Abstract: Techniques enable creation of a preview license for digital content. In some instances, the preview license indicates that it allows a content-consuming device to consume less than all of the content. This preview license may create a list specifying multiple portions of the digital content that the content-consuming device may consume. These techniques may also present to a device user an offer to purchase rights to consume all of the digital content after consumption of the preview-licensed portion(s). In other instances, a content server may embed the preview license into a content package that contains the digital content, allowing the server to distribute the package to multiple devices. In still other instances, the preview license may be bound to a domain rather than to individual devices. This allows member devices to share the digital content and the preview license, such that each member device may enjoy the preview experience.

Abstract: Techniques enable creation of a preview license for digital content. In some instances, the preview license indicates that it allows a content-consuming device to consume less than all of the content. This preview license may create a list specifying multiple portions of the digital content that the content-consuming device may consume. These techniques may also present to a device user an offer to purchase rights to consume all of the digital content after consumption of the preview-licensed portion(s). In other instances, a content server may embed the preview license into a content package that contains the digital content, allowing the server to distribute the package to multiple devices. In still other instances, the preview license may be bound to a domain rather than to individual devices. This allows member devices to share the digital content and the preview license, such that each member device may enjoy the preview experience.

Abstract: Techniques enable creation of a preview license for digital content. In some instances, the preview license indicates that it allows a content-consuming device to consume less than all of the content. This preview license may create a list specifying multiple portions of the digital content that the content-consuming device may consume. These techniques may also present to a device user an offer to purchase rights to consume all of the digital content after consumption of the preview-licensed portion(s). In other instances, a content server may embed the preview license into a content package that contains the digital content, allowing the server to distribute the package to multiple devices. In still other instances, the preview license may be bound to a domain rather than to individual devices. This allows member devices to share the digital content and the preview license, such that each member device may enjoy the preview experience.

Abstract: A system is disclosed for providing trusted third-party management of user device domains in a digital rights management environment. The system includes a plurality of content providers that distribute digital content items via user accounts having associated user device domains. The user device domains are managed by an independent domain manager. The domain manager includes a device registrar which is operative, for a given user device domain, to receive a request to add a device to the user device domain. If the request is grantable, a domain controller of the domain manager is operative to cause a domain private key to be transmitted to the device being added to the user device domain. The domain private key is usable at the device to decrypt a content key which was previously released to the user device domain for decrypting protected digital content.

Abstract: Various embodiments for software application verification are disclosed. Software application verification applies digital rights management to applications that run protected content on a playback device. In this way, protected content may be provided to approved applications and withheld from applications that have not been approved to run the protected content.

Abstract: Various embodiments enable so-called extended data to be added to a signed digital certificate without having a private key of a Certification Authority available. In at least some embodiments, a request to add extended data to a digital certificate generated by a certificate authority is received from a client device. The digital certificate includes a signed first portion, and an unsigned second portion that includes reserved empty spaces that are reserved for the extended data. The extended data is added to the unsigned second portion. the extended data includes a client ID associated with the client device. The unsigned portion of the digital certificate is signed after the extended data is added.

Abstract: This document describes tools capable of enabling cloud-based movable-component binding. The tools, in some embodiments, bind protected media content to a movable component in a mobile computing device in a cryptographically secure manner without requiring the movable component to perform a complex cryptographic function. By so doing the mobile computing device may request access to content and receive permission to use the content quickly and in a cryptographically robust way.

Abstract: A content license associated with unencrypted digital content is generated, the content license including both an identifier of the unencrypted digital content and a content policy. At a user device, a determination is made as to whether the content license corresponds to particular unencrypted digital content. Use of the particular unencrypted digital content by the computing device is permitted in accordance with the content policy if the content license corresponds to the particular unencrypted digital content. However, use of the particular unencrypted digital content by the computing device based on the content license is prohibited if the content license does not correspond to the particular unencrypted digital content.

Abstract: This document describes techniques and apparatuses enabling application of digital rights management (DRM) to media streams. In one embodiment, three license levels are used to protect numerous television channels without undue use of computing resources.

Abstract: Techniques enable building a collection of data that defines an asset, with the data possibly having differing data types. These techniques are then capable of assigning arbitrary policy to that asset, regardless of which data types are present within the asset. In addition, these techniques enable packaging of this first asset with one or more additional assets in a self-contained envelope. Each asset within the envelope may similarly include data of differing data types. Furthermore, each of these assets may be assigned a policy that may be different than the policy assigned to the first asset. This envelope, or a collection of envelopes, may then be provided to a content-consuming device to consume the assets in accordance with each asset's specified policy.

Abstract: Systems, methods, and/or techniques (“tools”) for binding content licenses to portable storage devices are described. In connection with binding the content licenses to the portable storage devices (“stores”), a host may perform authentication protocols that include generating a nonce, sending the nonce to a store, and receiving a session key from the store, with the session key being generated using the nonce. The store may perform authentication protocols that include receiving the nonce from the host, generating a random session key based on the nonce, and sending the session key to the host.

Abstract: Systems, methods, and/or techniques (“tools”) for binding content licenses to portable storage devices are described. In connection with binding the content licenses to the portable storage devices (“stores”), a host may perform authentication protocols that include generating a nonce, sending the nonce to a store, and receiving a session key from the store, with the session key being generated using the nonce. The store may perform authentication protocols that include receiving the nonce from the host, generating a random session key based on the nonce, and sending the session key to the host.

Abstract: Various embodiments enable so-called extended data to be added to a signed digital certificate without having a private key of a Certification Authority available. In at least some embodiments, a digital certificate can be issued and signed off line by the Certification Authority, and then later extended data can be added and signed using another key, whose public key was earlier embedded and signed in the certificate.

Abstract: Various mechanisms are provided for the lockdown of an item store. For example, a method is provided that comprises of disabling access to a relational engine for a set of users associated with a filing system utilizing the relational engine to manipulate data in an item store. Following such disabling of access, an exception is created by allowing access to the relational engine for users of the filing system based on a set of privileges the users have been assigned. The disabling of access can be accomplished by removing system users from ownership roles, and the allowing of access can be accomplished by providing certificates to users that have associated set of privileges granted to the users.

Abstract: Various embodiments utilize a third party, such as a trusted third-party, to perform DRM operations such as “move” operations. In at least some embodiments, the trusted third-party is utilized for both “move” operations as well as local content access such as playback and the like. In at least some embodiments, a third-party maintains a database that includes an association of clients, content, and move version numbers. A client—termed a “source client” maintains at least a move version number locally in a secure fashion. The version number is incremented each time the source client performs a move operation. Both the source client and the third-party increment the version number each time a piece of content is moved. When the client attempts to perform a move operation, it contacts the third-party to ascertain the third-party's move version number. If the move version numbers match and the source client owns the license/content, then, in at least some embodiments, a move operation is permitted.

Abstract: Various embodiments provide a mapping layer to translate DRM system requirements from one DRM system, such as a source system, to another DRM system, such as a target system. In at least some embodiments, DRM system requirement translation is performed using a signed data structure that maps DRM system requirements from one DRM system to one or more other DRM systems. By mapping DRM system requirements from one system to another, licenses associated with DRM-protected content and associated content can be safely transferred between systems.

Abstract: A content license associated with unencrypted digital content is generated, the content license including both an identifier of the unencrypted digital content and a content policy. At a user device, a determination is made as to whether the content license corresponds to particular unencrypted digital content. Use of the particular unencrypted digital content by the computing device is permitted in accordance with the content policy if the content license corresponds to the particular unencrypted digital content. However, use of the particular unencrypted digital content by the computing device based on the content license is prohibited if the content license does not correspond to the particular unencrypted digital content.

Abstract: This document describes techniques and apparatuses enabling application of digital rights management (DRM) to media streams. In one embodiment, three license levels are used to protect numerous television channels without undue use of computing resources.

Abstract: Embodiments are disclosed for providing trusted local enforcement of advertisement policies that are associated with digital content. One method includes receiving digital content and an associated advertisement policy at a network client. These items are received at the network client via a network from a content provider. A request is received to present the digital content with a media application of the network client. The method includes using a trusted agent of the network client to verify the authenticity of the advertisement policy in response to the request to present the content. The trusted agent operates to enforce the advertisement policy as a condition of presentation of the digital content at the media application.

Abstract: A system is disclosed for providing trusted third-party management of user device domains in a digital rights management environment. The system includes a plurality of content providers that distribute digital content items via user accounts having associated user device domains. The user device domains are managed by an independent domain manager. The domain manager includes a device registrar which is operative, for a given user device domain, to receive a request to add a device to the user device domain. If the request is grantable, a domain controller of the domain manager is operative to cause a domain private key to be transmitted to the device being added to the user device domain. The domain private key is usable at the device to decrypt a content key which was previously released to the user device domain for decrypting protected digital content.