System and method for device authorization and remediation
A method is provided for authorizing a device for consuming content. In method includes the steps of generating an authorization request, the authorization request for authorization data including device diagnostic data (instructions) an device remedial data (instructions), transmitting the authorization request from the device to an authorizing service, and authorizing or remediating the device according to an authorization response to the authorization request received from an authorization server.
1. A method of authorizing a device for playing back video content, comprising:
generating an authorization request to enable the device to receive video for playing back, the authorization request for authorization data comprising device diagnostic data and device remedial data;
transmitting the authorization request from the device to a remote authorization service and
authorizing or remediating the device according to an authorization response to the authorization request received from an authorization service, wherein the authorization response comprises an identification of one or more threatening processes or data types and instructions for performing appropriate remedial action, and wherein authorizing or remediating the device comprises:
determining whether one or more of the one or more threatening processes or data types are present at the device; and
if one or more of the one or more threatening processes or data types are present at the device, performing the appropriate remedial action identified from the authorization response;
transmitting a diagnostic ping from the device to an access service providing data required to use the content, wherein the diagnostic ping checks for connectivity, wherein the data provided by the access service comprises a media key for decrypting content, and wherein the authorization service is distinct and separate from the access service providing data required to use the content;
determining communication connectivity between the device and the authorization service via the same communication connectivity as between the device and the access service providing data required to use the content, wherein a determination is made that no communication connectivity exists between the device and the authorization service when no response to the diagnostic ping is received from the access service providing data required to use the content;
wherein the authorization request is generated by the device after expiration of the authorization data most recently received by the device, including expiration of the device remedial data that occurs by not timely confirming accurate digital rights management (DRM) information due to lack of response by the remote authorization service for a period of time, and wherein the authorization request is only transmitted when the determination is made that communication connectivity exists between the device and the authorization service.
2. The method of claim 1 , wherein the device diagnostic data comprises a description of a required device environment for the playing back the content and the device remedial data describes required device remedial action to be performed if the device is not in the required environment.
3. The method of claim 1 , wherein authorizing or remediating the device according to the authorization comprises:
determining if an authorization response comprising the authorization data is received from the authorization service;
if the authorization response is received from the authorization service;
(a) determining a device environment for the consumption of the content;
(b) if the determined device environment differs from the required device environment, remediating the device according to the device remedial data.
4. The method of claim 3 , further comprising:
if the authorization response is not received from the authorization service, determining if previous authorization data most recently received by the device has expired;
if the previous authorization data has expired:
retransmitting the authorization request up to N-1 times until an authorization response is received; and
performing steps (a) through (b);
if the previous authorization data has not expired:
determining the device environment for the consumption of protected video data; and
if the determined device environment differs from a required device environment of the previous authorization data, performing a device remedial action according to the device remedial data of the previous authorization data.
5. The method of claim 4 , wherein the device remedial action comprises one of shutting down the device and not shutting down the device.
6. The method of claim 5 , wherein the device plays back the content via execution of a playback process, and wherein:
the device stores:
the digital rights management (DRM) registration information including but not limited to one or more server keys in persistent device storage;
client identity information including client keys in the persistent device storage;
one or more content keys for decrypting the content in persistent storage;
a session key for communicating with the server in impersistent storage;
one or more content keys for decrypting the content in impersistent storage; and
the remedial action comprises shutting down the device comprising:
deleting the DRM registration information, the client identity information, content keys in persistent storage and terminating playback process thereby rendering the one or more content keys in impersistent storage unavailable for use.
7. The method of claim 5 , wherein the device plays back the content via execution of a playback process and wherein:
the device stores:
the digital rights management (DRM) registration information including one or more server keys in persistent device storage;
client identity information comprising client keys in the persistent device storage;
one or more content keys for decrypting the content in persistent storage;
a session key for communicating with the server in impersistent storage;
one or more content keys for decrypting the content in impersistent storage;
the remedial action comprises not shutting down the device, comprising:
deleting the one or more content keys and retaining the DRM registration information, the client identity information, and the session key.
8. The method of claim 5 , wherein the device plays back the content via execution of a playback process, and wherein:
the device stores:
the digital rights management (DRM) registration information including server keys in persistent device storage;
client identity information including client keys in the persistent device storage;
a session key for communicating with the server in impersistent storage;
one or more content keys for decrypting the content in impersistent storage;
the remedial action comprises not shutting down the device, comprising:
deleting the one or more content keys and retaining the DRM registration information, the client identity information, and the session key and refusing to retrieve any content keys in the future.
9. The method of claim 1 , wherein the authorization request is further generated by the device after at least one of:
an explicit request by an application on the device;
triggering of a periodic timer created and maintained by an application, for purposes of generating the said request, on the device;
a restart of the device; and
a change in an attribute of the device.
10. An apparatus for playing back content, comprising:
a processor;
a persistent memory for storing instructions comprising instructions for
generating an authorization request to enable the processor to receive video for playing back, the authorization request for authorization data comprising device diagnostic data and device remedial data;
transmitting the authorization request from the device to an authorizing service; and
authorizing or remediating the device according to an authorization response to the authorization request received from an authorization service, wherein the authorization response comprises an identification of one or more threatening processes or data types and instructions for performing appropriate remedial action, and wherein authorizing or remediating the device comprises:
determining whether one or more of the one or more threatening processes or data
types are present at the device; and
if one or more of the one or more threatening processes or data types are present
at the device, performing the appropriate remedial action identified from the authorization response;
transmitting a diagnostic ping from the device to an access service providing data required to use the content, wherein the diagnostic ping checks for connectivity, wherein the data provided by the access service comprises a media key for decrypting content, and wherein the authorization service is distinct and separate from the access service providing the data required to use the content;
determining communication connectivity between the device and the authorization service via the same communication connectivity as between the device and the access service providing data required to use the content, wherein a determination is made that no communication connectivity exists between the device and the authorization service when no response to the diagnostic ping is received from the access service providing data required to use the content;
wherein the authorization request is generated by the device after expiration of the authorization data most recently received by the device, including expiration of the device remedial data that occurs by not timely confirming accurate digital rights management (DRM) information due to lack of response by the remote authorization service for a period of time, and wherein the authorization request is only transmitted when the determination is made that communication connectivity exists between the device and the authorization service.
11. The apparatus of claim 10 , wherein the device diagnostic data comprises a description of a required device environment for the playing back of the content and the device remedial data describes required device remedial action to be performed if the device is not in the required environment.
12. The apparatus of claim 11 , wherein the instructions for authorizing or remediating the device according to the authorization comprise instructions for:
determining if an authorization response comprising the authorization data is received from the authorization service;
if the authorization response is received from the authorization service;
(a) determining a device environment for the consumption of the content;
(b) if the determined device environment differs from the required device environment, performing device remedial action according to the device remedial data;
if the authorization response is not received from the authorization service, determining if previous authorization data most recently received by the device has expired;
if the previous authorization data has expired:
retransmitting the authorization request up to N-1 times until an authorization response is received; and
performing steps (a) through (b);
if the previous authorization data has not expired:
determining the device environment for the consumption of protected video data; and
if the determined device environment differs from a required device environment of the previous authorization data, performing a device remedial action according to the device remedial data of the previous authorization data.
13. The apparatus of claim 12 , wherein the device remedial action comprises one of shutting down the device and not shutting down the device.
14. The apparatus of claim 13 , wherein the device plays back the content via execution of a playback process, and wherein:
the device persistent memory stores:
the digital rights management (DRM) registration information comprising one or more server keys;
client identity information comprising client keys;
one or more content keys for decrypting the content;
a session key for communicating with content server in impersistent storage;
a device impersistent memory stores:
the one or more content keys for decrypting the content; and
the remedial action comprises shutting down the device comprising:
deleting the registration information, the client identity information, content keys in persistent storage and terminating playback process thereby rendering the one or more content keys in impersistent storage unavailable for use.
15. The apparatus of claim 13 , wherein the device plays back the content via execution of a playback process, and wherein:
the device persistent memory stores:
the digital rights management (DRM) registration information comprising a one or more server keys;
client identity information comprising client keys;
one or more content keys for decrypting the content;
a device impersistent memory stores:
the one or more content keys for decrypting the content;
a session key for communicating with the server; and
the remedial action comprises not shutting down the device, comprising:
deleting the one or more content keys and retaining the DRM registration information, the client identity information, and the session key.