Accessing protected content in a rights-management architecture
A digital rights management system for the distribution, protection and use of electronic content. The system includes a client architecture which receives content, where the content is preferably protected by encryption and may include a license and individualization features. Content is protected at several levels, including: no protection; source-sealed; individually-sealed (or “inscribed”); source-signed; and fully-individualized (or “owner exclusive”). The client also includes and/or receives components which permit the access and protection of the encrypted content, as well as components that allow content to be provided to the client in a form that is individualized for the client. In some cases, access to the content will be governed by a rights construct defined in the license bound to the content. The client components include an object which accesses encrypted content, an object that parses the license and enforces the rights in the license, an object which obtains protection software and data that is individualized for the client and/or the persona operating the client, and a script of instructions that provides individualization information to a distributor of content so that the content may be individualized for the client and/or its operating persona. Content is generally protected by encrypting it with a key and then sealing the key into the content in a way that binds it to the meta-data associated with the content. In some instances, the key may also be encrypted in such a way as to be accessible only by the use of individualized protection software installed on the client, thereby binding use of the content to a particular client or set of clients.
1. A computer-readable storage medium, wherein the computer-readable storage medium is not a transient signal, the computer-readable storage medium having computer-executable instructions to perform acts comprising:
authenticating a software application that requests access to sealed data; and
providing at least one cryptographic service for the software application, wherein:
the computer-executable instructions to perform the at least one cryptographic service are separate from the software application and invocable by an application programming interface call from the software application;
the at least one cryptographic service comprises unsealing the sealed data, wherein the software application can only open the sealed data after an activation of the software application;
the activation comprising obtaining an activation certificate and secure repository executable component, wherein the secure repository executable component is uniquely tied to a first device on which the software application is executed and is obtained by downloading the secure repository executable component from a secure repository server;
the secure repository executable component contains a first private key that is required for unsealing the sealed data;
the activation certificate contains a second private key that is encrypted using a public key of the secure repository executable component;
the sealed data is encrypted using a symmetric key;
the symmetric key is encrypted with a public key contained in the activation certificate;
the secure repository executable component decrypts the second private key by using the first private key;
the decrypted second private key is used to decrypt the symmetric key; and
the decrypted symmetric key is used to unseal the sealed data.
2. The computer-readable storage medium of claim 1 , wherein the software application is a reader application that enables reading of an eBook on the first device.
3. The computer-readable storage medium of claim 1 , wherein the secure repository executable component is downloaded into the first device from the secure repository server.
4. The computer-readable storage medium of claim 1 , wherein the sealed data is an owner-exclusive data that cannot be opened on devices other than the first device.
5. The computer-readable storage medium of claim 1 , wherein the sealed data includes information associated with a user to whom the sealed data is licensed to, the information comprising at least one of: a name of the user, a credit card number, or a receipt number associated with a purchase of content in the sealed data.
6. A method of providing a cryptographic service, the method comprising:
activating a reader component for accessing an owner-protected title in a first device, the activating comprising obtaining an activation certificate and a secure repository executable component, wherein the secure repository executable component is uniquely tied to the first device and is obtained by downloading the secure repository executable component from a secure repository server; and
upon successful activation, executing the secure repository executable component to open the owner-protected title in the first device, wherein:
the secure repository executable component contains a first private key that is required for opening the owner-protected title;
the activation certificate contains a second private key that is encrypted using a public key of the secure repository executable component;
the owner-protected title is encrypted using a symmetric key;
the symmetric key is encrypted with a public key contained in the activation certificate;
the secure repository executable component decrypts the second private key by using the first private key;
the decrypted second private key is used to decrypt the symmetric key; and
the decrypted symmetric key is used to open the owner-protected title.
7. The method of claim 6 , wherein obtaining the secure repository executable component comprises:
uploading a hardware ID from the first device to the secure repository server; and
in response thereto, downloading into the first device, the secure repository executable component from the secure repository server.
8. The method of claim 7 , wherein the hardware ID is based on a number that is associated with hardware of the first device.
9. The method of claim 6 , wherein the owner-protected title is an eBook that can be read on the first device.
10. The method of claim 6 , wherein an ACTIVEX control component is used for activating the reader component in the first device.
11. The method of claim 6 , wherein the reader component is part of a browser that is executed on the first device.