Classifications

• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
  • G06Q30/00—Commerce
  • G06Q30/06—Buying, selling or leasing transactions

Definitions

• the present system and method relates to digital rights management. Description of the Related Technology
• DRM digital rights management
• One common problem is that conventional approaches fail to adequately control consumer access to information. Consumers may find ways to get around the owner's control. For example, one owner may send the consumer a password to access the information. Once the consumer accesses the information, the consumer may make copies of the information and pass it along to others.
• Another common problem is that conventional approaches fail to provide a digital rights management system that works for various types of information.
• one digital rights management system may work for music files, but may not be appropriate for literary works.
• the present invention provides a system and associated methods for granting access to a data object.
• the present invention relates to a system and method for providing a license management system wherein customers utilize computers to connect to a license management system via a communication medium.
• Customers interact with the license management system via a communication medium to obtain copies of various pieces of content wherein a content cell containing the requested piece of content is created and sent to the customer.
• the customers interact with the license management system via a communication medium to obtain a license for accessing the content wherein a license cell containing the requested license is created and sent to the customer.
• the customer Once the customer has both the content cell and a related license cell, the customer is allowed to access the piece of content as prescribed by the terms of the content cell and the license cell.
• the license management system provides complete control over a customer's access to information.
• the license management system can embed the license rights that are associated with the customer and the access privileges that are related to the content within the content and/or license.
• customers receive access to pieces of content after the license requirements have been satisfied.
• license rights permit the owner to regulate various types of access to a piece of content. For example, a customer may be able to view a piece of content, but may be restricted from printing a copy of the piece of content.
• a content cell may be created for a wide variety of content and a license is created that corresponds to the content cell, thus allowing licenses to be created for any content cell.
• a customer may obtain access to various types of content such as sound files, video files, executable files, text files, and so forth.
• An additional benefit of this embodiment is that customers can receive a piece of content and access the content without much delay because the license management system is available for immediate access via the communication medium.
• the license management system ensures that the user receives timely responses to its requests.
• Figure 1 illustrates a high level block diagram of one embodiment of the present invention and illustrates the interaction between the license management system and the user computer.
• Figure 2 illustrates a high level block diagram of one embodiment of the present invention showing the flow of information among the content manager, the offer manager, and the user computer.
• Figure 3 illustrates a block diagram of one embodiment of the user computer of Figure 2.
• Figure 4 illustrates a block diagram of one embodiment of the content manager of Figure 2.
• Figure 5 illustrates a block diagram of one embodiment of the offer manager of Figure 2.
• Figure 6a illustrates a block diagram of one embodiment of a content cell.
• Figure 6b illustrates a block diagram of another embodiment of a content cell.
• Figure 7a illustrates a block diagram of one embodiment of a license cell.
• Figure 7b illustrates a block diagram of another embodiment of a license cell.
• Figure 8 illustrates a flowchart of one embodiment of providing a user with access to content.
• Figure 9 illustrates a flowchart of one embodiment of sending content.
• Figure 10 illustrates a flowchart of one embodiment of requesting a license.
• Figure 11 illustrates a flowchart of one embodiment of sending a license.
• Figure 12 illustrates a flowchart of one embodiment of checking for content and a license.
• Figure 13 illustrates a flowchart of one embodiment of creating a content cell.
• Figure 14 illustrates a flowchart of one embodiment of creating a license cell.
• FIG. 1 illustrates one embodiment in which customers 110 utilize user computers 115 to connect to a license management system 120 via a communication medium 130.
• the license management system 120 comprises two primary components, an offer manager 122 and a content manager 124.
• Customers 110 interact with the content manager 124 via the communication medium 130 to obtain copies of various pieces of content.
• Pieces of content may include sound files, video files, text documents, e-mail, database records, HyperText Markup Language (HTML) files, Extensible Markup Language (XML) files, Electronic Data interchange (EDI) files, Message Oriented Middleware (MOM) files, executable scripts, and so forth.
• HTML HyperText Markup Language
• XML Extensible Markup Language
• EDI Electronic Data interchange
• MOM Message Oriented Middleware
• a user computer 115 communicates with the offer manager 122 and the content manager 124, via a communication medium 130.
• the offer manager 122 and the content manager communicates with the offer manager 122 and the content manager 124, via a communication medium 130.
• Figure 2 also illustrates flow of information when a customer 110 ( Figure 1) wants to access a piece of content.
• the user computer 115 requests a piece of content and the request is sent to the content manager 124.
• the content manager 124 sends a content cell 210 containing the requested content to the user computer 115.
• event C the user computer 115 requests a license and the request is sent to the offer manager 122.
• event D the offer manager 122 sends a license cell 220 containing the requested license to the user computer 115.
• the user computer 115 verifies that it has both the content cell 210 and a corresponding license cell 220, and the user computer 115 allows access to the content.
• the user computer 115 can receive a piece of content and access the content without much delay because ' the license management system 120 is available for immediate access via the communication medium 130.
• the license management system 120 ensures that the user receives timely responses to its requests.
• the license management system 120 controls the user computer's 115 use of the content via the license.
• the license management system 120 can embed the license rights that are associated with the user computer 115 and the access privileges that are related to the content within the content cell 210 and/or within the license cell 220.
• the exemplary system includes a communication medium 130, a user computer 1 15, and a license management system 120.
• the presently preferred communication medium 130 includes the Internet which is a global network of computers.
• the structure of the Internet which is well known to those of ordinary skill in the art, includes a network backbone with networks branching from the backbone. These branches, in turn, have networks branching from them, and so on. Routers move information packets between network levels, and then from network to network, until the packet reaches the neighborhood of its destination. From the destination, the destination network's host directs the information packet to the appropriate terminal, or node.
• the Internet Complete Reference by Harley Hahn and Rick Stout, published by McGraw-Hill, 1994.
• the Internet routing hubs comprise domain name system (DNS) servers, as is well known in the art.
• DNS is a Transfer Control Protocol/Internet protocol (TCP/IP) service that is called upon to translate domain names to and from Internet Protocol (IP) addresses.
• TCP/IP Transfer Control Protocol/Internet protocol
• IP Internet Protocol
• the communication medium 130 may include interactive television networks, telephone networks, wireless data transmission systems, two-way cable systems, customized computer networks, interactive kiosk networks, automatic teller machine networks, and the like.
• the World Wide Web contains different computers which store documents capable of displaying graphical and textual information.
• the computers which provide information on the World Wide Web are typically called "websites."
• a website is defined by an Internet address which has an associated electronic page.
• the electronic page can be identified by a Uniform Research Locator (URL).
• URL Uniform Research Locator
• an electronic page is a document which organizes the presentation of text, graphical images, audio, video, and so forth.
• the User Computer 115 shown in Figure 3, is a device which allows a user to interact with the communication medium 130 ( Figure 1).
• the user computer 115 is a conventional general purpose computer using one or more microprocessors, such as, for example, a Pentium processor, a Pentium II processor, a Pentium Pro processor, an xx86 processor, an 8051 processor, a MIPS processor, a Power PC processor, or an Alpha processor.
• the user computer 115 runs an appropriate operating system, such as, for example, Microsoft ® Windows ® 3.X, Microsoft ® Windows 98, Microsoft ® Windows ® NT, Microsoft ® Windows ® CE, Palm Pilot OS, Apple ® MacOS ® , Disk Operating System (DOS), UNIX, Linux ® , or IBM ® OS/2 ® operating systems.
• the user computer 115 is equipped with a conventional modem or other network connectivity such as, for example, Ethernet (IEEE 802.3), Token Ring (IEEE 802.5), Fiber Distributed Datalink Interface (FDDI), or Asynchronous Transfer Mode (ATM).
• the operating system includes a TCP/IP stack which handles all incoming and outgoing message traffic passed over the communication medium 130.
• the user computer 115 may, for example, be a computer workstation, a local area network of individual computers, an interactive television, an interactive kiosk, a personal digital assistant, an interactive wireless communications device, a handheld computer, a telephone, a router, a satellite, a smart card, an embedded computing device, or the like which can interact with the communication medium 130. While in such systems, the operating systems will differ, they will continue to provide the appropriate communications protocols needed to establish communication links with the communication medium 130.
• the exemplary user computer 115 includes a browser module 310, a user manager 320, as well as a database collection 330.
• Browser Module 310 includes a browser module 310, a user manager 320, as well as a database collection 330.
• the user computer 115 utilizes several operational modules including a user browser module 310.
• the user browser module 310 (hereinafter referred to as the user's browser 310) is a software program which allows a consumer to access different content providers through the communication medium 130 ( Figure 1).
• the user's browser 310 is the Netscape ® Navigator developed by Netscape, Inc. or the Microsoft ® Internet Explorer developed by Microsoft Corporation.
• access software could be, for example, other types of Internet browsers, custom network browsers, two-way communications software, cable modem software, point-to-point software, and the like. 2.
• the user computer 115 includes a user manager 320.
• the user manager 320 tracks and manages all content and licenses received by the user computer 115.
• the user manager 320 may be loaded onto the user computer 115 through a web-based download process.
• the user's browser 310 may ask the user if the user would like to download the user manager 320. If the user responds yes, then the download process checks to see if the user manager 320 supports the user's browser 310. If so, then the user's browser 310 automatically downloads the user manager 320 onto the user's computer. It is recognized that in other embodiments, the user manager download process could be performed without any user interaction or the user manager 320 could be pre-installed in the user computer 115.
• the user computer 1 15 includes a database collection 330 shown in Figure 3.
• the exemplary database collection 330 includes several databases such as a license database 332, a content database 334, and an encryption key database 336, which may contain one or more cryptographic keys.
• the license database 332 contains information about license cells 220 that have been received by the user computer 115. The information may include a copy of the license cells 220 as they are received, or extracted information such as the license rules, the license cell header information, and so forth.
• the content database 334 contains information about content cells 210 that have been received by the user computer 115.
• the information may include a copy of the content cells 210 as they are received, or extracted information such as the encrypted content, the content cell header information, and so forth.
• the encryption key database 336 includes the keys received via the license cell 220 that the user manager
• the database collection 330 may use to decrypt the encrypted content. While one embodiment uses symmetric key encryption, it is recognized that in other embodiments, other methods of encryption may be used separate from or in conjunction with symmetric encryption.
• the database collection 330 is implemented using a flat file database structure. It is recognized that in other embodiments, the database collection 330 could be implemented using different databases such as the relational database Microsoft® SQL Server allowing access to the data via the Structure Query Language
• database collection 330 depicted in Figure 3 is comprised of several separate databases, it is recognized that in other embodiments, the database collection 330 may contain other databases or some of the databases could be combined. In addition, the database collection 330 may be implemented as a single database with separate tables or as other data structures that are well know in the art such as linked lists, binary trees, and so forth.
• the license management system 120 ( Figure 1) manages the creation and issuance of content and licenses. It is recognized that in other embodiments, the license management system 120 may primarily manage the issuance of content cells 210 and license cells 220; and other modules could create the license cells 220 and/or the content cells 210. As previously discussed, the license management system 120 comprises two primary components, the content manager 124 and the offer manager 122. It is recognized that in other embodiments, however, there could be multiple content managers 124 and/or multiple offer managers 122. 1. The Content Manager
• Figure 4 illustrates one embodiment of a content manager 124.
• the exemplary content manager 124 includes web server software 410, a content manager component 420, as well as a database collection 430.
• a. Web Server Software In one embodiment, the content manager 124 includes web server software 410 as shown in Figure 4.
• the web server software 410 may be, for example, Netscape's Internet Server software, Microsoft's Internet Server Software (ISS), or the like.
• Such web server software 410 is configured to process messages from the user computer 115 and the offer manager 122 as illustrated in Figure 2.
• b. Content Manager Component In one embodiment, the content manager 124 includes a content manager component 420 that manages the creation and issuance of content cells 210.
• the content manager component 420 illustrated in Figure 4 comprises two processes, the user manager download process 422 and the content cell creation process 424.
• the content manager component 420 may also include other processes not shown such as managing user registration, tracking the inventory of the content cells, as well as providing a search engine.
• the user manager download process 422 downloads a copy of the user manager 320 onto the user computer
• the content cell creation process 424 may be invoked when the user computer 115 requests a piece of content, and the process 424 creates a content cell 210 with the requested content. While in this embodiment the content manager 124 includes a contents creation process 424, it is recognized that in other embodiments, other modules may create the content cell 210, and the content manager 124 may primarily manage the issuance of the content cell 210 by locating the content cell 210 rather than creating the content cell 210.
• the content manager 124 includes a database collection 430 shown in Figure 4.
• the exemplary database collection 430 includes several databases such as a rules database 432, an encryption key database 434, which may contain one or more symmetric keys, a public certificate database 436, a content database 438, and a cell header information database 439.
• the rules database 432 contains rules pertaining to how and when to assign rights to a piece of content.
• the rules can be general (e.g., Content X requires License Y) or they can be more specific (e.g., anyone with License Y can print Content X; To print Content X, need License Y, else go to URL C). While Figure 4 shows the rules as being stored in a rules database 432, it is recognized that in other embodiments, the rules may be stored in other formats such as a program or a set of scripts.
• the encryption key database 434 contains a set of symmetric keys that the content manager 124 may use to encrypt the requested content.
• the symmetric keys may be created using techniques well known in the art. For a more detailed description of symmetric and asymmetric encryption, please refer to "Applied Cryptography: Protocols, Algorithms, and Source Code in C, Second Edition," by Bruce Schneier, published by John Wiley & Sons, 1996. While this embodiment uses symmetric encryption, it is recognized that in other embodiments, other methods of encryption may be used separate from or in conjunction with symmetric encryption.
• the public certificate database 436 contains public certificates from other components with which the content manager 124 communicates. A component's public encryption key resides within the component's public certificate.
• the public certificate database 436 may contain the public certificates of the offer manager 122, which contain the public keys of the offer manager 122, to allow for encryption and authentication when the content manager 124 and the offer manager 122 communicate.
• the public certificate database 436 may also contain public certificates of the user computers 115 that request pieces of content.
• the content database 438 contains information about various pieces of content as well as the content itself. Pieces of content may include sound files, video files, text documents, e-mail, database records, HyperText Markup Language (HTML) files, Extensible Markup Language (XML) files, Electronic Data Interchange (EDI) files, Message Oriented Middleware (MOM) files, executable scripts, and so forth.
• the content database 438 may include tables such as a publishers table, a publications table, and an articles table.
• the publishers table tracks information about the publishers.
• the publishers table may include fields such as publisher ID, status (signifying whether the publisher is active or inactive), publisher name, default price, and so forth.
• Each publisher may publish one or more publications.
• the publications table tracks information about the publications.
• the publications table may include fields such as publication ID, status (signifying whether the publication is active or inactive), publication code, properties, publisher ID, domain, publication name, publication file type, publication web address, introductory credit, default price, number of free articles, print field (signifying whether printing is permitted), copy field (signifying whether copying is permitted), and so forth.
• Each publication may include one or more articles.
• the articles table tracks information about the articles, or pieces of content. While the term “article” is used, it is recognized that the term “article” may include pieces of content such as sound files, video files, text documents, e- mail, database records, HyperText Markup Language (HTML) files, Extensible Markup Language (XML) files, Electronic Data Interchange (EDI) files, Message Oriented Middleware (MOM) files, executable scripts, and so forth.
• the articles table may include fields such as title, time stamp, publication ID, publisher ID, price, valid time period, cell type, and so forth.
• the content database 438 may include other tables that relate to the content such as a subscriptions table, an administrators table, and so forth.
• the subscriptions table defines various subscriptions and includes fields such as a description field, publication ID, price, and so forth.
• the administrators table tracks special accounts that are authorized to perform administrative tasks such as setting prices, expiration dates, groups, and so forth.
• the administrators table may include fields such as name, password, email address, telephone number, publisher ID, administrator level, permission to manage group accounts, permission to manage promotion, and so forth.
• the cell header information database 439 contains information about the cell header. This information may include unique identifiers for each content cell 210, information about various stores that produce the pieces of content, descriptive information, as well as validation information (e.g., expiration date/time).
• the database collection 430 there may be several processes (not shown) such as ID generators, number generators, statistic generators, session generators and temp storage units that work with the database collection 430.
• processes such as ID generators, number generators, statistic generators, session generators and temp storage units that work with the database collection 430.
• the database collection 430 is implemented using the relational database Microsoft ® SQL Server allowing access to the data via the Structured Query Language (SQL).
• SQL is a language standardized by the International Standards Organization for defining, updating, and querying a relational database.
• the. database collection 430 could be implemented using a different relational database as well as other types of databases (such as a flat file database). Moreover, while the database collection 430 depicted in Figure 4 is comprised of several separate databases, it is recognized that in other embodiments, the database collection 430 may contain other databases or some of the databases could be combined. In addition, the database collection 430 may be implemented as a single database with separate tables or as other data structures that are well know in the art such as linked lists, binary trees, and so forth.
• the database collection 430 may be connected to a backend component (not shown) that receives database requests via servlets, small programs that run on servers, and sends a corresponding SQL request to the database collection 430. It is recognized that in other embodiments data access could be performed differently, for example, a different type of backend component could be used or the database collection 430 could be accessed directly.
• Appendix A While the database collection 430 in Appendix A illustrates a license management system 120 wherein the content manager 124 and the offer manager 122 both have access to the same database collection, it is recognized that in other embodiments, the content manager 124 and the offer manager 122 may have separate copies of various databases.
• Figure 5 illustrates one embodiment of an offer manager 122.
• the exemplary offer manager 122 includes web server software 510, an offer manager component 520, a license manager 530, and a database collection 540.
• Web Server Software 510, an offer manager component 520, a license manager 530, and a database collection 540.
• the offer manager 122 includes web server software 510 as shown in Figure 5.
• the web server software 510 may be, for example, Netscape's Internet Server software, Microsoft's Internet Server software (ISS), or the like.
• Such web server software 510 is configured to process messages from the user computer 115 and the content manager 124.
• the offer manager 122 includes an offer manager component 520 that manages the issuance of license cells 220.
• the offer manager component 520 may also include processes (not shown) such as managing interaction with users, determining whether user requirements have been satisfied before the license manager 530 is invoked, such as tracking monetary payments, determining whether a license was issued, as well other processes.
• the offer manager 122 includes a license manager 530 that manages the creation of license cells 220.
• the license manager 530 illustrated in Figure 5 is comprised of a license cell creation process 532.
• the license cell creation process 532 may be invoked after the user computer 115 requests a license for a content cell 210.
• the license cell creation process 532 creates a license cell 220 for the requested content. While in this embodiment the license manager 530 includes a contents creation process 424, it is recognized that in other embodiments, other modules may create the license cell 220.
• the offer manager 122 could include a license cell creation process 532 and create the license cells 220.
• another module may create the license cell 220 such that either the license manager 530 or the content manager 124 need only locate the appropriate license cell 220.
• the license manager 530 may also include other processes not shown such as managing the repository of issued licenses.
• the license manager 530 accesses the issued license database 547 tracking each time a new license is created. This management role allows the license manager 530 to act as an audit trail of the licensing process and to provide requested license information to other modules. d. Database Collection
• the offer manager 122 includes a database collection 540 shown in Figure 5.
• the exemplary database collection 540 includes several databases such as a rules database 541, an encryption key database 542, which may contain one or more symmetric keys, a public certificate database 543, a content database
• a user database 545 a user database 545, a group database 546, an issued license database (“license database”) 547, a billing database 548, and a cell header information database 549.
• license database issued license database
• the rules database 541 contains rules about how and when to assign rights to a piece of content.
• the rules can be general (e.g., Content X requires License Y) or they can be more specific (e.g., anyone with License Y can print Content X; To print Content X, need License Y, else go to URL C). While Figure 5 depicts a rules database 541, it is recognized that in other embodiments, the rules may be stored in other formats such as a program or a set of scripts.
• the encryption key database 542 contains a set of symmetric keys used by the content manager 124 to encrypt the pieces of requested content. The symmetric keys may be created using techniques well known in the art.
• symmetric and asymmetric encryption For a more detailed description of symmetric and asymmetric encryption, please refer to "Applied Cryptography: Protocols, Algorithms, and Source Code in C, Second Edition,” by Bruce Schneier, published by John Wiley & Sons, 1996. While this embodiment uses symmetric encryption, it is recognized that in other embodiments, other methods of encryption may be used separate from or in conjunction with symmetric encryption.
• the public certificate database 543 contains a set of public certificates from other components with which the offer manager 122 communicates.
• a component's public encryption key resides within the component's public certificate.
• the public certificate database 543 may contain the public certificates of the content manager 124, which contain the public keys of the content manager 124, to allow for authentication when the content manager 124 and the offer manager 122 communicate.
• the public certificate database 543 may also contain public certificates of the user computers 1 15 that request licenses.
• the offer manager's content database 544 may include part or all of the content manager's content database 438.
• the content database 544 may copy data from the content manager's content database 438 using data replication techniques well known in the art allowing the offer manager 122 and the content manager 124 to each have a copy of the same data without destroying the data's integrity.
• the offer manager's content database 544 may include information not in the content manager's content database 438. While this embodiment depicts the offer manager 124 and the content manager 122 each having its own copy off the same content database 544, 438, it is recognized that in other embodiments, the offer manager 122 and the content manager 124 may both have access to the same content database.
• the content database 544 please refer to section entitled 1. Content Manager - c. The Database Collection.
• the user database 545 tracks information on the users.
• the user database 545 may contain tables such as a user information table, a user credit card information table, a user comments table, and a user account balances table.
• the user information table includes information about the users of the system.
• the user information table may include fields such as user account ID, first name, last name, company, e-mail address, account creation date, account status, current charges, current credits, outstanding limit, service level, promotion e-mail, remote user, remote address, remote host, billing name, billing address, password, password encryption type, and so forth.
• the user credit card information table keeps a record of the user's encrypted credit card number as well as other credit card information.
• the user credit card information table may include fields such as user account ID, credit card encryption method, encrypted credit card account number, credit card expiration month, credit card expiration year, and so forth.
• the users comments table tracks comments specific to a particular user, allowing for customized customer support.
• the user comments table may include fields such as user account ID, time stamp, comment field, and so forth.
• the user account balance table keeps a record of a user's credit and charges for each specific publication a user has accessed.
• the user account balance table may include fields such as user account ID, publication ID, time credit was created, available credit, credit amount applied, current charge, pricing terms displayed, as well as other information related to the user's account.
• the group database 546 allows users to be consolidated into a single account, such as a corporate account.
• the group database 546 may include tables such as a groups table, a group users table, and a publications table.
• the groups table maintains group-related information.
• the groups table may include fields such as group ID, group name, password, type of account, number of days the accounts are valid, publication ID, expiration date, and so forth.
• the group users table identifies the members of a group.
• the group users table may include fields such as group ID, user account ID, expiration date, and so forth.
• the group publications table identifies which publications can be accessed by the group's members.
• the group publications table may include fields such as group ID, publication ID, and so forth.
• the license database 547 may contain several tables such as an issued license table.
• the issued license table records every license issued to a user that allows access to an article.
• the issued license table may include fields such as transaction ID, time stamp, article ID, content cell location, content cell ID, framework ID, publication ID, amount charged, and so forth.
• the billing database 548 manages the billing transactions.
• the billing database 548 may include tables such as current transactions, billable transactions, billable summaries, and so forth. It is recognized that other standard billing information may included in the billing database 548.
• the cell header information database 549 contains information for the cell header. This information may include unique identifiers for each license cell 220, unique identifiers for each content cell 210, information about various stores that produce the pieces of content, descriptive information, as well as validation information (e.g., expiration date/time).
• the database collection 540 may also include other databases (not shown) for performing various management tasks.
• the database collection 540 may include a user action database that tracks various user activity such as user requests, use click throughs (tracking each time a user selects a web link), and so forth.
• the database collection 540 may include an error database that tracks various system errors such as errors related to specific articles, errors related to new users, errors related to new licenses, and so forth.
• the database collection 540 may also include a database for maintaining data integrity, such as various synchronization tables that alert the system when new information should be added and /or existing information should be changed.
• the database collection 540 may also include a promotions database that tracks the promotions sent to the user via email and other communication means.
• the database collection 540 may also include user manager activation information for tracking the number of times the user attempts to load the user manager 320 onto one the of the user's computing devices, when the user attempts to reinstall the user manager 320 onto one of the user's computing devices, when the user has verified the user's ID, and so forth.
• user manager activation information for tracking the number of times the user attempts to load the user manager 320 onto one the of the user's computing devices, when the user attempts to reinstall the user manager 320 onto one of the user's computing devices, when the user has verified the user's ID, and so forth.
• there may be several processes such as ID generators, number generators, statistic generators, session generators and temp storage units that work with the database collection 540.
• the database collection 540 is implemented using the relational database Microsoft® SQL Server allowing access to the data via the Structured Query Language (SQL).
• SQL is a language standardized by the International Standards Organization for defining, updating, and querying a relational database.
• the database collection 540 could be implemented using a different relational databases as well as other types of databases (such as a flat file database).
• the database collection 540 depicted in Figure 5 is comprised of several separate databases, it is recognized that in other embodiments, the database collection 540 may contain other databases or some of the databases could be combined.
• the database collection 540 may be implemented as a single database with separate tables or as other data structures that are well know in the art such as linked lists, binary trees, and so forth.
• the database collection 540 may be connected to a backend component (not shown) that receives database requests via servlets, small programs that run on servers, and sends a corresponding SQL request to the database collection 540. It is recognized that in other embodiments data access could be performed differently, for example, a different type of backend component could be used or the database collection 540 could be accessed directly.
• a database collection 540 A more detailed description of one embodiment of a database collection 540 can be found in the attached Appendix A. While the database collection 540 in Appendix A illustrates a license management system 120 wherein the content manager 124 and the offer manager 122 both have access to the same database collection, it is recognized that in other embodiments, the content manager 124 and the offer manager 122 may have separate databases, which may be alike, partly similar or different. III. License Management System Cells
• the license management system 120 creates cells that contain content (content cells 210) as well as cells that contain licenses (license cells 220).
• Figure 6a illustrates one embodiment of a content cell 210a.
• the exemplary content cell 210a contains a set of rules 612a, encrypted content 614a, a cell header 616a, a public certificate 618a, as well as a content cell signature 611a. 1.
• the Rules 612a contains a set of rules 612a, encrypted content 614a, a cell header 616a, a public certificate 618a, as well as a content cell signature 611a.
• the content cell rules 612a tell the user computer 115 what rights are associated with the content cell 210a and what is required in order to have those rights. For example, a content cell 210a may have one set of requirements for the right to print an article, and another set of requirements for viewing an article. In one embodiment, the rules 612a may be written for a specific user, while in other embodiments, the rules 612a may be written more generically and may apply to a particular class of users.
• the content cell's encrypted content 614a contains the requested content encrypted by the content manager 124.
• the content is encrypted using a symmetric key.
• the symmetric key is then encrypted by the license management system 120 using the offer manager's public key so that only the offer manager 122 can decrypt the symmetric key and the encrypted symmetric key is sent to the user manager 320.
• the user manager 320 requests a license
• the user manager 320 sends the offer manager 122 the encrypted symmetric key.
• the offer manager 122 verifies that the user computer 115 has a valid license
• the offer manager 122 can decrypt the symmetric key and encrypt the symmetric key with the user manager's public key allowing the user manager 320 to decrypt the symmetric key and thus decrypt the content.
• symmetric and asymmetric encryption For a more detailed description of symmetric and asymmetric encryption, please refer to "Applied Cryptography: Protocols, Algorithms, and Source Code in C, Second Edition," by Bruce Schneier, published by John Wiley & Sons, 1996. While this embodiment describes a use of a combination of symmetric encryption and asymmetric encryption, it is recognized that other methods of encryption may be used. For example, the offer manager 122 and the content manager 124 could both have access to a database of symmetric keys such that the symmetric key is not sent to the user computer 115 until the user computer 115 has obtained a license.
• the cell header 616a contains information about the content cell 210a. Such information may include a unique identifier for the content cell 210a, information about the store that produced the requested content, descriptive information, information for locating an offer manager 122 (e.g., the URL of the offer manager), as well as validation information (e.g., expiration date/time).
• information about the content cell 210a may include a unique identifier for the content cell 210a, information about the store that produced the requested content, descriptive information, information for locating an offer manager 122 (e.g., the URL of the offer manager), as well as validation information (e.g., expiration date/time).
• the content cell's public certificate 618a is the public certificate of the cell creator which contains the cell creator's public key. For example, if the content manager 124 creates the content cell 210a, then the content manager 124 would sign the cell 210a and include its public certificate 618a in the content cell 210a.
• the public certificate 618a allows the recipient of the cell (e.g., the user computer 115) to verify the authenticity of the sender
• the content manager 124 (e.g., the content manager 124).
• the content cell's digital signature 611a is a piece of information based on both the content cell 210a and the content manager's private keys.
• the digital signature 611a can be used by the user computer 115 to authenticate the creator of the content cell 210a and the information contained in the content cell 210a.
• a digital signature is a code that is unique for each message and to each message sender. Authentication using digital signatures assures the receiver that the message was from the expected sender, and it confirms that the message is complete and has not been altered.
• the digital signature is a cryptographic means through which the origin of the cell and the identity of the sender may be verified.
• digital signatures please refer to "Applied Cryptography: Protocols, Algorithms, and Source Code in C, Second Edition," by Bruce Schneier, published by John Wiley & Sons, 1996. 6. Other Signatures
• Figure 6b illustrates another embodiment of a content cell 210b. While the rules 612b, the encrypted content 614b, and the cell header 616b are similar to those described above, each component has its own digital signature 613b, 615b, 617b. Each digital signature 613b, 615b, 617b is created by the module that created the component. For example, the rules signature 613b is created by the module that created the rules 612b; the cell header signature 617b is created by the module that created the cell header 616b. In other embodiments, different modules may create different parts of the content cell 210, and each module provides its own digital signature. This functionality permits the recipient of the cell to verify the identity of the component creator.
• the content cell 210 must contain a public certificate 618b for each module that created a part of the content cell 210.
• digital signatures could also be used for individual rules or sets of rules. For example, if Module A creates Rules X, Y, and Z and Module B creates Rules M and N, then Module A could sign Rules X, Y, and Z, and Module B could sign Rules M and N.
• the public certificates of both Module A and Module B would be sent in the content cell 210 so the user could verify the origin of each rule.
• the content cell 210 may be comprised of different components or may include only a subset of the above mentioned components.
• various encryption techniques such as symmetric encryption, asymmetric encryption, and digital signatures have been discussed, it is recognized that in other embodiments other means of ensuring security may be used.
• Figure 7a illustrates one embodiment of a license cell 220a.
• the exemplary license cell 220a contains a set of encrypted rules 712a, an encrypted license 714a, a cell header 716a, a public certificate 718a, as well as a license cell signature 711a.
• the license cell rules 712a tell the user computer 115 what rights are associated with the license cell 220a and what is required in order to have those rights.
• a license cell 220a may have one set of requirements for the right to print an article and another set of requirements for viewing an article.
• the rules may be written for a specific user, while in other embodiments, the rules may be written more generically and may apply to a particular class of users.
• both the license cell 220 and the content cell 210 contain rules 612, 712. In other embodiments, only the license cell 220, only the content cell 210, or neither contain rules 612, 712. 2. Encrypted License
• the license cell's encrypted license 714a contains the requested license encrypted by the license manager 530.
• the license is a unique identifier. It is recognized that in other embodiments, the license could be another type of data such as a record of information and/or the license could include the rules.
• the license is encrypted using a symmetric key. For example, the license could be encrypted with the same symmetric key used to encrypt the content.
• the symmetric key is then encrypted by the license management system 120 using the user manager's public key so that only the user manager 320 can decrypt the symmetric key and thus decrypt the license. While this embodiment describes a use of a combination of symmetric encryption and asymmetric encryption, it is recognized that other methods of encryption may be used.
• the cell header 716a contains information about the license cell 220a. Such information may include a unique identifier for the license cell 220a, an identifier for related content cells 210, information about the store that produced the requested content, descriptive information, as well as validation information (e.g., expiration date/time). 4. Public Certificate
• the license cell's public certificate 718a is the public certificate of the cell creator which contains the cell creator's public key. For example, if the license manager 530 creates the license cell 220a, then the license manager 530 creates the license cell 220a.
• the public certificate 718a allows the recipient of the cell (e.g., the user computer 1 15) to verify the authenticity of the sender (e.g., the license manager 530).
• the license cell's digital signature 61 la is a piece of information based on both the license cell 220a and the license manager's private keys.
• the digital signature 611a can be used by the user computer 115 to authenticate the creator of the license cell 220a and the information contained in the license cell 220a. 6.
• Figure 7b illustrates another embodiment of a license cell 220b. While the rules 712b, encrypted license 714b, and cell header 716b are similar to those described above, each component has its own digital signature 713b, 715b, 717b. Each digital signature 713b, 715b, 717b is created by the module that created the component 712b, 715b, 716b. For example, the rules signature 713b is created by the module that created the rules 712b; the cell header signature 715b is created by the module that created the cell header 714b. In other embodiments, different modules may create different parts of the license cell 220b, and thus each module provides its own digital signature. This functionality permits the recipient of the cell to verify the identity of the component creator.
• the license cell 220b In order to verify the creator's identity in this embodiment, the license cell 220b must contain a public certificate 718b for each module that created a part of the license cell 220b.
• digital signatures could also be used to sign individual rules or sets of rules. For example, if Module A creates Rules X, Y, and Z and Module B creates Rules M and N, then Module A could sign Rules X, Y, and Z, and Module B could sign Rules M and N.
• the public certificates of both Module A and Module B would need to be sent in the license cell 220 so the user could verify the origin of each rule.
• the license cell 220 may be comprised of different components or may include only a subset of the above mentioned components.
• FIG. 8 illustrates a flowchart of one embodiment of the flow of information previously discussed in Figure
• FIG. 8 corresponds with the flow of information in Figure 2, wherein state 820 corresponds with event A; state 830 corresponds with event B; state 840 corresponds with event C; state 850 corresponds with event D; state 860 corresponds with event E; and state 870 corresponds with event F.
• the process proceeds to the user computer request state 820.
• the user computer 1 15 requests a specific piece of content and then proceeds to the content manager send state 830.
• the content manager 124 sends the requested piece of content to the user computer 1 15 and proceeds to the next state 840 in which the user computer 115 requests a license.
• the offer manager 122 sends a license to the user computer 115 and proceeds to state 860 in which the user computer 115 checks for the requested content and the corresponding license. Once those items are found, the process proceeds to state 870 wherein the user manager 320 invokes the appropriate application with the requested content. The process then proceeds to the end state 880.
• the user views a web page using the user's browser 310.
• the user requests a piece of content to view, print, copy, play, etc.
• the user could request a piece of content by attempting to access a content cell 210 sent to the user via e-mail, located on a storage unit such as a CD-ROM, floppy disc, and so forth.
• the content request could occur without informing the user. For example, when a certain computer application is executed, the computer program application could automatically send a request to the content manager 124 requesting a piece of content.
• state 830 the content manager 124 finds the requested piece of content and then prepares the content for presentation to the user computer 115.
• the flowchart corresponding to state 830 is further illustrated in Figure 9. Beginning at the start state 830, the process proceeds to state 910 wherein the content manager 124 receives the content request. Proceeding to state 920, the content manager 124 builds the content cell 210 containing the requested content and moves to state 930 wherein the content manager 124 sends the content cell 210 to the user's browser 310 on the user computer 1 15.
• the content manager 124 builds the content cells 210
• the content manager 124 may locate a pre-built content cell 210 within a database.
• other modules could build generic content cells 210 and place them in a repository such that another module, such as the content manager 124, could access the content cells 210 and send them to the user as requested.
• the content cell 210 could be retrieved from a disk, a CD-ROM, as well as other storage devices.
• the content manager 124 sends the content cell 210 to the user's browser 310 in state 930 and then proceeds to the end state 940. It is recognized in other embodiments, the content cell 210 could be sent directly to the user manager 320 and not to the user's browser 310.
• the flowchart corresponding to state 840 when the user computer 1 15 requests a license is illustrated in Figure 10.
• the process proceeds to state 1010 wherein the user's browser 310 receives the content cell 210 and passes the content cell 210 to the user manager 320.
• the user manager 320 opens the content cell 210 in state 1020 and proceeds to state 1030 in which the user manager 320 verifies authenticity of the content cell 210.
• the content cell 210 in one embodiment, contains a signature and a public certificate such that the user manager 320 can use the public certificate to authenticate the sender and the creator of the content cell 210. Proceeding to state 1040, the user manager 320 attempts to locate a license for the content cell 210.
• a license is located in state 1050, then the process proceeds to end state 1090 and moves to state 870 wherein the user manager 320 invokes the application with the content. If, however, the license is not located, then the process proceeds to state 1070 wherein the user manager 320 stores the content cell information in the content database 334 and proceeds to state 1080 in which the user computer 115 requests a license. In one embodiment, the user manager 320 directs the user's browser 310 to send a license request to the content manager 124 and proceeds to the end state 1090. D. Offer Manager Sends License
• the flowchart corresponding to state 850 wherein the offer manager 122 sends the license to the user computer 115 is illustrated in Figure 11. Beginning at the start state 850, the process then proceeds to state 1110 wherein the offer manager 122 receives a license request and proceeds to state 1 120 wherein the offer manager 122 has the user complete license issuance requirements via the user's browser 310.
• the user may have to submit registration information, mailing information, fill out a questionnaire, submit credit card information, and so forth.
• a sample registration form may include requests for information such as: first name, last name, e-mail address, company, credit card type, credit card number, expiration date, name on credit card, billing address, city, state, zip code, country, password, and so forth.
• the process proceeds to the end state 1140. If, however, the user does complete the requirements, then the process proceeds to state 1150 wherein the user manager 320 begins to build the license cell 220. After the license manager 530 builds the license cell 220, the process proceeds to state 1160 wherein the offer manager 122 may "charge" the user computer 115 for the license. This charging takes place, for example, if the license issuance requirement included some type of monetary payment via credit card or other account information. It is recognized that in other embodiments, the billing transactions may be processed by another module such as a service provider, a server, and so forth. Proceeding to state 1170, the offer manager 122 then sends the license cell 220 to the user's browser 310 and proceeds to the end state 1180.
• the flowchart corresponding to state 860 wherein the user computer 115 locates the content and license is illustrated in Figure 12. Beginning in the start state 860, the process proceeds to state 1210 wherein the user's browser 310 receives the license cell 220 and passes the license cell 220 to the user manager 320. In state 1220, the user manager 320 opens the license cell 220 and then proceeds to state 1230 wherein the user manager 320 verifies the authenticity of the license cell 220. As previously described, the license cell 220, in one embodiment, contains a signature and public certificate such that the user manager 320 can use the license cell 220 to authenticate the sender and creator of the license cell 220. Proceeding to state 1240, the user manager 320 stores the license cell information in the user computer 115. In one embodiment, the license manager 530 stores the license cell information in the license database 332. It is recognized that in other embodiments, other methods of storage may be used.
• the process verifies whether the user still wants a license. If the user's response is no, then the process proceeds to the end state 1255. Otherwise if the user indicates that the user still wants a license, then the process proceeds to state 1260, wherein the user computer 115 re-requests a license and proceeds to state 1270 wherein the user computer 115 finds the license and proceeds to state 1280. In state 1280, the user computer 115 finds the content and then proceeds to the end state 1290.
• the user manager 320 invokes the appropriate application with the requested content and proceeds to the end state 880.
• the user manager 320 allows the appropriate access to content according to the terms of the rules. For example, if the requested content was a song in MP3 format and the rules allowed the user computer 115 to play the first 20 seconds of the song, the user manager 320 would invoke an MP3 player on the user computer 115 with the requested song and allow the song to play for 20 seconds.
• the rules may allow for varying types of access to content such as viewing a portion of the content, viewing the entire content, copying a portion of the content, copying the entire content, printing a portion of the content, printing one full copy of the entire content, printing two full copies of the entire content, and so forth.
• the license could be created and/or requested before the content is created and/or requested.
• a user could purchase a license for a subscription to all new articles published in a specific publication. The user would receive a license for content that may not have been created.
• a single piece of content could be related to one or more licenses and a single license could correspond to one or more pieces of content.
• the content manager 124 may also send the user a content location cell. The content location cell provides the user with information on where the content is located. The user may still need to receive a content cell 210 when the user is ready to access the content.
• a license management system module such as the content manager 124, may send the user a content location cell giving the user access to the location of the requested content.
• the content location cell may be similar to a content all, but contains an encrypted content location, such as a URL, rather than the content itself.
• the content location cell may be built by the content manager 124 or another module. Once the user receives the content location cell, the user may request a license to gain access to the content location. After the user receives a license to access the content location, the user may gain access to the content location. With this access the user may, for example, be able to see a snapshot of a piece of content, access advertising material, and so forth. The user may then request access to the content itself and, if required, request the appropriate license.
• Figures 13 and 14 illustrate one embodiment for building content cells 210 and license cells 220. As previously discussed, it is recognized that in other embodiments, other modules could build the cells and/or the cells could be built using other techniques. A. Building The Content Cell
• FIG. 13 A flowchart corresponding to one embodiment of building of the content cell 210 is illustrated in Figure 13.
• the process proceeds to state 1310 wherein the content manager 124 extracts the rules 612.
• the rules 612 tell what types of licenses and/or users can access various types of data and what is required for accessing the content.
• the rules 612 may be stored in a rules database or they may be listed as a text document and/or program wherein the content manager 124 can decipher and determine which rules 612 apply to the selected piece of content.
• the content manager 124 obtains content from the content database 438. In one embodiment, all of the content is stored in one database and the content manager 124 can search the database and retrieve the requested content. Proceeding to state 1330, the content manager 124 then encrypts the content.
• the encryption technique may use a variety of techniques well known in the art. However, as previously discussed, in one embodiment the content manager 124 encrypts the content using a symmetric key and then encrypts the symmetric key with the offer manager's public key. When the encrypted content 614 and encrypted symmetric key are sent to the user computer 115, the user computer 115 cannot decrypt the content and cannot decrypt the symmetric key until it has the appropriate license.
• the content manager 124 creates the cell header 616.
• the cell header 616 may include information such as a unique identifier for the piece of content, the store from which the content was derived, descriptive text, information about expiration, as well as other information. Proceeding to state 1350, the content manager 124 then adds the extracted rules 612, the encrypted content 614, cell header 616, as well as its own public certificate 618 to the content cell 210. In state 1360, the content manager 124 "signs" the content cell 210. As previously discussed, the module that signs the content cell 210 must also include that module's public certificate in the cell.
• the content manager 124 includes its public certificate so that the recipient can verify that the content manager 124 was the one who sent and created the content cell 210. After the content manager 124 signs the content cell 210, the process proceeds to the end state 1370.
• FIG. 14 A flowchart corresponding to one embodiment of building of the license cell 220 is illustrated in Figure 14.
• the process proceeds to state 1410 wherein the license manager 530 extracts the rules 712.
• the rules 712 tell what types of licenses and/or users can access various types of data and what is required for accessing the content.
• the rules 712 may be stored in a rules database or they may be listed as a text document and/or program wherein the license manager 530 can decipher and determine which rules 712 apply.
• the license manager 530 creates a license. Proceeding to state 1430, the license manager 530 then encrypts the license.
• the encryption technique may use a variety of techniques well known in the art. However, as previously discussed, in one embodiment the license manager 530 encrypts the license using a symmetric key and then encrypts the symmetric key with the user's public key. When the encrypted license 714 and encrypted symmetric key are sent to the user computer 115, the user computer 115 can decrypt the license.
• the cell header 716 may include information such as a unique identifier for the license cell, unique identifies for related pieces of content, the store from which the content was derived, descriptive text, information about expiration, as well as other information.
• the license manager 530 then adds the extracted rules 712, the encrypted license 714, cell header 716, as well as its own public certificate 718 to the license cell 220.
• the license manager 530 "signs" the license cell 220.
• the module that signs the license cell 220 must also include that module's public certificate in the cell.
• the license manager 530 includes its public certificate so that the recipient can verify that the license manager 530 was the one who sent and created the license cell 220. After the license manager 530 signs the license cell 220, the process proceeds to the end state 1470.
• the license manager 530 may store a copy of the license cell information in a license database 547 for later tracking the issued license.
• Email address of the Administrator It allows electronic communication with the Administrator (i.e., send reports, statistics, etc ).
• Valid values are P, I, and E.
• the Status is set to E and the error message is stored in this field.
• This field might be null.
• a User account can be inactive (0) or can belong to a guest (1), a member(2) or a group member (3). Also, it can be disabled (4) .
• Credit card type used for billing e.g. , Visa, MasterCard, etc.
• Encrypted credit card number It is encrypted for security reasons.
• Date and time when the entry to this table was made was made. Generally, this is the time when the user encountered the "payment" page and authorized charges to a credit card.
• Date and time when the transaction took place this may be hours, days, or weeks prior to the TimeStamp. Generally, it is the time when the user purchased each document.
• Transaction type identified by a number.
• the valid types are Used (0), Introductory credit (1), Purchase (2), and Summary (3).
• Average time for creating a contract This value is used to monitor the performance of the contract creation code
• the encrypte the credit card number is also specified.
• Transaction type identified by a number.
• the valid types are Unused (0), Introductory credit ( 1), Purchase (2), and Summary (3).
• An article is also known as a DOI.
• Ever represents an available DOI in the KnowledgeStor.
• This table is an article inventor contains all articles a User would access, all Content Cells, and more. This table is the naming servlet.
• Email accounts to which the Email was sent The User can modify this data in their customer profile, so we store the address that was actually used.
• This table houses the collection of templates the system can use to generate Emai messages.
• the system takes the FromHeader, SubjectHeader, and Body from the database entry and uses them to build the m Templates are either owned by a specific publisher or by the system.
• Publisher that owns this template Publisherld of 0 (zero) indicates a system template.
• IP address of the user reinstalling a Framework IP address of the user reinstalling a Framework.
• Groups are used to accomplish corporate ace users can be consolidated into a single account using corporate accounts.
• Group identification number This number is unique
• Type of valid group accounts are demo accounts: D, and standard accounts; S, Users in a demo account can be promoted to a standard account if respective group account fees are paid.
• Template used for th is promotional Email.
• Short code to identify a publication usually it is a three-letter code (e.g., csn, olr, or cad).
• Publisher domain for this publication e.g., com.g2news, com.cadcamnet, etc.
• a User account can be inactive (0) or can belong to a guest (1), a member(2), or a group member (3). It can also be disabled (4).
• a "guest” is one who has not registered fully with KnowledgeStor.
• a "member” has provided complete information including billing information.
• the limit that must be reached for a User to be asked to pay; can be set per User.
• Type of credit card e.g., Visa, MasterCard, etc.
• Valid values are P, I, and E.

Landscapes

• Engineering & Computer Science (AREA)
• Theoretical Computer Science (AREA)
• Software Systems (AREA)
• Physics & Mathematics (AREA)
• Business, Economics & Management (AREA)
• General Physics & Mathematics (AREA)
• Computer Security & Cryptography (AREA)
• General Engineering & Computer Science (AREA)
• Computer Hardware Design (AREA)
• Technology Law (AREA)
• Multimedia (AREA)
• Accounting & Taxation (AREA)
• Finance (AREA)
• Development Economics (AREA)
• Economics (AREA)
• Marketing (AREA)
• Strategic Management (AREA)
• General Business, Economics & Management (AREA)
• Management, Administration, Business Operations System, And Electronic Commerce (AREA)
• Storage Device Security (AREA)

Applications Claiming Priority (3)

Publications (1)

Family

ID=23885110

Family Applications (1)

Country Status (4)

Families Citing this family (6)

Citations (1)

Family Cites Families (1)

• 2000
  • 2000-12-22 WO PCT/US2000/035103 patent/WO2001050319A2/en active Search and Examination
  • 2000-12-22 JP JP2001550610A patent/JP2004500643A/ja active Pending
  • 2000-12-22 EP EP00989442A patent/EP1423807A2/de not_active Withdrawn
  • 2000-12-22 AU AU25945/01A patent/AU2594501A/en not_active Abandoned
• 2011
  • 2011-07-28 JP JP2011165992A patent/JP2011222047A/ja active Pending
• 2013
  • 2013-01-18 JP JP2013007668A patent/JP5793767B2/ja not_active Expired - Lifetime

Patent Citations (1)

Non-Patent Citations (2)

Also Published As

Similar Documents

Legal Events