is injected, in a sense, in a conversation between the third-party key issuing entity and a client to which one or more keys are distributed. The trusted key protecting entity is able to apply various protections which, in at least some embodiments are unknown to the key issuing entity, to a distributed key which can then be used by the client to access protected content.