Digital rights management authorization token pairing
A method and apparatus for providing a license to a client device, the license providing a key for decrypting a content instance. In one embodiment, the method comprises accepting a license request, the license request including a client identifier and an access token having an access token identifier and key request data comprising a content identifier identifying the content instance, determining if the received access token identifier is currently bound to a stored client device identifier, and temporarily binding the received access token identifier with the received client device identifier and providing the received access token for validation or returning an error without providing the received access token for validation depending upon the determination.
1. A method of providing a key to a client device for decrypting and displaying a content instance on the client device, the method comprising:
receiving a request from the client device, the request including a client device identifier and an access token having an access token identifier and key request data comprising a content identifier identifying the content instance;
determining that the received access token identifier is currently not bound to a stored client device identifier;
based upon the determination, modifying the access token to temporarily bind the received access token identifier with the received client device identifier and providing the modified access token to a token validator for validation; and
upon validation by the token validator, delivering the key to the client device.
2. The method of claim 1 , further comprising:
determining if the received access token has been validated;
if the received access token has not been validated, returning an error without providing the key; and
if the received access token has been validated, returning the key for decrypting the content instance identified by the content identifier.
3. The method of claim 2 , wherein binding the received access token identifier with the received client device identifier and providing the received access token for validation comprises:
temporarily binding the received access token identifier with the received client device identifier and providing the received access token for validation.
4. The method of claim 3 , wherein:
binding the received access token identifier with the received client device identifier comprises associatively storing the received access token identifier and the received client device identifier.
5. The method of claim 4 , wherein:
the key is characterized at least in part by a maximum temporal key duration; and
the received access token identifier is bound with the received client device identifier for only the maximum temporal key duration.
6. The method of claim 4 , wherein the received access token identifier and the received client device identifier are associatively stored in a first-in-first-out (FIFO) memory cache.
7. The method of claim 4 , wherein the received access token is a JavaScript object notation (JSON) access token appended to a license request.
8. The method of claim 7 , wherein:
the JSON access token includes a signature of data including at least access token identifier; and
the method further comprises
verifying the token identifier according to the signature; and
returning the error to the client device if the token identifier is not verified.
9. The method of claim 1 , wherein:
binding the received access token identifier with the received client device identifier and providing the received access token for validation or returning an error without providing the received access token for validation depending upon the determination comprises:
if the received access token identifier is not currently bound to a stored client device identifier:
temporarily binding the received access token identifier with the received client device identifier and providing the received access token for validation;
if the received access token identifier is currently bound to a stored client device identifier:
determining if the received access token identifier is currently bound to a different client device identifier than the received client device identifier of the license request;
if the received access token identifier is currently bound to a different client device identifier than the received client device identifier of the license request, returning an error without providing the received access token for validation; and
if the received access token identifier is currently bound to the received client device identifier of the license request, providing the received access token for validation.
10. An apparatus for providing a key to a client device for decrypting a content instance on the client device, the method comprising:
a processor;
a memory, communicatively coupled to the processor, the memory comprising processor instructions including processor instructions for:
receiving a request from the client device, the request including a client device identifier and an access token having an access token identifier and key request data comprising a content identifier identifying the content instance;
determining that the received access token identifier is currently not bound to a stored client device identifier;
based upon the determination, modifying the access token to temporarily bind binding the received access token identifier with the received client device identifier and providing the modified access token to a token validator for validation; and
upon validation by the token validator, delivering the key to the client device.
11. The apparatus of claim 10 , further comprising:
determining if the received access token has been validated;
returning an error without providing the key if the received access token has not been validated; and
returning the key for decrypting the content instance identified by the content identifier if the received access token has been validated.
12. The apparatus of claim 11 , wherein the instructions for binding the received access token identifier with the received client device identifier and providing the received access token for validation comprise instructions for:
temporarily binding the received access token identifier with the received client device identifier and providing the received access token for validation.
13. The apparatus of claim 12 , wherein:
the instructions for binding the received access token identifier with the received client device identifier comprise instructions for associatively storing the received access token identifier and the received client device identifier.
14. The apparatus of claim 13 , wherein:
the key is characterized at least in part by a maximum temporal key duration; and
the received access token identifier is bound with the received client device identifier for only the maximum temporal key duration.
15. The apparatus of claim 13 , wherein the received access token identifier and the received client device identifier are associatively stored in a first-in-first-out (FIFO) memory cache.
16. The apparatus of claim 13 , wherein the received access token is a JavaScript object notation (JSON) access token appended to a license request.
17. The apparatus of claim 10 , wherein:
the instructions for binding the received access token identifier with the received client device identifier and providing the received access token for validation or returning an error without providing the received access token for validation depending upon the determination comprises:
temporarily binding the received access token identifier with the received client device identifier and providing the received access token for validation if the received access token identifier is not currently bound to a stored client device identifier;
determining if the received access token identifier is currently bound to a different client device identifier than the received client device identifier of the license request if the received access token identifier is currently bound to a stored client device identifier;
returning an error without providing the received access token for validation if the received access token identifier is currently bound to a different client device identifier than the received client device identifier of the license request; and
providing the received access token for validation if the received access token identifier is currently bound to the received client device identifier of the license request.