Abstract: A system is configured to receive a first authentication request from a first device, authenticate the first device, establish a secure connection with the first device based on authenticating the first device, and receive, via the secure connection with the first device, a set of parameters from the first device. The first device is capable of generating an encryption key for a secure message, intended for a second device, based on the set of parameters. The system is also configured to receive a second authentication request from a second device, authenticate the second device and establish a secure connection with the second device based on receiving the second authentication request, and send, via the secure connection with the second device, the set of parameters to the second device. The second user device is capable of generating a decryption key for the secure message based on the set of parameters.

Abstract: An information processing device and method include storing encrypted content, storing a key for decrypting the encrypted content stored, decrypting the encrypted content stored using the key, storing a deletion table storing information indicating whether or not the key stored is to be deleted when a transition from an operating state to one of other states is made, the information corresponding to the other states, and checking the information in the deletion table corresponding to the one of the other states and deleting the key when the information indicates that the key is to be deleted.

Abstract: A system and method of protecting digital media contents, which maintain compatibility with an existing system and block any attempt to illegally use the digital media contents having various formats, and which reduce a system load and maximize a possibility of reusing the digital media contents. The system includes a packager for analyzing a format of contents and encoding at least a portion of a data region located in a payload of the contents, and for generating encoded contents by inserting encoding information including at least one of an encoding key value and contents information into the contents; and a digital rights management (DRM) server for receiving a request for a license and the encoding information from an external device which receives the encoded contents, for confirming the encoding information and then generating a license which is used to decode the encoded contents, and for providing the generated license to the external device.

Abstract: Methods, apparatus and systems for embedding auxiliary information in encrypted host signals are provided. The present invention enables secure application of digital watermarks at any point in the transmission and/or distribution of digital content by enabling the insertion of a plurality of digital watermarks, without the knowledge of the encryption/decryption keys, into a digital host content that has been encrypted with an encryption key. The embedded watermarks persist throughout the content subsequent to the decryption of the content. The disclosed techniques are applicable to content that has been encrypted using a variety of different encryption techniques and algorithms, including stream ciphers, block ciphers, symmetric and asymmetric encryption algorithms. These methods are further adapted to enable the insertion of watermarks into a content that is compressed prior to encryption.

Abstract: Methods and apparatus for providing media content offered by media content subscription service to portable media player devices associated with subscribers of the service are described herein. In various embodiments, particular fulfillment module, request module and media player are provided to fulfillment server(s) of the subscription service, request client devices, and portable media player devices, respectively.

Abstract: The present invention relates to an information processing system, an information processing apparatus and method, and a program in which the purchase of content can be facilitated. When a device to which content data is downloaded and a device for giving an instruction to purchase the content data are different, a purchase form for purchasing the content data is sent to the device for giving an instruction to purchase the content data. The user ID and password are input into the purchase form, and the device to which the content data is downloaded is determined by the user ID. If the device to which the content data is downloaded cannot be specified because the user registers a plurality of devices, a destination determination form for specifying the device to which the content data is downloaded is sent. The content data is then distributed to the device indicated in the destination determination form. The present invention is applicable to a server for executing processing concerning content data.

Abstract: A personal video recorder (PVR) enables delivery of audio-visual content and associated metadata to storage devices. The PVR is configured to access a plurality of services using a plurality of storage modules. Each storage module is dedicated to a single designated content provider. One or more of the storage modules are removably coupled to the PVR. A disconnected storage module can be reconnected to another PVR different from the PVR from which the storage module was disconnected. Where authorization is required to access content stored on the storage module, authentication is performed each time the removable storage module is reconnected to a PVR.

Abstract: A method of storing content, in accordance with one embodiment of the present invention, includes receiving an item of content in a protected format and a key corresponding to the item of content. The item of content in its protected format may be stored on a mass storage device. The key may also be stored in a safeguarded format on the mass storage device.

Abstract: The disclosure relates generally to processing audio and video signals. One claim recites an apparatus comprising: electronic memory for storing a media signal, the media signal comprising degradation introduced through use of a key, in which the key corresponds to detection criteria in the media signal, and in which the degradation comprises human perceptible degradation, the media signal further comprising the key embedded therein; and a processor programmed for: analyzing the media signal to obtain the key; and removing some of the degradation through use of the key, in which said removing utilizes different detection criteria relative to a process that introduced the degradation into the media signal. Of course, other claims and combinations are provided too.

Abstract: A digital security bubble encapsulation is disclosed. A public key and a device identifier of at least one recipient is requested from a first server. A message containing one or more components is encrypted using a symmetric key. The symmetric key is encrypted with a public key received in response to the request. The encrypted message, the encrypted symmetric key, and the device identifier are encapsulated in a digital security bubble encapsulation. The digital security bubble encapsulation is transmitted to a second server.

Abstract: Exemplary systems and methods for managing media content decryption keys in encrypted media content distribution systems and methods are described. An exemplary method includes a user device 1) accessing a set of decryption keys, 2) storing the set of decryption keys in local memory, 3) accessing an encrypted media content program, 4) switching from accessing the encrypted media content program to accessing another encrypted media content program, the another encrypted media content program temporally aligned with the encrypted media content program, 5) using a decryption key included in the set of decryption keys stored in the local memory to decrypt the encrypted media content program before the switching is performed, and 6) using another decryption key included in the set of decryption keys stored in the local memory to decrypt the another encrypted media content program after the switching is performed. Corresponding systems and methods are also disclosed.

Abstract: A flexible product distribution and payment system for computer network based electronic commerce is disclosed. Primary content data is made available to customers through a detachable local storage medium, such as a DVD or CD-ROM disc, or over a network connection. The primary content is capable of being accessed and played back through a computer or game console at the customer site. The primary content distribution may comprise a superset of content that is intended to be used by the customer. The customer is allowed to view and access the encoded primary content, and is charged only for the primary content that is used. Content that is encoded on the medium but that is not used by the customer remains on the medium but is not charged. A content database and customer database maintained at the primary customer site maintain records of products ordered and used by the customer, as well as identification and use patterns associated with the user.

Abstract: The present invention makes use of techniques such as those described by Boneh and Franklin to allow for the realization of a pseudo-asymmetric encryption scheme whereby one public encryption corresponds to a plurality of private decryption keys. This scheme therefore provides a solution to the problem of inefficient use of bandwidth in asymmetrical encryption schemes which inherently require that a plurality of encryptions of data be broadcast to a plurality of receivers. The invention further ensures that the advantage of traceability, typical found in asymmetric encryption schemes, is maintained due to the characteristic that each receiver uses a unique traceable decryption key. The traceability thus achieved by the present invention allows for the revocation of a security module which has been involved in the abusive use of conditional access data, particularly by means of clones of security modules whose security has been compromised.

Abstract: The present intention permits a user to conduct remote transactions without a network while using an untrusted computing device, such as a hand held personal digital assistant or a laptop computer. The computing device is augmented with a smartcard reader, and the user obtains a smartcard and connects it to the device. This design can be used by an untrusted user to perform financial transactions, such as placing bets on the outcome of a probabilistic computation. Protocols are presented for adding (purchasing) or removing (selling) value on the smartcard, again without requiring a network connection. Using the instant protocols, neither the user nor the entity issuing the smartcards can benefit from cheating.

Abstract: A method to manage members of a group of decoders having access to broadcast data, each group member sharing a common broadcast encryption scheme (BES) comprising the steps of, in a stage for a decoder to become a group member, receiving keys pertaining to the position in the group according to the BES, receiving a current group access data comprising a current group access key, and in a stage of accessing broadcast data, using the current group access data to access the broadcast data, and in a stage of renewing the current group access key, sending a first group message comprising at least a next group access key encrypted so that only non-revoked decoders can access it, said group message being further encrypted by the current group access key, updating the current group access key with the next group access key.

Abstract: Methods and apparatus for control of data and content protection mechanisms across a network using a download delivery paradigm. In one embodiment, conditional access (CA), digital rights management (DRM), and trusted domain (TD) security policies are delivered, configured and enforced with respect to consumer premises equipment (CPE) within a cable television network. A trusted domain is established within the user's premises within which content access, distribution, and reproduction can be controlled remotely by the network operator. The content may be distributed to secure or non-secure “output” domains consistent with the security policies enforced by secure CA, DRM, and TD clients running within the trusted domain. Legacy and retail CPE models are also supported.

Abstract: A content import method in a digital rights management (DRM) system imports transport streams received from outside a domain, generates a content file, and regularly inserts information in the form of transport packets necessary for decrypting encrypted content into a payload of the content file. Accordingly, even if usage constraint information (UCI) included in the received content changes, packaging is possible. When a device pertaining to the domain receives half of an imported content file via streaming, transport packets of the received half of the imported content file can be promptly decrypted without a time delay.

Abstract: A system, method, and computer program product for managing limited-use software on a host computer having an operating system is disclosed. A software application can be installed in the operating system as a virtualized application using light weight virtualization technology. Rights usage information for the software application is received, the rights usage information comprising a rule describing permitted use of the software application on the host computer. A determination is made whether to enable the virtualized application based at least in part on the rights usage information. Responsive to the determination, the virtualized application is enabled to be executed on the host computer.

Abstract: Key management in a digital cinema system (10, 100 and 1000) occurs by encrypting a feature key associated with encrypted content with a transmission key exchanged with a decryption module (60, 601, 602, 6001, 6002, 6003 and 6004), that serves to decrypt encrypted content. The encrypted feature key undergoes transmission to the decryption module to enable decryption of the encrypted content. In this way, the decryption module will only have the capability of decrypting content based on that module's own key.

Abstract: A system and method providing for appending of a note or instruction to the contents of an email such that the note or instructions is only appended to emails of selected recipients of a group of recipients, with only the email going to the other recipients of the group of recipients is provided.

Abstract: Embodiments of the systems, devices, and methods described herein generally facilitate the secure transmittal of security parameters. In accordance with at least one embodiment, a representation of first data comprising a password is generated at the first computing device as an audio signal. The audio signal is transmitted from the first computing device to the second computing device. The password is determined from the audio signal at the second computing device. A key exchange is performed between the first computing device and the second computing device wherein a key is derived at each of the first and second computing devices. In at least one embodiment, one or more security parameters (e.g. one or more public keys) are exchanged between the first and second computing devices, and techniques for securing the exchange of security parameters or authenticating exchanged security parameters are generally disclosed herein.

Abstract: Usage rights for a digital work are established prior to creation of the corresponding content. The rights can be associated with the content after the content is created. A content creation, such as a video recorder or a still camera, device can store labels of the rights and can associate usage rights with content in real time as the content is created.

Abstract: A set top box is provided that includes a receiver/tuner for receiving programming content over a broadband communications network, an encrypter/decrypter for encrypting and decrypting the programming content, and a secure memory configured to store at least a first cryptography key to be used by the encrypter/decrypter to encrypt and decrypt the programming content. The set top box also includes a digital storage medium for storing encrypted programming content, a multimedia processor operationally associated with the receiver/tuner, the decrypter, and the digital storage medium, and a user interface operationally associated with the multimedia processor.

Abstract: A method for pairing a first element and a second element, wherein the first element and the second element form a first decoding system among a plurality of receiving decoding systems in a broadcasting network. Each receiving decoding system is adapted to descramble scrambled audiovisual information received over the broadcasting network. A first key unique in the broadcasting network is selected. A second key is determined according to the first key, such that a combination of the first key and the second key enables to decrypt broadcasted encrypted control data that is received to be decrypted by each receiving decoding system, the encrypted control data being identical for each receiving decoding system. The first key and the second key are assigned respectively to the first element and the second element.

Abstract: A system and method for delivering digital media content to a user over a network is disclosed. The illustrative embodiment of the present invention enables multiple types of electronic devices to access the same digital media content for the same end user through the use of a smart card equipped with a license for the digital media content. Depending on the format of the digital media content, devices such as phones, pagers, internet appliances or PDAs can be used to present the digital media content to a user, as can traditional consumer electronic devices such as DVD players and VCRs. The encrypted content may be freely transferred and stored without copyright concerns since the decryption key is generated by the smart card containing the license.

Abstract: Techniques are disclosed for sharing information in a wide variety of contexts. An information sharing system is described that allows both an explicit capture process and an implicit capture process to add information items to a staging area. Further, the information sharing system supports both implicit and explicit consumption of information items that are stored in said staging area. A rules engine is provided to allow users to create and register rules that customize the behavior of the capture processes, the consuming processes, and propagation processes that propagate information from the staging areas to designated destinations. Techniques are also described for achieving exactly-once handling of sequence of items, where the items are maintained in volatile memory. Techniques are also provided for recording DDL operations, and for asynchronously performing operations based on the previously-performed DDL operations.

Abstract: A self-service terminal comprises: a plurality of session initiation devices, each associated with an initiation token, so that a customer can initiate a transaction using one of a plurality of different initiation tokens. The terminal further comprises a plurality of session suppliers, each session supplier being associated with one of the session initiation devices, and each session supplier being operable: (i) to receive from its associated session initiation device, information from an initiation token provided by a customer, and (ii) to create an electronic access token based on the received information. The terminal also comprises a session supplier aggregate operable to receive an electronic access token from one of the session suppliers for each session to be created; and a session component operable (i) to receive the electronic access token from the session supplier aggregate and (ii) to create a session based on the received electronic access token.

Abstract: An access management system for managing network access of an end-user to one or more online content sources of a number of content providers. The system comprises a content proxy unit that stores the concealed addresses of the content sources. The content proxy unit is designed to receive a request for accessing one or more content sources from the end-user. The system further comprises an access management unit that stores an access rights record of the end-user. The access management unit is designed to authorize the request according to the access rights record of the end user. If the request is authorized, the content proxy unit facilitates the accessing using the concealed addresses of the requested content sources.

Abstract: A communication system 100 includes a group of user devices, a first device separate from the group of user devices, a first satellite, a peer-to-peer network 130 in communication with the user devices and the satellite 106 and a content delivery network 120 in communication with the user devices. The content delivery network encrypts the content in response to a first encryption-decryption information and communicates the content to the plurality of user devices through a satellite. At each of the plurality of the group of user devices the content is encrypted in response to a second encryption-decryption information. A first user device communicates a content request to the group of user devices. At least one of the group of user devices communicates the content to the first user device through the peer-to-peer network. The first user device requests the encryption-decryption information from a content delivery network through a terrestrial network.

Abstract: An apparatus, system, and method for image processing are disclosed, each of which obtains a mark from image data, detects additional information in the mark, determines whether the mark is detected in the mark to generate a determination result, and controls processing performed by an image processing apparatus with respect to the image data based on the determination result.

Abstract: The present embodiments provide methods, apparatuses, and systems to distribute content over a network. Some embodiments provide methods to distribute content within a local media network. These methods receive a request for a first content to be transferred to a sink device, request from the source an access criteria for a first content that is protected according to a first digital rights management (DRM), forward the access criteria to the sink device, receive an evaluation of the access criteria from the sink device regarding at least whether the sink device can interpret the first DRM, determine according to the evaluation received from the sink device whether the sink device can utilize the first content that is protected according to the first DRM, and initiate a transfer of the first content from the source device to the sink device when the sink device can utilize the first content.

Abstract: Disclosed is a system and a method for maintaining broadcasting chip information regardless of device replacement in a USIM unlock environment where broadcast information can be automatically modified in response to device replacement.

Abstract: A distributed system for distributing conferencing data such as video, audio, and other conference data. The distributed system includes a conference data dispatch system, multiple conference participant computing systems, and a network distribution path through which conference data may be distributed from the conference data dispatch system to the various conference participant computing systems. The conference data is segmented. Each segment is encoded to be suitable to a particular class of participant computing systems. The encoded segments may be cached in an intermediary computing system to thereby avoid a strict unicast model for distributing conference data.

Abstract: The invention concerns a method for transmitting a flow of digital data and of controlled messages associated with said flow addressed to mobile terminals. The flow comprises successive bursts of data of encrypted contents with control words included in the control messages transmitted in parallel with said flow. The method is characterized in that it consists in inserting a control message in each transmitted burst of contents, said message containing at least one control word designed to decrypt the contents of said burst.

Abstract: A method, system, and computer-readable storage medium containing instructions for controlling access to data stored on a plurality of storage devices associated with a first platform. The method includes authenticating a user to access the first platform, wherein the first platform includes first and second storage devices, chipset encryption hardware, and a memory. Data stored on the storage devices are encrypted, with first data on the first storage device being encrypted by the chipset encryption hardware and second data stored on the second storage device being encrypted by another encryption mechanism. The data are decrypted and the user is allowed to access the first data and the second data.

Abstract: This invention relates to a method for broadcasting digital data to a targeted set of reception terminals in which said data are previously scrambled by a series of control words transmitted in a conditional access control message. This method comprises the following steps: on transmission, particularise said access control message using a reversible function F for which the inverse function F?1 is executable only in terminals in the targeted set, and on reception, redetermine the original access control message in each terminal in the targeted set using said inverse function.

Abstract: A data recording apparatus and a data reproducing apparatus which ensure security of a portable recording medium, such as an optical disk. The apparatus has a security mode and a normal mode as operation modes. In the security mode, a system controller of the apparatus records a security identification signal in an area other than a user data area of the optical disk. At the time of copying of the optical disk, the security identification signal disappears, and a limitation is imposed on reproduction, thereby preventing copying operation. In the security mode, the system controller records the security identification signal in the area other than the user data area of the optical disk, as well as recording user data by means of converting an address through use of a password. At the time of reproduction of data, absence or presence of the security identification signal is ascertained. When the security identification signal is present, the address is inversely converted, thereby reproducing data.

Abstract: When data is encrypted and stored for a long time, encryption key(s) and/or algorithm(s) should be updated so as not to be compromised due to malicious attack. To that end, stored encrypted data is converted in the storage system with new set of cryptographic criteria. During this process, read and write requests can be serviced.

Abstract: A method for controlling a digital television (DTV) includes receiving independent space identification information recorded in a storage area of a compact wireless device and a wired equivalent privacy (WEP) key value of an access point (AP) card, receiving the WEP key value corresponding to the AP card of the DTV from a management server, and comparing the WEP key value received from the compact wireless device with the WEP key value received from the management server. If the WEP key values are identical to each other, receiving first checklist information associated with the use of the independent space from the management server, displaying the received first checklist information, and transmitting second checklist information, in which one or more elements of the displayed first checklist information is marked, to the management server.

Abstract: A method and apparatus for brokering the enablement of the communication of encrypted media programs from a plurality of independent broadcasters to a plurality of receivers is disclosed. The system makes use of a pairing key for each provided service, which is differently encrypted by a pairing server and by the broadcaster providing the service. The encrypted versions of the pairing key are decrypted in a first receiver module using information known to the pairing service but not the broadcaster and in a second receiver module using information known to the broadcaster. The pairing key is used to cryptographically bind the first and second receiver modules.

Abstract: A decryption process chip has a memory in which a first decryption control unit for decrypting a scramble key by using an ECM and an EMM is downloaded from outside and stored. A stream input unit extracts a packet including the ECM based on first information obtained from the first decryption control unit, and the first decryption control unit extracts the ECM from the packet. An STB control unit extracts only data including the EMM based on second information set up from the first decryption control unit, and the first decryption control unit extracts the EMM from the data. The stream input unit indirectly obtains a scramble key decrypted by the first decryption control unit so as to extract the scramble key and transmit it to a descrambler.

Abstract: A method of operating a digital program playback device, including: receiving, via a first communications network, a data stream including an encrypted data portion representative of a program; identifying, from the received data stream, an identifier associated with the program; transmitting the program identifier and a device identifier associated with the digital program playback device to an authorization device via a second communications network; receiving, via the second communications network, a decryption key in response to the transmission; and, decrypting the data stream using the decryption key and generating an output signal for playback of the program.

Abstract: An image processing device, which includes: an original reception unit that receives an original image; a dot image generation unit that generates, on the basis of additive information to be added to the original image, a dot image in which a plurality of dots each formed by one or more pixels are arranged; a state alteration unit that, when any of the dots in the dot image is determined to be not extractable, alters a state of the non-extractable dot on the basis of a relationship between a position on the dot image generated by the dot image generation unit and a corresponding position on the original image; and a composite image generation unit that generates a composite image by superimposing, on the original image, the dot image having the state of the non-extractable dot altered by the state alteration unit.

Abstract: The invention provides a business platform, a business entity management system, and a software module that can be used in conjunction with the software service framework. The invention mimics actual business relationships between business entities, and uses a software service module to configure the business entities into a network that comprises at least three generations of business entities, wherein role dependent associations mimicking real life business relationships are established between the business entities. In addition, information as defined by business objects are configured to permit or deny access and manipulation based on user roles. Accordingly, the invention permits a user role in one business entity to potentially access information of a plurality of other associated business entities through a common business platform, based on the role of the user and the configuration of the business objects.

Abstract: Examples of a system, method, and apparatus for encrypting and recording content are presented. When content is recorded to storage media, the content is encrypted with a content instance key. This content instance key is encrypted with the public key of a first set-top box and a duplicate of the content instance key is encrypted with the public key of other than said first set-top box. A private key corresponding with the public key of the first set-top box may be used to decrypt the content instance key, or a private key corresponding to the public key of other than the first set-top box may be used to decrypt the duplicate of the content instance key so that the encrypted content from the removable storage media may be made available in the clear.

Abstract: A method and apparatus allows owners of electronic signs, such as retailers, real estate owners, other space owners, and content providers, such as advertisers, entertainment producers, event promoters, visual artists, and the general community to participate in an open content network, in which electronic signs are universally uniquely identified and then added to a network in a distributed fashion, after which content is selectively downloaded to the electronic signs. The times at which the content is presented are determined collaboratively by the owners of the electronic signs and the content providers. A mechanism that verifies whether the content is actually presented on the electronic signs is also disclosed.

Abstract: A computerized intellectual property trading exchange is disclosed for facilitating the trading of license contracts relating to intellectual property rights or pools of intellectual property rights. The exchange includes at least one intellectual property license contract relating to intellectual property rights or pools of intellectual property rights and a computer-accessible forum configured to allow a plurality of participants to trade the license contract. The plurality of participants includes at least one seller, which may be the owner, having the license contract and desiring to trade the license contract. The plurality of participants also includes at least one buyer desiring to obtain the license contract. The buyer may be an investor, speculator, market maker, or arbitrageur, who purchases the license contract to achieve appreciation. The buyer also may be a licensee, who purchases the license contract to practice the intellectual property rights.

Abstract: In a data providing server 1101, whether or not specified compressed content data D51 generated by means of a specified compression coding method corresponding to terminal identification information has been stored in a content database 1113 is detected, according to content specifying data D53 transmitted from a portable dedicated terminal 1104. If the specified compressed content data D51 has been stored, the data providing server 1101 reads and transmits this to the portable dedicated terminal 1104. And if the specified compressed content data D51 has not been stored, the data providing server 1101 generates the specified compressed content data D51 by means of the specified compression coding method, and transmits this to the portable dedicated terminal 1104. Thereby, the specified compressed content data D51 generated by means of a specified decoding method can be properly provided to the portable dedicated terminal 1104, and the user can easily view a content based on the content data.

Abstract: Embodiments of the systems, devices, and methods described herein generally facilitate the secure transmittal of security parameters. In accordance with at least one embodiment, a representation of first data comprising a password is generated at the first computing device as an image or audio signal. The image or audio signal is transmitted from the first computing device to the second computing device. The password is determined from the image or audio signal at the second computing device. A key exchange is performed between the first computing device and the second computing device wherein a key is derived at each of the first and second computing devices. In at least one embodiment, one or more security parameters (e.g. one or more public keys) are exchanged between the first and second computing devices, and techniques for securing the exchange of security parameters or authenticating exchanged security parameters are generally disclosed herein.

Abstract: A method of providing a stream of data units with scrambling state identifying data and providing a stream of key messages, synchronized with the stream of data units. The scrambling state identifying data includes an identifier value associated with the first decryption key that associates the data units in a third section. Then separating the first and second sections, with scrambling state identifying data lacking an identifier value associated with the decryption key, and providing in a key message coinciding with first or third sections key information. Thereby enabling an authorized decoder to obtain a value of the first decryption key corresponding with the second value of the first encryption key. Encryption of at least part of the clear data units uses the first encryption key is suspended for each data unit in the sequence included in the third section.