Microsoft Technology Licensing, LLC

Brian Patrick Evans

Clifford Paul Strom

Benjamin Brooks Cutter, Jr

Amit Jain

Daniel Rosenstein

Yongjun Wu

James Morris Alkove

Shyam Sadhwani

Geoffrey T Dunbar

Ajitesh Kishore

Anand Paka

Richard D Prologo

Michael Jay Parks

Samuel John Wenker

M Jay Parks

Hany Farag

Vikas Khandelwal

Clifford Paul Storm

Alexandre Vicktorovich Grigorovitch

Nicholas Jie Fang

Eduardo P Oliveira

Ming Ma

Scott J Fierstein

Matthew C Howard

Michael Yiu-Kwan Siu

Lucia Darsa

Michael Y Siu

Fedir Yuriyovych Kyslov

Eduardo Oliveria

Michael Yui-Kwan Siu

Matthew L c/o Microsoft Corporation Howard

Anand D Paka

Benjamin Brooks Cutter

Lossy data stream decoder techniques are described herein. In response to a request for decoded content from a consuming application, a decoder may validate headers and identify portions of the data that are considered pertinent to the request. The decoder then performs lossy extraction to form incomplete data that is provided to the consuming application in response to the request. The full data for the data stream is not exposed to the consuming application or other downstream components. In this way, the consuming application is provided data sufficient to perform requested graphics processing and resource management operations, while at the same time the risk of piracy is mitigated since the consuming application is unable to get a full version of the data in the clear and the data have been validated by the decoder.

Lossy data stream decoder

Innovations in the area of hardware-protected digital rights management ('DRM') systems are presented. For example, a hardware-protected DRM system includes a trusted layer and untrusted layer. In the untrusted layer, a control module receives source media data that includes encrypted media data. The control module processes metadata about the media data. The metadata, possibly exposed by a module in the trusted layer, is not opaque within the untrusted layer. In the trusted layer, using key data, a module decrypts encrypted media data, which can be the encrypted media data from the source media data or a transcripted version thereof. A module in the trusted layer decodes the decrypted media data. A host decoder in the untrusted layer uses the metadata to manage at least some aspects of the decoding, rendering and display in the trusted layer, without exposure of decrypted media data or key data within the untrusted layer.

Media decoding control with hardware-protected digital rights management

A method of generating a device certificate. A method of generating a device certificate comprising, constructing a device certificate challenge at a device, sending information to a device certificate individualization server in response to the device certificate challenge, validating the device certificate challenge by the device certificate individualization server, and validating the device certificate response by the device.

Device certificate individualization

A computing device has encrypted content and a corresponding license having a decryption key for decrypting the content. The license allows the computing device to render the content thereon. The computing device may issue a sub-license based on the license to a portable device. The sub-license allows the portable device to render the content thereon and has the decryption key. The portable device has a digital device certificate including information thereon. The computing device receives from the portable device the device certificate thereof, and determines based on rules in the license and the information on the portable device in the device certificate whether the computing device can issue the sub-license to the portable device. If so, the computing device constructs such sub-license to include the decryption key (KD) and transmits the constructed sub-license to the portable device.

Licensing content for use on portable device

A system of controlling playback of digital media. A system of controlling playback of digital media comprising a CE device having an output path and a license having a specified output protection level disposed upon the CE device in which the specified output protection level controls playback of the digital media over the output path.

Output protection levels

A system of controlling playback of digital media. A system of controlling playback of digital media comprising a CE device having a secure clock and a license having a specified grace period disposed upon the CE device in which a digital media file governed by the license may be played for the grace period upon failure of the secure clock.

Secure clock with grace periods

A digital license includes an identification of a removal service that can authorize removing such license. A client selects the license to be removed and the service, constructs a challenge including therein a challenge license identification block (LIB) identifying the license to be removed, and sends the challenge to the service. The service receives the challenge, stores at least a portion of the challenge in a database, constructs a response corresponding to the challenge and including therein a response LIB identifying the license to be removed and an identification of the service, and sends the response to the client. The client receives the response, employs the response LIB from the response to identify the license to be removed, and removes the identified license upon confirming that the identification of the service in the identified license matches the identification of the service in the response.

Trusted license removal in a content protection system or the like

A computing device segregates licenses for corresponding content according to relatively short lived licenses for relatively short lived content and relatively long lived licenses for relatively long lived content. The computing device stores the relatively short lived licenses in a more temporary and volatile license store, and the relatively long lived licenses in a more permanent and non-volatile license store. Thus, the relatively short lived licenses are deleted when the temporary license store is turned off and do not create disorder in the permanent license store.

Rights management system for streamed multimedia content

A method is provided for a computing device to copy (burn) a playlist of tracks to a portable medium, where each track corresponds to a piece of digital content. At least one of the pieces of content is rights-management (RM) protected and accordingly is burned to the portable medium only in accordance with a corresponding digital license.

Playlist burning in rights-management context

A host securely transmits content to a peripheral thereof. The peripheral has a symmetric key (PK) and a copy of (PK) encrypted according to a public key (PU) of an entity ((PU(PK))). In the method, the host receives (PU(PK)) from the peripheral, and sends (PU(PK)) to the entity. The entity has a private key (PR) corresponding to (PU), applies (PR) to (PU(PK)) to obtain (PK), and sends (PK) back to the host. The host receives (PK) from the entity, encrypts at least a portion of the content according to (PK), and transmits the encrypted content to the peripheral. The peripheral may then decrypt the encrypted content based on (PK). A bind key (BK) encrypted by (PK) ((PK(BK))) may accompany (PU(PK)), where the content is to be encrypted according to (BK). Thus, (PK) is not revealed to the host.

Secure transmission of digital content between a host and a peripheral by way of a digital rights management (DRM) system

A sequence of content keys are shared between a receiver of pieces of digital content and a computing device upon which the content is to be rendered. The receiver encrypts each piece of content according to a corresponding content key in the sequence and forwards the encrypted content to the computing device and the computing device decrypts the encrypted content according to the corresponding content key. The receiver initially transmits to the computing device an initialization digital license with an initial content key (CK) therein. Each of the receiver and the computing device derive a new content key (CKx) in the sequence from the initial content key (CK()) in the sequence on an as-needed basis and in a coordinated fashion. The initialization license is required only once for the sequence of content keys, and the receiver need not explicitly communicate (CKx) to the computing device for each piece of content.

A method of registering network devices in a digital rights management system (DRMS) includes receiving a digital certificate transmitted by the network device requesting registration and verifying the validity of the certificate. The DRMS may then send cryptographic information to the applying network device. The network device may be authorized for registration via a user interface to the DRMS. The DRMS may conduct a proximity test to determine of the network device is proximate to the DRMS. If the certificate is validated, authorization is received, and the proximity test indicates that the network device is proximate to the DRMS, the network device may be registered. A registered network device is then authorized to play protected digital content.

Method and system for device registration within a digital rights management framework

A request to render encrypted content is received and a chain of licenses corresponding to the content is located. The chain includes a leaf license linked to the content at one end of the chain, a root license at the other end of the chain, and any intermediate licenses therebetween. The leaf license and any intermediate licenses in the chain are each bound to the adjoining license in the chain toward the root license, and the root license is bound to an owner of a private key (PR-U). For each license in the chain, the license is verified and it is confirmed that the license allows the content to be rendered. A decryption key is obtained from the leaf license based on application of (PR-U) to the root license, the obtained key is applied to decrypt the encrypted content, and the decrypted content is rendered.

Growing community of inventors

Redmond, WA, United States of America

Brian Patrick Evans