Method and apparatus for transferring protected content between digital rights management systems

1 . A method of importing content from an upstream digital rights management (DRM) system into a device in a downstream DRM system, comprising:

obtaining data associating at least one device with a rights issuer module (RIM);

verifying authenticity of the data as originating from an entity in a trust hierarchy of the device; and

if the data is authentic and the device is one of the at least one device associated with the RIM, accepting a ciphertext version of the content and a content license associated with the content from the RIM.

2 . The method of claim 1 , wherein the content license includes DRM data associated with the content and a representation of a content encryption key used to encrypt a plaintext version of the content received from an upstream DRM agent to produce the ciphertext version, the representation of the content encryption key being cryptographically bound to the device or a domain.

3 . The method of claim 1 , wherein the data comprises a digital certificate associated with the RIM and signed by a certificate authority in the downstream DRM system, the digital certificate including a field having at least one device identifier respectively associated with the at least one device.

4 . The method of claim 3 , wherein the field comprises a critical extension of the digital certificate.

5 . The method of claim 3 , wherein the step of verifying authenticity of the data comprises:

verifying, at the device, the digital certificate as being signed by the certificate authority;

wherein the content license is accepted by the device only if an identifier of the device is one of the at least one device identifier in the digital certificate and the digital certificate is authentic.

6 . The method of claim 1 , wherein the data comprises an electronic message signed by an authority certified by the downstream DRM system, the electronic message including a field having at least one device identifier respectively associated with the at least one device.

7 . The method of claim 6 , wherein the step of verifying authenticity of the data comprises:

verifying the electronic message as being signed by the authority at the device;

wherein the content license is accepted by the device only if an identifier of the device is one of the at least one device identifier in the electronic message and the electronic message is authentic.

8 . The method of claim 1 , wherein the data comprises a registration trigger message signed by an authorizing rights issuer in the downstream DRM system, the registration trigger message including a field having at least one identifier associated with a respective at least one RIM.

9 . The method of claim 8 , wherein the step of verifying authenticity of the data comprises:

verifying the registration trigger message as being signed by the authorizing rights issuer at the device;

wherein the content license is accepted by the device only if an identifier of the RIM is one of the at least one identifier in the registration trigger message and the registration trigger message is authentic.

10 . The method of claim 1 , wherein the data is generated by the RIM under control of the upstream DRM system.

11 . The method of claim 1 , wherein the data is generated by at least one of the upstream DRM system and the downstream DRM system.

12 . The method of claim 1 , wherein the data is generated by the upstream DRM system, the upstream DRM system being certified to generate the data by the downstream DRM system.

13 . The method of claim 1 , wherein the data includes a hash of an initial domain key value.

14 . A method of processing content from an upstream digital rights management (DRM) system for importation into a device in a downstream DRM system, comprising:

receiving data that associates at least one device with a rights issuer module (RI M);

providing the data to one or more of the at least one device;

if the device is one of the at least one device:

encrypting a plaintext version of the content to produce a ciphertext version of the content;

generating a content license associated with the content for the device; and

providing the ciphertext version of the content and the content license to the device.

15 . The method of claim 14 , further comprising:

obtaining information indicative of the plaintext version of the content from an upstream DRM agent;

receiving DRM data for the content established by the upstream DRM system;

wherein the plaintext version of the content is encrypted using a content encryption key; and

wherein the content license includes a representation of the DRM data and a representation of the content encryption key, the representation of the content encryption key within the content license being cryptographically bound to the device or a domain.

16 . The method of claim 14 , wherein the data comprises a digital certificate associated with the RIM and signed by a certificate authority in the downstream DRM system, the digital certificate including a field having at least one device identifier respectively associated with the at least one device.

17 . The method of claim 16 , wherein the field comprises a critical extension of the digital certificate.

18 . The method of claim 14 , wherein the data comprises an electronic message signed by an authority certified by the downstream DRM system, the electronic message including a field having at least one device identifier respectively associated with the at least one device.

19 . The method of claim 14 , further comprising:

transcoding the plaintext version of the content prior to encryption.

20 . Apparatus for importing content from a rights issuer module (RIM) to a device, comprising:

an encryption module for encrypting a plaintext version of the content received from an upstream digital rights management (DRM) system to produce a ciphertext version of the content;

a content license module for generating a content license associated with the content for the device; and

a DRM agent for obtaining data associating at least one device with the RIM, verifying authenticity of the data as originating from an entity in a trust hierarchy of the device, and accepting the content license only if the device is one of the at least one device associated with the RIM and the data is authentic.

21 . The apparatus of claim 20 , wherein the encryption module is configured to encrypt the plaintext version of the content using a content encryption key, and wherein the content license module is configured to receive DRM data for the content established by the upstream DRM system and generate the content license to include a representation of the DRM data and a representation of the content encryption key, the representation of the content encryption key being cryptographically bound to the device or a domain, the representation of the DRM data being based entirely or in part on the DRM data and realized in a form accessible by a downstream DRM system.

22 . The apparatus of claim 20 , wherein the data comprises a digital certificate associated with the RIM and signed by a certificate authority in a downstream DRM system, the digital certificate including a field having at least one device identifier respectively associated with the at least one device.

23 . The apparatus of claim 20 , wherein the data comprises an electronic message signed by an authority certified by a downstream DRM system, the electronic message including a field having at least one device identifier respectively associated with the at least one device.

24 . The apparatus of claim 20 , wherein the data comprises a registration trigger message signed by an authorizing rights issuer in a downstream DRM system, the registration trigger message including a field having at least one identifier associated with a respective at least one RIM.

25 . The apparatus of claim 20 , wherein the RIM is configured to generate the data under control of the upstream DRM system.

26 . The apparatus of claim 20 , wherein the data is generated by at least one of the upstream DRM system or a downstream DRM system.

27 . The apparatus of claim 20 , wherein the data is generated by the upstream DRM system, the upstream DRM system being certified to generate the data by a downstream DRM system.

28 . The apparatus of claim 20 , wherein the data includes a hash of an initial domain key value.