Abstract: Providing access to content for devices is performed by providing multiple entitlement management messages (EMMs), each which including a service key, to the plurality of devices. Also, a same entitlement control message (ECM) is provided to the devices. The ECM includes an encrypted traffic key for decrypting content. Each of the devices derives an access key from the service key according to a business model level of access to the content for a user of the devices and uses the access key to decrypt the traffic key to access the content according to the business model level of access to the content for the each of the plurality of devices.

Abstract: Embodiments of the invention generally provide a method and apparatus for insuring digital content. One embodiment of a method for insuring digital content includes receiving a request to insure a specific instance of digital content and associating insurance with the instance of digital content, such that the instance of digital content can be restored to an owner of the instance of digital content in an event that the instance of digital content becomes unusable. At least one of: a copy of the at least one instance of digital content, metadata related to the at least one instance of digital content, and data related to the insurance is stored in at least one database.

Abstract: A process is provided. The process determines member devices in a domain of devices. Further, the process encrypts a set of content with a content encryption key to generate an encrypted set of content. In addition, the process encrypts the content encryption key with each of a plurality of pre-fetch keys to generate a plurality of encrypted content encryption keys. Each of the pre-fetch keys corresponds to a member device in the domain of devices. Finally, the process stores each of the encrypted content encryption keys in a content license corresponding to a member device in the domain of devices. The encrypted content may be stored on a removable medium. Further, the process allows another device to play back the content from the same removable medium.

Abstract: Content delivered to client device over an Internet Protocol Multimedia Subsystem (IMS)-based network is protected through a digital rights management (DRM) scheme that leverages IMS service and access infrastructure, such as the IMS core. After authentication and selection of content to be played for the user, the network identifies a key management system having keys for decrypting the selected content. A bootstrapping service function participates in an application-level authentication of the client device to establish a secure communication channel between the key management system and the client device. The key management system responds to a content key request received from the client device by providing a content key via the secure communication channel. The network can then stream content to the client device, which decrypts it using the content key.

Abstract: A method of providing permissions to consume content objects within a domain includes creating a domain and a domain membership rights object for each member. The domain facilitates the sharing of content objects amongst the members of the domain. The domain membership rights objects for each member include permissions for each member in the domain to consume content objects in the domain.

Abstract: A copyright protection method and apparatus employ a first protection scheme within a single authorized domain, in which all interfaces are protected with digital rights management system, and employ a second protection scheme for use in inter-domain file transfers. The method and apparatus employ a third protection scheme for external outputs not protected by a digital rights management system.

Abstract: An application programming interface (API) for managing resources in a Digital Television (DTV) Receiver/Terminal. The API provides a uniform mechanism for gaining/controlling access to resources, managing multiple resources of the same type, and accessing the individual resource's management state and status. The resources may include, for example, a tuner, a modem, a database, a plug-in module, a cable, a software module, a network interface card, or a conditional access module. The resources are monitored and controlled either locally at the terminal, or remotely, e.g., from a head-end or an uplink. The API provides a resource package (40) for registering the available resources at the terminal, a resource state management package (30) for managing states of the resources, and a registry package (20) for storing objects that represent the resources. Resources of the same type are managed as a group.

Abstract: A process may be utilized by a DVR. The process characterizes a set of content as a plurality of segments as the set of content is received. Each of the segments has a segment length according to a predetermined time interval. Further, the process encrypts each of the segments with a corresponding content encryption key to generate a plurality of encrypted segments. The corresponding content encryption key for each of the segments is generated by the DRM component. In addition, the process stores each of the encrypted segments for playback with trick play features in accordance with an expiration content rule having a time limit on the temporary playability of the set of content.

Abstract: A process is provided. The process stores, on a first device, each segment of a set of content having corresponding copy control information. Further, the process receives, from a second device, a request for a copy of the set of content. In addition, the process analyzes a list of the copy control information associated with each segment of the set of content. The process also establishes a restriction indicator, based on the request for the copy of the set of content, for one or more segments of the set of content having a corresponding copy control information value. Finally, the process provides to the second device, the content, the list of copy control information, and the restriction indicator for the one or more segments.

Abstract: Embodiments of the invention generally provide a method and apparatus for enabling digital rights management in file transfers. One embodiment of a method for transferring digital content from a first user to a second user, includes transferring ownership of an instance of the digital content to the second user, where the instance of the digital content resides on a first device belonging to the first user. Copies of the digital content are then deleted from one or more additional devices belonging to the first user (including at least one offline device).

Abstract: A process composes a content license for a set of content. The content license has a static portion and a dynamic portion. Further, the process inserts a master key into the static portion. In addition, the process inserts a plurality of content rule sets of values into the dynamic portion and composes a unique content encryption key for each segment of content associated with one of the content rule sets of values as each of the content rule sets of values is sequentially received during recording of the content. The unique content encryption key is based on the master key and at least a subset of the content rule set of values for a corresponding segment of the content. The unique content encryption key is utilized for encryption of each segment of the content to generate a plurality of encrypted content segments for storage on the storage medium.

Abstract: A process may be utilized by the DVR. The process receives a plurality of segments of a set of content and a plurality of corresponding content rule sets. Further, the process provides one or more instructions to record and encrypt the plurality of segments of the set of content on a storage medium. In addition, the process provides the plurality of content rule sets to the DRM component to be inserted into a locally generated and secured content license associated with the encryption of the set of content. The secured content license includes a master key and a list of the plurality of corresponding content rule sets that have been received in order of reception. The process receives a plurality of marker tokens from the DRM component in order to facilitate trick mode playback.

Abstract: A method is provided that authenticates a data transfer module. Further, the method establishes a secure tunnel between a first processor, which receives a copy protection key from the data transfer module, and a second processor, which receives the copy protection key from the first processor through the secure tunnel. In addition, the method receives, at the second processor, encrypted content from the data transfer module. The method also decrypts, at the second processor, the encrypted content with the copy protection key to generate decrypted content.

Abstract: A method is provided that establishes a secure tunnel with a content acquisition processor that acquires encrypted content from a content source and decrypts the encrypted content to obtain content. The content acquisition processor is not trusted for providing digital rights management. Further, the method transmits a request through the secure tunnel to the content acquisition processor to re-encrypt the content with a content encryption key so that re-encrypted content is generated and stores the re-encrypted content on a storage medium. The request includes the content encryption key.

Abstract: A method receives a set of data. Further, the method receives a traffic key. In addition, the method determines a traffic protection group for the set of data. The method also encrypts the set of data according to the traffic key to generate an encrypted set of data. Finally, the method provides the encrypted set of data through a network to a device.

Abstract: Described herein are embodiments that provide an approach to cryptographic key management for a digital rights management (DRM) architecture that includes multiple levels of key management for minimizing bandwidth usage while maximizing security for the DRM architecture. In one embodiment, there is provided a data structure for cryptographic key management that includes a public/private key pair and three additional layers of symmetric keys for authorizing access to a plurality of contents.

Abstract: An apparatus and method for providing at least one root certificate are disclosed. Specifically, a plurality of root certificates is received and stored. Afterwards, a request is received from a first endpoint device for a desired root certificate, where the desired root certificate is used by the first endpoint device to verify an identity of a second endpoint device. Furthermore, the first endpoint device and the second endpoint device are associated with different certificate hierarchies. The desired root certificate is then sent to at least the first endpoint device.

Abstract: In a client-server system employing protocols such as RTP (real-time protocol), RTCP (real-time control protocol) and RTSP (real-time streaming protocol) for communicating real-time data stream, a method for using the same security parameters to secure by encryption and/or authentication, communication of the real-time data stream.

Abstract: The present invention discloses an apparatus and method for a method for determining proximity of a device (e.g., a client device). In one example, a key management request is acquired from the device. A measurement request is then transmitted to the device. Afterwards, a measurement reply is received from the device. In response, a determination is made as to whether a measurement parameter associated with the transmitting and the receiving exceeds a predetermined threshold. If the predetermined threshold is not exceeded (i.e., the device is proximate to an associated local network), then a reply to the original key management request is transmitted to the device. Notably, the reply to the key management request is required for the device to establish a secure session with a server from which digital content can be acquired.

Abstract: A method for receiving information content from an information distribution system, wherein the information content is divided into a plurality of content portions, the method comprising: subscribing to a multicast group representing at least one content portion; and determining, at the end of a content portion, whether to subscribe to another multicast group.