Challenge-response system and method

1. A content-based authorisation method operable in a server for authorising an operation requested by a client across a communications network, the method comprising a processor performing the steps of:

receiving a request from the client to perform an operation in respect of a data item;

generating a challenge based at least on the content of said data item, wherein said challenge comprises a request for an indication that the client has access to at least a first part of said content, said generating including obtaining a server public value based on said at least first part of said content and a server private value;

sending said challenge to said client including providing with said challenge, said server public value and an indication of said at least first part of said content; and

responsive to receiving a response to said challenge from said client based at least in part on said server public value and comprising said indication, authorising said operation.

2. The method of claim 1 , wherein the method comprises the step of generating a nonce value, and wherein said step of generating a challenge comprises including in said challenge said nonce, and wherein said authorising step is responsive to said received indication being based on a combination of said nonce and said first part of said content to authorise said operation.

3. The method of claim 1 , wherein the method further comprises the step of selecting said at least first part of said content.

4. The method of claim 3 , wherein one of said client or said server selects said indication of said at least first part of said content.

5. The method of claim 4 , wherein said response includes said selection in addition to said indication.

6. The method of claim 1 , wherein at least a portion of said response received from said client and including said indication is cryptographically processed.

7. The method of claim 6 , wherein said cryptographically processed portion is based at least in part on said nonce.

8. The method of claim 6 , wherein the response comprises the hash value of the portion of the data item.

9. The method of claim 6 further comprising the step of performing a secure cryptographic key exchange operation.

10. The method of claim 1 , wherein said step of obtaining a server public value comprises generating a server public Diffie-Hellman value.

11. The method of claim 10 , wherein said authorising step is further responsive to said response being based on a client public value, wherein said client public value is based on said at least first part of said content.

12. The method of claim 11 wherein said authorising step is responsive to said response being based at least in part on a client public Diffie-Hellman value.

13. The method of claim 12 , wherein said step of authorising is responsive to said response being based on said client public Diffie-Hellman value and an authenticator based on said server public Diffie-Hellman value, said at least first part of said content, and a client private Diffie-Hellman value.

14. The method of claim 13 further comprising the step of: generating an authenticator value using a secret key, wherein the step of generating a challenge comprises embedding said authenticator value in said challenge, and wherein said step of authorising is responsive to said received response comprising an indicator of said authenticator value to authorise said operation.

15. A content-based authorisation method for a hand-off operation between a central content server and a hand-off server across a communications network, the method comprising the steps of, a processor at the central content server:

receiving a request from a client to download a data item from the central content server;

performing an authorisation operation with said client;

responsive to said authorisation operation, sending at least a first portion of said data item to said client; and

altering the communications connection between said central content server and said client to cause said client to connect with the hand-off server once said at least first portion of said data item has been sent to said client, and wherein the method further comprises the steps of, a processor at the hand-off server:

receiving a request from said client to download at least a second portion said data item; and

authorising said download operation by said client including:

generating a challenge based at least on the content of said data item, wherein said challenge comprises a request for an indication that the client has access to at least a first part of said content;

sending said challenge to said client; and

responsive to receiving a response to said challenge from said client comprising said indication, authorising said operation.

16. The method of claim 15 wherein said step of altering comprises breaking the communications connection between said central content server and said client once said at least first portion of said data item has been sent to said client.

17. The method of claim 15 , wherein said step of altering comprises redirecting said client to said hand-off server.

18. The method of claim 15 , wherein said step of redirecting comprises sending to said client a partial content response.