Secure communication and real-time watermarking using mutating identifiers
A multiple party system for distributing content. In one embodiment, four parties are involved in the system: a consumer, a service provider, an authenticator, and a content provider. The distribution of content from the content provider to the consumer is carried out using a predefined protocol, mutating IDs, watermarks, and licenses. The authenticator controls the distribution of mutating IDs, verifies the identity of one or more participating parties, and provides tracking information for mapping service providers and consumers to particular, possibly watermarked, content items.
1. A method of distributing content items, the method comprising:
obtaining encrypted content at a first entity, the encrypted content including a content item encrypted with a first encryption key;
requesting, at the first entity, a first mutating identifier having a first part and a first key from an authenticator;
encrypting, at the first entity, a watermark with the first key from the first mutating identifier to create a first encrypted label;
grouping, at the first entity, the first part of the first mutating identifier with the first encrypted label to create a first encrypted watermark;
receiving, at the first entity, a request for a content item from a second entity having an identity and a second mutating identifier over a communication link;
generating a decryption key request at the first entity;
transferring the decryption key request from the first entity to the authenticator over a communication link;
receiving, at the first entity, the first decryption key and a second encryption key from the authenticator over a communication link;
decrypting, at the first entity, the encrypted content with the first decryption key to obtain the content item;
applying, at the first entity, the watermark to the content item to obtain watermarked content;
encrypting, at the first entity, the watermarked content with the second encryption key to create encrypted watermarked content;
transferring the first encrypted watermark from the first entity to the second entity over a communication link;
verifying, at the authenticator, the identity of the second entity;
based on verifying the identity of the second entity, sending the encrypted watermarked content from the first entity to the second entity over a communication link; and
based on verifying the identity of the second entity, sending a second decryption key from the authenticator to the second entity over a communication link.
2. The method claimed in claim 1 , further comprising generating a plurality of watermarks including the watermark, wherein each watermark is distinct.
3. The method claimed in claim 1 , wherein the first encryption key is associated with a known identifier associated with the content item.
4. The method claimed in claim 1 , wherein the second decryption key is the second encryption key used to encrypt the watermarked content.
5. The method claimed in claim 1 , wherein the first encrypted watermark is only transferred to the second entity.
6. The method claimed in claim 1 , wherein verifying the identity of the second entity comprises:
encrypting, at the second entity, the first encrypted watermark with a key included in the second mutating identifier of the second entity to create a doubly-encrypted watermark;
sending the doubly-encrypted watermark from the second entity to the authenticator;
decrypting, at the authenticator, the doubly-encrypted watermark to uncover the first encrypted watermark;
decrypting, at the authenticator, the first encrypted watermark to uncover the watermark; and
generating, at the authenticator, a receipt for the first entity.
7. The method claimed in claim 6 , wherein the receipt for the first entity contains a concatenation of the identity of the second entity and the first encrypted watermark.
8. The method claimed in claim 6 , further comprising encrypting, at the authenticator, the receipt for the first entity with a mutating identifier known to the first entity.
9. The method claimed in claim 6 , further comprising sending the second entity a third mutating identifier from the authenticator.
10. The method claimed in claim 9 , further comprising marking, at the authenticator, the second mutating identifier as used.
11. The method claimed in claim 1 , further comprising generating, at the authenticator a receipt for a third entity.
12. The method claimed in claim 11 , wherein the receipt for the third entity contains a concatenation of the identity of the second entity and a function of the watermark.
13. The method claimed in claim 11 , further comprising encrypting the receipt for the third entity with a mutating identifier known to the third entity.
14. The method claimed in claim 1 , further comprising marking, at the authenticator, the first mutating identifier as used.
15. The method claimed in claim 1 , further comprising requesting authorization of the second decryption key from the second entity based on a known identifier associated with the second decryption key before sending the second decryption key to the second entity.
16. The method claimed in claim 1 , further comprising assigning, at a third entity, a label to the content item.
17. The method claimed in claim 16 , further comprising generating a key request for the first encryption key at the third entity, the key request including the label.
18. The method claimed in claim 17 , further comprising transferring the key request from the third entity to the authenticator.
19. The method claimed in claim 18 , further comprising receiving, at the third entity, the first encryption key from the authenticator.
20. The method claimed in claim 19 , further comprising encrypting, at the third entity, the content item with the first encryption key to create the encrypted content.
21. The method claimed in claim 20 , further comprising transferring the encrypted content to the first entity over a communication link.
22. A method of distributing content, the method comprising:
obtaining encrypted content at a first entity, the encrypted content including a content item encrypted with a first encryption key;
obtaining a first encrypted watermark at the first entity, the first encrypted watermark including a watermark encrypted with a first key of a first mutating identifier;
requesting from the authenticator, at the first entity, a second mutating identifier having a second part and a second key;
encrypting, at the first entity, the first encrypted watermark with the second key from the second mutating identifier to create a second encrypted watermark;
grouping, at the first entity, the second part of the second mutating identifier with the second encrypted watermark to create a first doubly-encrypted watermark;
receiving, at the first entity, a request for a content item from a second entity having an identity and a third mutating identifier over a communication link;
generating a decryption key request at the first entity;
transferring the decryption key request from the first entity to the authenticator over a communication link;
receiving, at the first entity, the watermark, a first decryption key, and a second encryption key from the authenticator over a communication link;
decrypting, at the first entity, the encrypted content with the first decryption key to obtain the content item;
applying, at the first entity, the watermark to the content item to create watermarked content;
encrypting, at the first entity, the watermarked content with the second encryption key to create encrypted watermarked content;
transferring the first doubly-encrypted watermark to the second entity from the first entity over a communication link;
verifying, at the authenticator, the identity of the second entity;
based on verifying the identity of the second entity, sending the encrypted watermarked content from the first entity to the second entity a communication link; and
based on verifying the identity of the second entity, sending a second decryption key from the authenticator to the second entity over a communication link.
23. The method claimed in claim 22 , further comprising generating a plurality watermarks including the watermark, wherein each watermark is distinct.
24. The method claimed in claim 22 , wherein the first encryption key is associated with a known identifier, the known identifier included in the request.
25. The method claimed in claim 22 , wherein the second decryption key is the second encryption key used to encrypt the watermarked content.
26. The method claimed in claim 22 , wherein the first doubly-encrypted watermark is only transferred to the second entity.
27. The method claimed in claim 22 , wherein verifying the identity of the second entity comprises:
encrypting, at the second entity, the first doubly-encrypted watermark with a key included in the third mutating identifier of the second entity to create a thrice-encrypted watermark;
sending the thrice-encrypted watermark to the authenticator from the second entity;
decrypting, at the authenticator, the thrice-encrypted watermark to uncover the first doubly-encrypted watermark;
decrypting, at the authenticator, the first doubly-encrypted watermark to uncover the encrypted watermark;
decrypting, at the authenticator, the encrypted watermark to uncover the watermark; and
generating, at the authenticator, a receipt for the first entity.
28. The method claimed in claim 27 , wherein the receipt for the first entity contains a concatenation of the identity of the second entity and the encrypted watermark.
29. The method claimed in claim 27 , further comprising encrypting, at the authenticator, the receipt with a mutating identifier known to the first entity.
30. The method claimed in claim 22 , further comprising sending the second entity a fourth mutating identifier from the authenticator.
31. The method claimed in claim 30 , further comprising marking, at the authenticator, the third mutating identifier as used.
32. The method claimed in claim 22 , further comprising marking, at the authenticator, the first and second mutating identifiers as used.
33. The method claimed in claim 22 , further comprising generating, at the authenticator, a receipt for a third entity.
34. The method claimed in claim 33 , wherein the receipt for the third entity contains a concatenation of the identity of the second entity and a function of the watermark.
35. The method claimed in claim 33 , further comprising encrypting, at the authenticator, the receipt for the third entity with a mutating identifier known to the third entity.
36. The method claimed in claim 22 , further comprising requesting, at the authenticator, authorization of the second decryption key from the second entity based on a known identifier associated with the second decryption key before sending the second decryption key to the second entity.
37. The method claimed in claim 22 , further comprising assigning, at a third entity, a label to the content item.
38. The method claimed in claim 37 , further comprising generating a key request for the first encryption key at the third entity, the key request including the label.
39. The method claimed in claim 38 , further comprising transferring the key request from the third entity to the authenticator.
40. The method claimed in claim 39 , further comprising receiving, at the third entity, the first encryption key from the authenticator.
41. The method claimed in claim 40 , further comprising encrypting the content item with the first encryption key to create the encrypted content.
42. The method claimed in claim 41 , further comprising transferring the encrypted content to the first entity over a communication link.
43. The method claimed in claim 42 , further comprising generating, at the third entity, the watermark.
44. The method claimed in claim 43 , further comprising requesting, at the third entity, the first mutating identifier from the authenticator, the first mutating identifier including a first part and a first key.
45. The method claimed in claim 44 , further comprising receiving, at the third entity, the first mutating identifier from the authenticator.
46. The method claimed in claim 45 , further comprising encrypting, at the third entity, the label and the watermark with the first key of the first mutating identifier to create a first encrypted watermark.
47. The method claimed in claim 46 , further comprising grouping the first part of the first mutating identifier with the first encrypted label to create the first encrypted watermark.
48. The method claimed in claim 47 , further comprising transferring the first encrypted watermark to the first entity over a communication link.