Digital rights management engine systems and methods
In one embodiment, a digital rights management engine is provided that evaluates license associated with protected content to determine if a requested access or other use of the content is authorized. In some embodiments, the licenses contain control programs that are executable by the digital rights management engine.
1 . A method of protecting a digital rights management license, the digital rights management license comprising (a) a first object, the first object comprising a control program, the control program comprising one or more instructions, the one or more instructions being operable to test one or more conditions associated with a specified use of a piece of electronic content; (b) a second object comprising a first cryptographic key, the first cryptographic key being encrypted at least in part, the first cryptographic key being operable to decrypt the piece of electronic content; (c) a third object comprising a reference to the first object and a reference to the second object; and (d) a fourth object comprising a reference to the second object and a reference to the piece of electronic content, the method comprising:
digitally signing the third object using the first cryptographic key.
2 . The method of claim 1 , further comprising:
computing a message authentication code of the first object, the message authentication code making use of the first cryptographic key.
3 . The method of claim 2 , further comprising:
computing a public key signature of the message authentication code.
4 . The method of claim 3 , further comprising:
including the message authentication code and the public key signature in the second object.
5 . The method of claim 1 , wherein the first object comprises a control object.
6 . The method of claim 1 , wherein the second object comprises a content key object.
7 . The method of claim 1 , wherein the third object comprises a controller object.
8 . The method of claim 1 , wherein the fourth object comprising a protector object.
9 . A method of verifying the integrity of a digital rights management license, the digital rights management license comprising (a) a first object, the first object comprising a control program, the control program comprising one or more instructions, the one or more instructions being operable to test one or more conditions associated with a specified use of a piece of electronic content; (b) a second object comprising a first cryptographic key, the first cryptographic key being encrypted at least in part, the first cryptographic key being operable to decrypt the piece of electronic content; (c) a third object comprising a reference to the first object and a reference to the second object; and (d) a fourth object comprising a reference to the second object and a reference to the piece of electronic content, the method comprising:
using the first cryptographic key to verify a digital signature of the third object.
10 . The method of claim 9 , further comprising:
using the first cryptographic key to compute a message authentication code and comparing the message authentication code with a value contained in the third object.
11 . The method of claim 10 , further comprising:
using a private key of public/private key pair to verify a signature of the message authentication code.
12 . The method of claim 9 , wherein the first object comprises a control object.
13 . The method of claim 9 , wherein the second object comprises a content key object.
14 . The method of claim 9 , wherein the third object comprises a controller object.
15 . The method of claim 9 , wherein the fourth object comprises a protector object.
16 . A system of verifying the integrity of a digital rights management license, the digital rights management license comprising (a) a first object, the first object comprising a control program, the control program comprising one or more instructions, the one or more instructions being operable to test one or more conditions associated with a specified use of a piece of electronic content; (b) a second object comprising a first cryptographic key, the first cryptographic key being encrypted at least in part, the first cryptographic key being operable to decrypt the piece of electronic content; (c) a third object comprising a reference to the first object and a reference to the second object; and (d) a fourth object comprising a reference to the second object and a reference to the piece of electronic content, the system comprising:
means for using the first cryptographic key to verify digital signature of the third object.