Abstract: Methods and systems for enabling content to be securely and conveniently distributed to authorized users are provided. More particularly, content is maintained in encrypted form on sending and receiving devices, and during transport. In addition, policies related to the use of, access to, and distribution of content can be enforced. Features are also provided for controlling the release of information related to users. The distribution and control of contents can be performed in association with a client application that presents content and that manages keys.

Abstract: A method and system of binding content at first access is disclosed. A non-volatile storage device may provide a content access script and a content binding script in order to access protected content. An accessing application may attempt to access the protected content by executing a content access script. The accessing application must have permission to access and execute the content access script. If the accessing application cannot access or execute the content access script, the accessing application may access and execute the content binding script. The content binding script contains instructions that enable the accessing application to successfully execute the content access script. The content binding script, when executed, may disable itself from being executed again by moving critical information associated with the access to protected data. Thus, the content binding script may be executed once to enable an accessing application to successfully execute the content access script.

Abstract: An information processing apparatus (100) is provided with a memory unit (130) for storing digital broadcast content for which a number of copies that can be made is set, a writing unit (160, 162) for writing the content on external recording medium, an IC medium reader/writer (150) for reading an IC medium (300) and recording the number of copies that can be made of the content on the IC medium (300) in association with an identifier of the content, and a control unit (170) for determining whether an identifier of the content is recorded on the IC medium (300) when the content is copied to the external recording medium and, when it is determined that the identifier is recorded, controlling the writing unit (160, 162) to write the content on external recording medium (210, 220) as well as controlling the IC medium reader/writer (150) to update the number of copies that can be made of the content.

Abstract: A system and method for using content on multiple devices includes a head end associating a first user device and a second user device with a user account and authorizing the first user device and the second user device to receive content. The first user device forms a selection signal corresponding to a first content. The head end communicates the first content to the first user device corresponding to the selection signal. The first user device displays the first content on a first display associated therewith. The second user device receives the first content and displays the first content on a second display associated with the second user device.

Abstract: Whether a combination method defined in an output rule satisfies a combination condition of each content specified in a play list is judged in order of priority defined in a priority list. Based on the judgment result, the output rule is edited in such a manner that the combination condition of each content specified in the play list is satisfied. The resources of the combination target contents specified in the play list are combined in accordance with the combination method of the edited output rule.

Abstract: A content server device includes a request section for requesting a key server to transmit key data for decrypting encrypted content data to a client side in response to the content distribution request from the client side and a control unit which prohibits the transmission of the encrypted content data in response to the content distribution request when the reception number of notification received from the client side and indicating the reception of the key data from the key server is not less than the transmission number of key data to the client side by the key server and which transmits the encrypted content data in response to the content distribution request when the number of reception is not more than the number of transmission.

Abstract: Apparatus and methods for protected content access, browsing and transfer over a network. In one embodiment, the network comprises a premises (e.g., residential) LAN, and the apparatus comprises a server and renderer consumer premise equipment (CPE). The renderer CPE scans the network to search for a server CPE that implement a compatible security framework. The renderer authenticates itself with the server, and the server allows content browsing and selection access only to an authorized and authenticated renderer. A negotiation and exchange protocol comprises messages exchanged between the renderer and the server that include one or more of device identification, encryption key exchange, digital certificates and information regarding security package used by each CPE.

Abstract: A computing system selects a portion of data of an unknown work and detects each event in the portion of data of the unknown work. An event is a perceptual occurrence in a work successively positioned in time. The system determines an event metric between each successive event in the portion of data in the unknown work and generates a list of event metrics between the events for the unknown work. The system compares the list of event metrics for the unknown work to a list of event metrics for a known work and determines the unknown work is a copy of the known work responsive to a match between the list of event metrics of the unknown work and the list of event metrics for the known work.

Abstract: A system and method providing sharable content item links with link sharer specified use restrictions. The method includes: receiving, from a device used by a link sharer, a request to share a server-stored content item as a sharable link; causing a user interface to be presented at the device that allows the link sharer to specify one or more restrictions on how the sharable link is used to access to the content item; receiving, through the user interface presented at the device, a specification of at least one of the restrictions; receiving, from a device used by a link submitter, a request to access the content item at the sharable link; determining whether the at least one restriction prevents the link submitter from the requested access; and granting the requested access only after determining that the at least one restriction does not prevent the link submitter from the requested access.

Abstract: In one embodiment, a mechanism for separating content from noisy context in template-based documents for search indexing is disclosed. In one embodiment, a method includes selecting a plurality of documents for index comparison, identifying one or more identical elements found in each of the plurality of documents, and removing the one or more identical elements from consideration in an indexing process of the plurality of documents.

Abstract: When a control unit of a content receiver causes to write out content to an exchangeable medium, causes to also write out a viewing license of the content to the exchangeable medium, and further causes an invalidating/validating unit to invalidate a viewing license of related content belonging to a same predetermined content group as the content if a viewing time limit of the content is not determined. When a content reproducer reproduces the content recorded in the exchangeable medium, determines the viewing time limit of the content and records it to the exchangeable medium. When the exchangeable medium which is reproduced by the content reproducer is installed, the control unit causes to set a viewing time limit of the related content to the same time limit as the viewing time limit of the content on the exchangeable medium and causes to validate the viewing license of the related content.

Abstract: Methods and apparatus for processing title data watermarked with a code. At least a portion of the title data may be watermarked at a plurality of locations within the title data with customer information data, so that the title data provided to a customer includes the watermark information. To obtain the code from the watermarked title data, watermarking information associated with the watermarked title data is first received. The watermarking information identifies a plurality of locations and a number to frequency modulation relationship at each of the locations. A different modulation scheme may be used at each location. The watermarked title data is demodulated at each of the plurality of placement locations based on the number to frequency modulation relationship. The code is then generated from the demodulated watermarked title data. A verification indication is output based in part on the generated code.

Abstract: A method that includes receiving a first request for video content from a user of a user device; retrieving an identifier for the user device using an application programming interface; sending a second request to receive the video content that includes the identifier; receiving an instruction to provide payment to rent or purchase the video content; sending the payment in response to the instruction; receiving the video content and a token, where the video content is encrypted based on a key and where the token indicates that the payment was processed; sending a third request to obtain a license associated with the video content that includes the token and the identifier; receiving the license, which includes the key and terms under which the video content is to be processed; decrypting the video content, using the key, when the decrypting is performed in a manner permitted by the terms; and playing the decrypted video content.

Abstract: A method and an apparatus for moving a license between SRMs. A DRM agent obtains the license from a first SRM, and sets the license to a forwarding state locally; the DRM agent deducts one permission of moving the license; and the DRM agent sends the license to a second SRM.

Abstract: A secure LSI device 1 includes an encryption section 2 for encrypting a program, and an external I/F 50 for inputting/outputting a program or data from/to an external memory 100. In the encryption section 2, the operation of a private key arithmetic processing section 20 is prohibited with respect to a sequence whose execution is determined by a key-generation/update sequencer 30 to be impermissible. In the external I/F 50, a program processing section 51 and a data processing section 55 are structured independently from each other.

Abstract: A computer program product for secure key management is provided. The computer program product includes a tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method. The method includes creating a token and populating the token with key material, and binding key control information to the key material. The key control information includes information relating to management of the key material populating one or more key management fields that define attributes that limit distribution of the key material.

Abstract: Techniques for controlling the use of data stored on a media or integrated circuit sample are provided. A sample identifier is created at the point of sample use. The type of sample could range from storage media, such as a Digital Video Disc, or DVD, on which, for example, data representing a motion picture is recorded, to an integrated circuit in which computer code is stored. The sample identifier is stored at a location that is different from where the data is to be employed, and compared with other sample identifiers. The use of the data is controlled based on the results of the comparison.

Abstract: Methods, devices, and systems for managing sensitive data are provided. The management tool may be provided on a user input device, as opposed to being provided in memory or in a peripheral that can be read from a program running on a computing platform. The management tool may be maintained in a read/write isolation mode where no data is transmitted outside of the management tool unless the user input device is disengaged from the computing platform, at which point data may be transmitted from the management tool for ultimate delivery to the computing platform.

Abstract: A method performed in a network element coupled between a subscriber end station and an AAA server for avoiding AAA processing by at least temporarily suppressing AAA access-request messages for a rejected subscriber end station. The network element receives subscriber session-request messages from the subscriber end station. Subscriber session-request messages include information for verifying an identity that the network element transmits to the AAA server as AAA access-request messages. The network element receives AAA access-response messages corresponding to the AAA access-request messages. Responsive to an AAA access-response message, the network element determines that additional AAA access-request messages should be, at least temporarily, suppressed with regards to the subscriber end station. Responsive to determining, the network element suppresses any additional AAA access-request messages from being transmitted to the AAA server.

Abstract: An authentication system and method is presented for authenticating a first party to a second party, where an operation is performed on condition that the authentication succeeds. The authentication method verifies whether the first party is authenticated. If the first party is not authenticated, then it is determined if the first party qualifies for a sub-authorization. The sub-authorization depends on a value of a grace-counter associated with a number of times that first parties have been qualified for the sub-authorization. If the first party qualifies for the sub-authorization, the operation is performed and the grace counter is decremented. If the first party is authenticated, then the grace counter is set to a predetermined number.

Abstract: A system and method for secure transport of data, the method comprising: sharing of key information with a key distributor, wherein the key information is for enabling decryption of first and second encrypted data, the key distributor being for making one or more decryption keys available to an authorized user; creating a container object, the container object comprising: first encrypted data having a first encryption based on at least a part of said key information; second encrypted data having a second encryption based on at least a part of said key information, wherein the first encryption is different to the second encryption; and metadata relating to the first encrypted data and the second encrypted data; and sending the container object to a data store or otherwise making the container object available, to allow user access to said data container object.

Abstract: A system and method for modifying material related to computer software. The system receives an original disclosure for a software system. A masquerading algorithm is applied to the original disclosure to generate a new disclosure. The subject matter of the new disclosure is different from the original disclosure but has the same functionality. The system also receives original source code for the software system and applies a camouflaging algorithm to the original source code to generate modified source code and conversion data for converting between the modified source code and the original source code.

Abstract: Disclosed herein are systems, methods, and non-transitory computer-readable storage media for making policy decisions relating to when to sync and when to default to cloud storage and for addressing the need for solutions relating to how to share media items between overlapping user accounts

Abstract: A computerized method for providing a computer code an access to a restricted resource of a computer program, comprising modifying an at least one duplicate of an at least one declaration file of the computer program by removing a restriction definition of an at least one resource of the computer program that is referred to by the computer code, thereby generating an at least one modified declaration file, and building a computer application comprising the computer code and also the computer program as being dependent on the at least one modified declaration file, thereby providing access to the at least one resource originally defined as restricted, and an apparatus for performing the same.

Abstract: Apparatus, system, and media for utilizing content. An exemplary system comprises a first computing device and a second computing device, wherein the first computing device transmits a request for access to content to the second computing device, receives the content from the second computing device, and grants at least one permitted utilization of the content, and wherein the second computing device receives the request for access to content from the first computing device, determines whether the first second computing device is permitted to receive the content, grants access to the content based at least in part on the first computing device being permitted to receive the content, and transmits the content to the first computing device based at least in part on the first computing device being permitted to receive the content.

Abstract: When a viewer views content, it is reproduced by a reproduction procedure depending on a dynamic condition set in the content. Here, a content object data input unit obtains an externally-input content object. The content object is stored in a content object data retention unit, if necessary. The content object includes a reproduction rule and a content data. A reproduction rule evaluation and execution unit obtains the reproduction rule in the content object and performs processing in accordance with the reproduction rule. The reproduction unit reproduces a reproducible data specified by the reproduction rule evaluation and execution unit. An identifier management unit retains an identifier of a content object reproduction device and provides the identifier upon request. It is thus possible to reproduce in accordance with the reproduction rule set in the content object data and to control the reproduction procedure depending on the dynamic condition.

Abstract: Disclosed are systems and methods for protecting secret device keys, such as High-bandwidth Digital Content Protection (HDCP) device keys. Instead of storing secret device keys in the plain, a security algorithm and one or more protection keys are stored on the device. The security algorithm is applied to the secret device keys and the one or more protection keys to produce encrypted secret device keys. The encrypted secret device keys are then stored either on chip or off-chip.

Abstract: Various embodiments are disclosed relating to performing a trusted copy and paste operations between a source application and a target application. For example, a trust system may receive a paste request for pasting copied source content, and may compare a source trust level associated with the source content to a target trust level associated with a target application. In this way, for example, harmful or disruptive code may be prevented from being pasted into the target application.

Abstract: The present invention provides a method, system and program product for modifying content usage conditions during broadcast content distribution. Specifically, the present invention allows protected (e.g., encrypted, secured, etc.) content to be received along with content usage conditions, an encrypted combination of the content usage conditions and a title key (e.g., a MAC), and a key management block. Using the key management block, a key encrypting key can be determined for decrypting the combination. Once the combination is decrypted, the content usage conditions can be modified (e.g., edited, added to, etc.).

Abstract: The invention provides a method of recovering from de-synchronization attacks includes registering original and altered digital content using nonlinear transformations to iteratively attempt to provide better-approximated registration. Approximation occurs at more than one level of granularity, by selecting among a greater number of possible transformation functions at each step. Transformations and comparisons might be conducted directly on pixel values, on coefficients for a set of basis wavelets, or on some transformation of the original and altered digital content. A human operator might assist this process, such as by suggesting transformations or providing evaluation of the degree of registration. Upon resynchronization, embedded identifying information in the original digital content is recovered.

Abstract: A restrictive presentation system can receive an electronic message configured for offline consumption expressed as user-specified delivery conditions. The electronic message can be securely conveyed to a computing device in an online state using a communications network. A client application of the restrictive presentation system can be installed upon the computing device and can receive the electronic message. The client application can detect a change of the computing device from the online state to the offline state. In response to user-acceptance, the electronic message can be presented upon the computing device while in the offline state. Upon user-termination of the presentation, the electronic message can be automatically deleted from a storage location of the computing device. When the computing device returns to the online state, the client application can notify the restrictive presentation system of the offline consumption.

Abstract: One embodiment of the present invention provides a system that facilitates issuing rights in a digital rights management system. The system operates by sending a request to perform an operation on an item of content from a client to a rights-management server, wherein the request includes a usage parameter which specifies constraints involved in performing the operation. Next, the system receives a response from the rights-management server, wherein the response indicates whether or not the client has rights to perform the operation in accordance with the constraints specified by the usage parameter. Note that the response may also include a hint that facilitates generating subsequent requests to perform the operation. Finally, if the client has rights to perform the operation, the system performs the operation on the item of content.

Abstract: An optical article for playback in a player includes a first file comprising a first control logic; and a second file comprising a second control logic. The first file is configured to direct the player to play a first content data stored on the optical article, when the first control logic is read by the player. The player is directed to read the second file if the player cannot read the first file. The second file is configured to direct the player to play a second content data stored on the article when the second control logic is read by the player. The optical article includes a mark containing an optical state change material disposed on at least a portion of the first file, wherein the mark is in one of a first optical state or a second optical state, and wherein the first control logic can be read only when the mark is in the second optical state.

Abstract: A server includes a limitation database, a monitor module, and a notification module. The limitations database is configured to store control limits for a user device. The monitor module is in communication with the limitations database. The monitor module is configured to monitor usage of the user device and to determine that one of the control limits for the user device has been exceeded. The notification module is in communication with the monitor module. The notification module is configured to notify a master device that the one of the control limits for the user device has been exceeded, to receive a request to disable the user device, and to disable the user device in response to the request.

Abstract: An image forming apparatus includes a program storing unit, a function introducing unit to obtain a program licensed to an individual user and license information about the program from an external source and to store the program in the program storing unit, a user information storing unit to store user information that includes the license information about the program that is stored by the function introducing unit, the license information being associated with a user ID of the individual user in the user information, a removal timing receiving unit to receive a setting of removal timing at which the program stored by the function introducing unit is removed from the program storing unit, and a removal unit to remove the program stored by the function introducing unit from the program storing unit upon arrival of the removal timing received by the removal timing receiving unit.

Abstract: The digital data file management method reads a header of the digital data file stored on an external medium. Based on the read header, the digital data file is selectively uploaded and/or managed.

Abstract: An image processing apparatus, comprising: an input portion that inputs image data of a plurality of pages of document; a password detector that detects a password given to each of the pages; a password judger that judges from a detecting result drew by the password detector about each of the pages, whether or not a shared password issued for each page in common is detected in addition to an individual password uniquely issued for each page; an entry requester that requests entry of a shared password if it is judged by the password detector that a shared password is detected, and requests entry of an individual password about each of the pages if it is judged by the password detector that a shared password is not detected; and an output permitting portion that permits image data of all the pages each having a shared password, which is the image data inputted by the input portion, if the appropriate shared password is entered in response to the request for entry of a shared password, and permits image data of

Abstract: In a content transmitting method in a content transmitting apparatus, wherein the content transmitting apparatus adds copy control information for indicating to execute a recoding control with either one of “copy can be made only one (1) generation” or “number of times of copying is limited”, on number-limited copy target content, when distributing the number-limited copy target content, which can be copied within a region of limited number of pieces.

Abstract: Embodiments are described herein for managing licenses of media files on playback devices in a media system. In some embodiments, each media file is purchased based on a number of licenses, each license granting permission to store the media file on a single playback device. Each media file may have an associated number of one or more licenses that specifies the maximum number of playback devices on which the media file may be stored at the same time (concurrently). The media system may comprise a home central licensing (HCL) device, a primary storage device, and playback devices coupled via a network. The primary storage device may be used to initially store newly purchased media files. The HCL device may allow or prohibit distribution of the media files on the primary storage device to playback devices by using a license manager data structure storing licensing information for each media file.

Abstract: Disclosed herein is an improved (digital) supply chain (ISC) product. The disclosure covers a simple explanation of the improved supply chain as a service business model, a review of key digital cinema (D-Cinema) topics, a description of the Digital Cinema supply chain, and finally, a description of the improved supply chain product and process.

Abstract: An image processing apparatus comprising: an input portion that inputs image data of a plurality of pages of document; a password detector that detects a password given to each of the pages; a password judger that judges from the detecting results drew by the password detector whether or not different passwords are detected from each of the pages; a correlation judger that judges about each of the pages if the password judger judges that different passwords are detected from each of the pages, whether or not the passwords are correlated to each other; and an output permitting portion that permits the image data of all the pages, which are the image data inputted by the input portion, to be outputted without requesting entry of all passwords, if it is judged about each of the pages that the passwords are correlated to each other, on the other hand, requests entry of a password about each of the pages if it is judged about at least one of the pages that the passwords are not correlated to each other, then permi

Abstract: An apparatus for enforcing a media stream delivery restriction uses a stream control service (SCS). The SCS is implemented in a distributed network, such as a CDN, in which a given media stream is delivered to authorized end users from multiple delivery servers, but where an authorized end user is associated with a single log-in identifier that is not intended to be shared with other end users. According to the method, an enforcement server of the SCS identifies first and second copies of the given media stream associated with the single log-in identifier being delivered from multiple delivery servers. It then issues message to terminate delivery of the given media stream from at least one of the multiple delivery servers.

Abstract: Arbitrary numerical distributions are presented for use in devices having limited processing and storage capabilities by having the device accept strings of arbitrarily distributed numbers from a source outside of the device. In one embodiment, a master controller creates a table of values which follow the desired minimum, maximum, mean, and standard deviation, etc. of the particular desired statistical distribution required. The created table is then communicated to the limited capacity device and can be used whenever a distribution of random values is required. The master controller could have one of several slave devices associated with it in the system. In another embodiment, where the storage capability of the device is large enough to store a table of values with sufficient different entries to create a distribution of satisfactory “randomness” for the particular application, a random number generator within the device is used to select the order of presentation of the table of values.

Abstract: This invention relates to provide a communication network system, a gateway, and a data communication method, in which the gateway has an advanced functionality. A person who issues an access request can retrieve a desired access destination easily by the following configuration: functions of routing information providing and authentication processing are added to a gateway that performs protocol conversion between two different communication networks; when an access request is issued from a public communication network such as Internet to a terminal in a local (private) communication network connected to the gateway, a request terminal is authenticated to enable prevention of unauthorized data writing and reading; and an access request user who succeeded in the authentication is provided with an active terminal list comprising accessible terminal information, or with a user condition table.

Abstract: The management apparatus 105a manages copying of information from an original recording medium 101a to a copy recording medium 102a. The management apparatus 105a comprises: a transmission/reception unit 701a configured to receive an original-medium identifier from the copying apparatus 104a and to transmit permission information to the copying apparatus 104a, the original-medium identifier identifying the original recording medium, and the permission information indicating permission for the copying of the information; and a control unit 708a configured to determine whether to permit the copying of the information based on the received original-medium identifier and a registered original-medium identifier that identifies a registered original recording medium, and to allow the transmission/reception unit 701a to transmit the permission information when determining to permit the copying.

Abstract: A secure document printing system is provided. A policy server is used to define access rules for a document, and select individual users and/or groups that will have access to the document. The policy server stores the access rules along with a document decryption key. The policy server's name and address are packed in the document, and then encrypted and sent to a print server which stores it for later access. A recipient is notified that the document resides on a particular print server. The print server retrieves the specified document, contacts the policy server named in the document, and requests the document decryption key and access rules for the user, print server, and document from the policy server which replies with the related decryption key and access rules. The print server decrypts the document and prints the document based on the access rules.

Abstract: A storage medium includes an ID registration area for storing therein a main body ID which is an ID unique to an information processing apparatus. The information processing apparatus has the main body ID stored therein. The information processing apparatus includes copying means for, when the storage medium is attached thereto, copying a program stored in the storage medium thereinto in the case where the main body ID has not yet been registered. When the copy is made, the main body ID is stored into the ID registration area of the storage medium. The information processing apparatus also includes execution program selecting means for selecting, from the copied program and from the program stored in the storage medium, a program to be executed.

Abstract: An application program or an extended application program is installed that extends the functionality of this application program. If the application program is installed, a license file used in this application program is stored in a storage unit. If the extended application is installed, then control is executed so as to install the extended application using the license file stored in the storage unit and used in installing the application program corresponding to the extended application program.

Abstract: There is provided a method and system for allocating an entitlement to digital media content. In one implementation, the system includes a media server accessible over a communications network and configured to utilize a processor to issue the entitlement including a transferable authorization to access the digital media content to a first user, and to store an entitlement record identified with the first user and authorizing access to the digital media content by the first user in a memory of the media server. The media server is further configured to receive a communication including a data corresponding to the transferable authorization to access the digital media content from a second user and to update the entitlement record to authorize access to the digital media content by the second user.

Abstract: A method for selectively controlling access to electronic media disposed on a media storage device according to one embodiment is described. The method comprises creating a first list comprising a plurality of process identification values. Each of the plurality of process identification values of the first list is associated with a software application that is accessing the media disposed upon the media storage device. The method further includes creating a second list comprising a second plurality of process identification values. Each of the second plurality of process identification values is associated with a software application that is storing data. The method further includes determining that a particular software application is creating an unauthorized copy of the media disposed upon the media storage device. The method further includes preventing the particular software application from storing a usable copy of said electronic media.