Apparatus and methods for content management and account linking across multiple content delivery networks
Methods and apparatus for providing protected content to subscribers of a managed (e.g., MSO) network via a content source accessible via an internetwork such as the Internet. In one embodiment, a user accesses a service provider portal (e.g., website), and requests content. The service provider determines whether the requesting user is permitted to access the content, and what rights or restrictions are associated with the user. This includes authenticating the user as a subscriber of the MSO, and determining the subscriber's subscription level. In another embodiment, a user's account with the MSO and service provider may be federated, thus a given user will have MSO-specific information regarding its identity (such as login information, GUID, etc.) and is able to perform a single sign on to request and receive content.
1. A computerized method for providing access to digitally rendered content via an unmanaged network to a computerized client device associated with a managed network, the computerized method comprising:
receiving, at a computerized entity of the managed network, data representative of a request for first digitally rendered content, the request originating from the computerized client device;
generating, via the computerized entity of the managed network, a unique identifier for the computerized client device;
transmitting, from the computerized entity of the managed network, data indicative of a response to the request to a computerized entity of the unmanaged network, the response (i) comprising the unique identifier, and (ii) configured to indicate to the computerized entity of the unmanaged network that the computerized client device is authorized to access, via the unmanaged network, the first digitally rendered content; and
enabling the computerized entity of the unmanaged network to link data relating to one or more content rendering capabilities of the computerized client device to the unique identifier generated via and received from the computerized entity of the managed network at least for use in one or more subsequent requests for digitally rendered content from the computerized client device;
wherein:
the unique identifier and the data relating to the one or more content rendering capabilities are stored at the computerized entity of the unmanaged network; and
the storage of the unique identifier and the data relating to the one or more content rendering capabilities at the computerized entity of the unmanaged network enables the computerized entity of the unmanaged network to provide the computerized client device access to second digitally rendered content without communicating with the computerized entity of the managed network for (a) authorization of access to the second digitally rendered content by the computerized client device, or (b) determination of a rendering capability of the computerized client device.
2. The computerized method of claim 1 , wherein:
the receiving of the data representative of the request for the first digitally rendered content comprises receiving the data representative of the request via a web computer application program that is not maintained by the computerized entity of the managed network; and
the computerized client device accesses at least the first digitally rendered content via the web computer application program.
3. The computerized method of claim 1 , wherein the receiving of the data representative of the request for the first digitally rendered content comprises receiving the data representative of the request via a website maintained by the computerized entity of the managed network.
4. The computerized method of claim 1 , wherein the transmitting of the data indicative of the response further comprises transmitting data relating to a subscription level of a user of the computerized client device, the data relating to the subscription level stored at the computerized entity of the unmanaged network, the storage of the data relating to the subscription level configured to enable the computerized entity of the unmanaged network to determine at least one of an encoding or a bitrate for the second digitally rendered content.
5. The computerized method of claim 1 , wherein the transmitting of the data indicative of the response further comprises transmitting data relating to a subscription level of a user of the computerized client device, the data relating to the subscription level stored at the computerized entity of the unmanaged network, the storage of the data relating to the subscription level configured to enable the computerized entity of the unmanaged network to automatically pre-configure the first and the second digitally rendered content according to the one or more content rendering capabilities of the computerized client device.
6. The computerized method of claim 1 , wherein the generating of the unique identifier for the computerized client device comprises generating a global unique identifier (GUID) specific to a user of the computerized client device.
7. The computerized method of claim 1 , further comprising pre-positioning cryptographic data at the computerized entity of the unmanaged network, the pre-positioned cryptographic data configured to be linked to the unique identifier for use in the provision of the access to the second digitally rendered content, the cryptographic data pre-positioned by the computerized entity of the managed network at the computerized entity of the unmanaged network in order for the computerized entity of the managed network to maintain integrity of the first and the second digitally rendered content outside of the managed network and within the unmanaged network.
8. The computerized method of claim 7 , wherein the pre-positioning of the cryptographic data comprises pre-positioning a user-specific public/private key pair assigned to the computerized client device by the computerized entity of the managed network.
9. Computer readable apparatus comprising a non-transitory storage medium, the non-transitory storage medium comprising at least one computer program having a plurality of instructions, the plurality of instructions configured to, when executed on a processing apparatus:
receive, at a computerized process of a first network, data representative of a request for access, via a second network, to one or more first digital resource elements, the request originating from a computerized client device;
verify an identity of a user of the computerized client device as an authorized user of the first network, the verification comprising enablement of the user to establish or input one or more credentials, the one or more credentials comprising information specific to the user; and
based at least on success of the verification, transmit, from the computerized process of the first network, data representative of a response to the request, the transmitted data representative of the response configured to indicate to a computerized process of the second network that the access to the one or more first digital resource elements can be provided to the computerized client device of the user;
wherein at least a portion of the data representative of the response is stored at the computerized process of the second network, the stored portion configured to enable the computerized process of the second network to provide the computerized client device access to one or more second digital resource elements without having to redirect the computerized client device back to the computerized process of the first network for a subsequent verification; and
wherein the transmitted data representative of the response comprises rights profile data, the rights profile data indicative of which of a plurality of profiles pre-positioned at the computerized process of the second network to apply, the application comprising modification of at least one digital resource element particularly for use by at least the computerized client device.
10. The computer readable apparatus of claim 9 , wherein the data representative of the response comprises at least one Security Assertion Markup Language (SAML) attribute element.
11. The computer readable apparatus of claim 9 , wherein the data representative of the response comprises an Extensible Hypertext Markup Language (XHTML) format.
12. The computer readable apparatus of claim 11 , wherein the XHTML format comprises at least a pseudonym and GUID (global unique identifier).
13. The computer readable apparatus of claim 9 , wherein the receipt of the data representative of the request comprises receipt of the data in a first format, the first format comprising an Extensible Hypertext Markup Language (XHTML) format.
14. The computer readable apparatus of claim 13 , wherein the XHTML format comprises a Hypertext Transfer Protocol (HTTP) POST message.
15. The computer readable apparatus of claim 14 , wherein the HTTP POST message comprises one or more of the following fields:
(i) user identification information;
(ii) a uniform resource identifier (URI) used to identify the computerized process of the second network; and
(iii) a token.
16. The computer readable apparatus of claim 15 , wherein:
the token comprises an opaque reference to state information maintained at the computerized process of the second network, and the user identification information comprises a value, the value comprising a base64 encoding of an authentication request element;
the authentication request element comprises a uniform resource locator (URL)-encoded element inserted into the XHTML format; and
the authentication request element is deflated and encoded in base64 prior to (i) URL-encoding performed to generate the URL-encoded element and (ii) the insertion of the URL-encoded element into the XHTML form.
17. The computer readable apparatus of claim 9 , wherein the plurality of instructions are configured to, when executed on the processing apparatus: based on the success of the verification, initiate a session between the computerized process of the first network and the computerized client device.
18. The computer readable apparatus of claim 9 , wherein:
the computerized process of the first network comprises a corporate identity provider; and
the computerized process of the second network comprises a provider of web services.
19. The computer readable apparatus of claim 9 , wherein the modification of the at least one digital resource element comprises embedding of at least one of (i) digital rights management (DRM) data or (ii) watermark data within the at least one digital resource element.
20. Computerized apparatus for use in a first network and configured to authorize a computerized client device access to digitally rendered content via a second network, the computerized apparatus comprising:
digital processor apparatus; and
storage apparatus in data communication with the digital processor apparatus, the storage apparatus comprising at least one computer program configured to, when executed on the digital processor apparatus, cause the computerized apparatus to:
generate a unique identifier for a computerized client device, the computerized client device associated with the first network;
obtain data indicative of one or more capabilities of the computerized client device, the capabilities relating to at least one of (i) a plurality of available codecs or (ii) one or more digital rights management (DRM) policies to be enforced at the computerized client device; and
provide, to a computerized entity of the second network, data (a) relating to the unique identifier and the one or more capabilities, and (b) configured to authorize the computerized client device to access, via at least the second network, at least one digitally rendered content element;
wherein the unique identifier and the data indicative of the one or more capabilities are utilized to create a persistent profile to be used by the computerized entity of the second network for subsequent authorization of the computerized client device to access one or more additional digitally rendered content elements until the computerized entity of the second network receives data indicative of a request to terminate the subsequent authorization, the request originating from the computerized client device.