Domain-based trust models for rights management of content
View Patent ↗In a system for distributing and licensing rights-managed digital content, the way in which content is distributed and licensed can be affected by the trust relationships that are established between the various servers that participate in the system. In a typical system, a license server licenses content to particular identities, and an identity server defines those identities by issuing certificates for those identities. The license server issues licenses to identities that have been issued by trusted identity servers. Also, the license server can issue a license on behalf of any entity whose private key it holds. Thus, in one embodiment, the universe of people to whom the license server can issue licenses can be expanded by adding new identity servers to the list of trusted identity servers. In another embodiment, exceptions to the general trust of an identity server can be carved out by creating an exclusion list, which excludes particular identity certificate (e.g., on the basis of e-mail address, domain name, etc.) that have been issued by a trusted identity server. In another embodiment, the universe of content for which the license server can issue licenses can be expanded by providing the license server with the private keys of other license servers.
1. A computer-implemented method of licensing content comprising:
receiving a license request, the license request comprising an identity certificate for an entity to whom the license is to be issued, the identity certificate indicating an issuer that issued the identity certificate;
determining that the issuer of the identity certificate is trusted;
determining that conditions for licensing the content to the entity are present;
creating a license for the entity to use the content; and
transmitting the license to the entity,
wherein determining that the issuer of the identity certificate is trusted comprises:
determining that the issuer issues identity certificates to the public based on e-mail addresses and passwords, the certificate indicating an e-mail address; and
determining that neither the e-mail address nor a domain name identified in the e-mail address is on an exclusion list.
2. A computer-implemented method of licensing content comprising:
receiving a license request, the license request comprising an identity certificate for an entity to whom the license is to be issued, the identity certificate indicating an issuer that issued the identity certificate;
determining that the issuer of the identity certificate is trusted;
determining that conditions for licensing the content to the entity are present;
creating a license for the entity to use the content; and
transmitting the license to the entity,
wherein the method further comprises:
determining that there is an applicable exclusion list for the issuer, the exclusion list comprising for the issuer one or more email addresses such that a license may not be issued for any identity certificate that is issued by the issuer and that contains an e-mail address that is on the exclusion list;
determining that the identity certificate is not excluded according to the terms of the exclusion list, and
determining that the identity certificate does not contain an e-mail address that is on the exclusion list.
3. The method of claim 2 , wherein the exclusion list comprises one or more domain names such that a license may not be issued for any identity certificate that is issued by the issuer and that contains a domain name that is on the exclusion list, and wherein the method comprises:
determining that the identity certificate does not contain a domain name that is on the exclusion list.
4. The method of claim 2 , wherein the exclusion list comprises one or more identifiers such that a license may not be issued for any identity certificate that is issued by the issuer and that contains an identifier on the exclusion list, and wherein the method comprises:
determining that the identity certificate does not contain an identifier that is on the exclusion list.
5. A computing system for licensing a piece of content, the piece of content having an associated rights label that comprises an encrypted decryption key for the content, the encrypted decryption key being decryptable, the system comprising:
a set of private keys, each private key being associated with a particular publishing entity; and
a license issuing module that receives the rights label, determines which publishing entity issued the rights label, determines whether the set of private keys includes the private key of the publishing entity that issued the rights label, decrypts the encrypted decryption key using the publishing entity's private key to produce a decryption key for the content, and that creates a license that includes the decryption key for the content.
6. The computing system of claim 5 , wherein the license includes the decryption key for the content in an encrypted form.
7. The computing system of claim 5 , wherein the rights label includes a certificate of the publishing entity that issued the rights label, and wherein the license issuing module identifies, based on the certificate, which private key in the set corresponds to the publishing entity that issued the rights label.