Method and system for securely distributing content
View Patent ↗A system for securely distributing content is provided. A distribution system includes a content server that distributes content to content clients via a communications link or a tangible medium. The distribution system uses passwords to encrypt and decrypt content and to control access to sensitive information stored on the content clients. The distribution system initially receives various passwords from a user and encrypts each password. Some of the encrypted passwords are “identification passwords” and others are “encryption passwords.” The identification passwords are used to control access to sensitive information stored on the content clients, and the encryption passwords are used to encrypt and decrypt content that is distributed to the content clients. The distribution system configures each content client to contain the identification passwords and encryption passwords in a secure folder.
1. A tangible computer-readable medium having stored thereon instructions that, if executed by a computing system having a processor, cause the computing system to perform operations for distributing content, the operations comprising:
creating an administrative account on a content client;
storing encryption keys in a secure folder of the content client;
installing on the content client a startup application, the startup application programmed to launch a decryption application, the decryption application programmed to decrypt the encryption keys stored in the secure folder and to decrypt encrypted content sent to the content client using at least one of the decrypted encryption keys;
programming the content client so that at initialization of the content client the startup application is launched under the administrative account;
creating a client-specific password that is used to access the administrative account,
wherein the startup application is further programmed to recreate the client-specific password from an identification password stored in the secure folder and at least one persistent attribute of the content client.
2. The tangible computer-readable medium of claim 1 , wherein the operations further comprise:
sending the encrypted content to the content client, the encrypted content being encrypted using at least one of the encryption keys.
3. The tangible computer-readable medium of claim 1 wherein the client-specific password is based on an identification password and the at least one persistent attribute of the content client.
4. The tangible computer-readable medium of claim 3 wherein the at least one persistent attribute of the content client includes an identifier of a processor of the content client.
5. The tangible computer-readable medium of claim 3 wherein the at least one persistent attribute of the content client includes an identifier of a network card of the content client.
6. The tangible computer-readable medium of claim 3 wherein the at least one persistent attribute of the content client includes an identifier derived from a hardware configuration of the content client.
7. The tangible computer-readable medium of claim 1 wherein the startup application is further programmed to use the recreated client-specific password to launch the decryption application.
8. The tangible computer-readable medium of claim 1 wherein the encrypted content is encrypted by serially applying the at least one of the encryption keys.
9. The tangible computer-readable medium of claim 8 wherein the content client decrypts the encrypted content by serially applying the at least one of the decrypted encryption keys in reverse order of encryption.
10. The tangible computer-readable medium of claim 1 wherein the content is a package of images to be displayed by the content client.
11. The tangible computer-readable medium of claim 1 wherein an encryption key is an asymmetrical pair of keys, one of the keys being stored in the secure folder and the other of the keys being used to encrypt the encrypted content.
12. A tangible computer-readable medium having stored thereon instructions that, if executed by a computing system having a processor, cause the computing system to perform operations for distributing content, the operations comprising:
creating an administrative account on a content client;
storing encryption keys in a secure folder of the content client;
installing on the content client a decryption application, the decryption application programmed to decrypt encrypted content sent to the content client using at least one of the encryption keys;
installing on the content client a startup application, the startup application programmed to recreate the client-specific password from an identification password stored in the secure folder and from at least one persistent attribute of the content client;
programming the content client so that at initialization of the content client the decryption application is launched under the administrative account; and
creating a client-specific password that is used to access the administrative account.
13. The tangible computer-readable medium of claim 12 , wherein the operations further comprise:
sending the encrypted content to the content client, the encrypted content being encrypted using at least one of the encryption keys.
14. The tangible computer-readable medium of claim 12 wherein the encryption keys are encrypted.
15. The tangible computer-readable medium of claim 12 wherein the client-specific password is based on an identification password and the at least one persistent attribute of the content client.
16. The tangible computer-readable medium of claim 12 wherein the startup application uses the recreated client-specific password to launch the decryption application.
17. The tangible computer-readable medium of claim 12 wherein the encrypted content is encrypted by serially applying the at least one of the encryption keys.
18. The tangible computer-readable medium of claim 17 wherein the content client decrypts the encrypted content by serially applying the at least one of the decrypted encryption keys in reverse order of encryption.
19. The tangible computer-readable medium of claim 12 wherein the content is a package of images to be displayed by the content client.
20. The tangible computer-readable medium of claim 12 wherein an encryption key is an asymmetrical pair of keys, one of the keys being stored in the secure folder and the other of the keys being used to encrypt the encrypted content.
21. A client system including a processor and memory, the client system comprising:
an administrative account stored in the memory and accessible with a client-specific password derived from an identification password and at least one persistent attribute of the client system;
a secure folder stored in the memory and containing the identification password and a plurality of encryption keys; and
a startup application stored in the memory and when executed by the processor causes the client system to perform the following operations:
recreate the client-specific password based on the identification password stored in the secure folder and the at least one persistent attribute of the client system, and
launch a decryption application in the administrative account using the recreated client-specific password, the encryption keys stored in the secure folder being accessible to the decryption application for decrypting content sent to the client system,
wherein the client system is configured so that at initialization of the client system the startup application is launched under the administrative account.
22. The client system of claim 21 wherein the identification password stored in the secure folder is encrypted.
23. The client system of claim 21 wherein the content includes images distributed by a distribution server.
24. A method, performed by a computer system having a processor, comprising:
creating, with the processor, an administrative account on a content client;
storing encryption keys in a secure folder of the content client, wherein the secure folder is accessible via the administrative account;
installing a decryption application on the content client, the decryption application being configured to decrypt encrypted content received by the content client using at least one of the encryption keys;
programming the content client to launch the decryption application under the administrative account during initialization of the content client;
creating a client-specific password for accessing the administrative account; and
recreating, by a startup application, the client-specific password from an identification password stored in the secure folder and from at least one persistent attribute of the content client.
25. The method of claim 24 wherein the encryption keys are encrypted.
26. The method of claim 24 wherein the client-specific password is based on an identification password and the at least one persistent attribute of the content client.
27. The method of claim 24 wherein the startup application is configured to use the recreated client-specific password to launch the decryption application.
28. The method of claim 24 wherein the encrypted content is encrypted by serially applying the at least one of the encryption keys.
29. The method of claim 28 wherein the content client decrypts the encrypted content by serially applying the at least one of the decrypted encryption keys in reverse order of encryption.
30. The method of claim 24 wherein the content is a package of images to be displayed by the content client.
31. The method of claim 24 wherein an encryption key is an asymmetrical pair of keys, one of the keys being stored in the secure folder and the other of the keys being used to encrypt the encrypted content.
32. The client system of claim 21 wherein the at least one persistent attribute of the client system includes an identifier of a processor of the client system.
33. The client system of claim 21 wherein the at least one persistent attribute of the client system includes an identifier of a network card of the client system.
34. The client system of claim 21 wherein the at least one persistent attribute of the client system includes an identifier derived from a hardware configuration of the client system.
35. The client system of claim 21 wherein the identification password is received from a user.