Microsoft Technology Licensing, LLC

Kedarnath Atmaram Dubhashi

Alexandre Vicktorovich Grigorovitch

Patrik Schnell

Anand Paka

Clifford Paul Strom

Jeffrey B Hamblin

Simon Skaria

Robert P Reichel

Richard Bruce Ward

Jonathan D Schwartz

Satvir Randhawa

Mark L Beaubien

Praerit Garg

Adrian J Oney

Jason Todd Hunter

Sambavi Muthukrishnan

Hany Farag

Yu Lin Sie

Anne C Hopkins

James Morris Alkove

Majd Bakar

Kenneth S Reneris

Thomas C Jones

Bhalchandra Pandit

Sumedh N Barde

Klaus U Schutz

John J Lambert

Peter T Brundrett

Stephen P DiAcetis

John A Bocharov

Gilles Khouzam

Daniel Rosenstein

Kiran Kumar

Reid Joseph Kuhn

Alex McKelvey

Mark E Paley

Vishnu A Patankar

Douglas Steedman

Jim E Thatcher

Vikram Mangalore

Alex Mckelvey

Jason T Hunter

Techniques enable creation of a preview license for digital content. In some instances, the preview license indicates that it allows a content-consuming device to consume less than all of the content. This preview license may create a list specifying multiple portions of the digital content that the content-consuming device may consume. These techniques may also present to a device user an offer to purchase rights to consume all of the digital content after consumption of the preview-licensed portion(s). In other instances, a content server may embed the preview license into a content package that contains the digital content, allowing the server to distribute the package to multiple devices. In still other instances, the preview license may be bound to a domain rather than to individual devices. This allows member devices to share the digital content and the preview license, such that each member device may enjoy the preview experience.

Content preview

A system is disclosed for providing trusted third-party management of user device domains in a digital rights management environment. The system includes a plurality of content providers that distribute digital content items via user accounts having associated user device domains. The user device domains are managed by an independent domain manager. The domain manager includes a device registrar which is operative, for a given user device domain, to receive a request to add a device to the user device domain. If the request is grantable, a domain controller of the domain manager is operative to cause a domain private key to be transmitted to the device being added to the user device domain. The domain private key is usable at the device to decrypt a content key which was previously released to the user device domain for decrypting protected digital content.

Domain manager for extending digital-media longevity

A method to identify a child process to a parent process in an operating system includes obtaining a token and login identifier from the operating system. The parent process creates a remote procedure call communications endpoint to communicate with the child process. Thereafter, a child process is spawned by the parent process. A child-initiated request to communicate with the parent process is then received by the parent process. In order to verify the identity of the child-initiated request, the parent process impersonates the child process and receives as identifier that identifies the requestor child process. The requestor process identifier and the spawned child identifier are compared. Based on the comparison, the parent process responds to the child-initiated request. In another embodiment, process identifiers are used by the parent process to verify the identity of a child process the requests communication with the parent process.

Trusted communications with child processes

Various embodiments for software application verification are disclosed. Software application verification applies digital rights management to applications that run protected content on a playback device. In this way, protected content may be provided to approved applications and withheld from applications that have not been approved to run the protected content.

Software application verification

This document describes tools capable of enabling cloud-based movable-component binding. The tools, in some embodiments, bind protected media content to a movable component in a mobile computing device in a cryptographically secure manner without requiring the movable component to perform a complex cryptographic function. By so doing the mobile computing device may request access to content and receive permission to use the content quickly and in a cryptographically robust way.

Cloud-based movable-component binding

Various embodiments enable so-called extended data to be added to a signed digital certificate without having a private key of a Certification Authority available. In at least some embodiments, a request to add extended data to a digital certificate generated by a certificate authority is received from a client device. The digital certificate includes a signed first portion, and an unsigned second portion that includes reserved empty spaces that are reserved for the extended data. The extended data is added to the unsigned second portion. the extended data includes a client ID associated with the client device. The unsigned portion of the digital certificate is signed after the extended data is added.

Extended data signing

A content license associated with unencrypted digital content is generated, the content license including both an identifier of the unencrypted digital content and a content policy. At a user device, a determination is made as to whether the content license corresponds to particular unencrypted digital content. Use of the particular unencrypted digital content by the computing device is permitted in accordance with the content policy if the content license corresponds to the particular unencrypted digital content. However, use of the particular unencrypted digital content by the computing device based on the content license is prohibited if the content license does not correspond to the particular unencrypted digital content.

Associating policy with unencrypted digital content

This document describes techniques and apparatuses enabling application of digital rights management (DRM) to media streams. In one embodiment, three license levels are used to protect numerous television channels without undue use of computing resources.

Digital rights management for media streams

Systems, methods, and/or techniques ('tools') for binding content licenses to portable storage devices are described. In connection with binding the content licenses to the portable storage devices ('stores'), a host may perform authentication protocols that include generating a nonce, sending the nonce to a store, and receiving a session key from the store, with the session key being generated using the nonce. The store may perform authentication protocols that include receiving the nonce from the host, generating a random session key based on the nonce, and sending the session key to the host.

Binding content licenses to portable storage devices

Techniques enable building a collection of data that defines an asset, with the data possibly having differing data types. These techniques are then capable of assigning arbitrary policy to that asset, regardless of which data types are present within the asset. In addition, these techniques enable packaging of this first asset with one or more additional assets in a self-contained envelope. Each asset within the envelope may similarly include data of differing data types. Furthermore, each of these assets may be assigned a policy that may be different than the policy assigned to the first asset. This envelope, or a collection of envelopes, may then be provided to a content-consuming device to consume the assets in accordance with each asset's specified policy.

Managing digital rights for multiple assets in an envelope

Various embodiments enable so-called extended data to be added to a signed digital certificate without having a private key of a Certification Authority available. In at least some embodiments, a digital certificate can be issued and signed off line by the Certification Authority, and then later extended data can be added and signed using another key, whose public key was earlier embedded and signed in the certificate.

Various mechanisms are provided for the lockdown of an item store. For example, a method is provided that comprises of disabling access to a relational engine for a set of users associated with a filing system utilizing the relational engine to manipulate data in an item store. Following such disabling of access, an exception is created by allowing access to the relational engine for users of the filing system based on a set of privileges the users have been assigned. The disabling of access can be accomplished by removing system users from ownership roles, and the allowing of access can be accomplished by providing certificates to users that have associated set of privileges granted to the users.

Relational lockdown for an item store

Various embodiments utilize a third party, such as a trusted third-party, to perform DRM operations such as 'move' operations. In at least some embodiments, the trusted third-party is utilized for both 'move' operations as well as local content access such as playback and the like. In at least some embodiments, a third-party maintains a database that includes an association of clients, content, and move version numbers. A client&#x2014;termed a &#x201c;source client&#x201d; maintains at least a move version number locally in a secure fashion. The version number is incremented each time the source client performs a move operation. Both the source client and the third-party increment the version number each time a piece of content is moved. When the client attempts to perform a move operation, it contacts the third-party to ascertain the third-party's move version number. If the move version numbers match and the source client owns the license/content, then, in at least some embodiments, a move operation is permitted.

Using trusted third parties to perform DRM operations

Growing community of inventors

Redmond, WA, United States of America

Kedarnath Atmaram Dubhashi