Microsoft Technology Licensing, LLC

Quintin Swayne Burns

Vishal Sood

John Carl Simmons

Douglas Charles Shimonek

Steven C Peterson

Ashish Chawla

Mingfei Yan

Dawei Wei

Adrian J Oney

Scott J Fierstein

Robert Kilroy Hughes, Jr

Bryan R Born

Dennis N Bromley

Paul England

Clifford Paul Strom

Sumedh N Barde

Ning Lin

Samuel John Wenker

Andrew Lee Jenks

Alexander McKelvey

Kevin M Kane

Jr Hughes Robert Kilroy

Lightweight mechanisms provide a way to assert provenance when live streaming media content and establish provenance upon playback. For example, a provenance claim generator generates a key pair including a live-stream private key and live-stream public key. The claim generator signs, with a long-term private key reliably associated with a sender, manifest metadata including the live-stream public key, thereby producing a manifest signature. During live streaming, the claim generator signs respective portions of media content with the live-stream private key, producing portion signatures for the respective portions. A provenance claim validator receives the manifest signature and manifest metadata. The claim validator verifies the manifest metadata using a long-term public key (reliably associated with the sender) and the manifest signature. During live streaming, the claim validator verifies the respective portions of the media content using the live-stream public key and the portion signatures for the respective portions.

Asserting and establishing provenance of media content during live streaming

Described herein are various technologies pertaining to delivery of token-authenticated encrypted data. Content descriptor(s) (e.g., playlist(s)) can be modified to facilitate exchange of a token for a decryption key for browser(s) that do not provide logic to manage a flow of the token.

Modifying a content descriptor to facilitate delivery of token-authorized encrypted data

Supporting a plurality of content protection systems in a single container file. The protection systems share an encryption method which is accessible from a sample encryption box in the file. Each of the protection systems stores, in a protection system header box, information for decrypting the content in accordance with the corresponding protection system. In some embodiments, separate protection system header boxes in the file correspond to each of the protection systems. By using the common encryption method and sharing encryption expressions across the protection systems, the multiple content protection systems are supported in the file without creating additional copies of the content. In some embodiments, aspects of the disclosure extend the International Organization for Standardization (ISO) base media file format to support multiple digital rights management (DRM) systems in the single container file.

Multiple content protection systems in a file

Encrypted content streaming is provided by a method comprising holding an encrypted content stream that is cryptographically encrypted from a content stream with a content key, and holding an encrypted content key that is cryptographically encrypted from the content key with one or more blackout encryption keys. Each blackout encryption key is paired to a blackout decryption key corresponding to a specific audience, and each blackout decryption key is obtainable by audiences other than the specific audience corresponding to the blackout decryption key. The method further comprises serving the encrypted content stream to the plurality of different audiences. The encrypted content stream is embedded with a leaf license comprising the encrypted content key, and the encrypted content key is cryptographically decryptable by audiences having the one or more blackout decryption keys paired to the one or more blackout encryption keys.

Encrypted content streaming

Content license storage is provided by holding, in a temporary license store on the content consumption device, a plurality of content licenses for a plurality of content streams, wherein each content license of the plurality of content licenses includes a removal date. The method further includes for each content license of the plurality of content licenses corresponding to a content stream of the plurality of content streams which is designated for archived playback, copying the content license into an embedded license store within the content stream to form an archived content stream. The method further includes removing one or more of the plurality of content licenses held at the temporary license store if the removal date included in the content license has been reached, while leaving each content license stored within an archived content stream even if the removal date has been reached.

Content license storage

Encrypted content streaming is provided by a method comprising holding an encrypted content stream that is cryptographically encrypted from a content stream with a content key, and holding an encrypted content key that is cryptographically encrypted from the content key with one or more intermediate encryption keys. The method further comprises serving the encrypted content stream to a plurality of content consumption devices, wherein the encrypted content stream is embedded with a leaf license comprising the encrypted content key, and wherein the encrypted content stream is cryptographically decryptable by a content consumption device having a scalable root license providing one or more intermediate root keys from which the content consumption device derives the one or more intermediate decryption keys paired to the one or more intermediate encryption keys.

A protocol is provided that permits a third-party key issuing entity to have its issued keys protected by an unrelated key protecting entity. In at least some embodiments, a trusted key protecting entity is injected, in a sense, in a conversation between the third-party key issuing entity and a client to which one or more keys are distributed. The trusted key protecting entity is able to apply various protections which, in at least some embodiments are unknown to the key issuing entity, to a distributed key which can then be used by the client to access protected content.

Protocol for protecting third party cryptographic keys

This document describes tools that enable a computing device to receive an update to content management software. The tools also enable the computing device to generate new public and private keys without the use of a key server.

Secure local update of content management software

In accordance with one or more aspects of the separating keys and policy for consuming content, content has a corresponding leaf license, and the leaf license has one or more associated root policy addenda. Each root policy addenda includes policy identifying when it is permissible to decrypt and consume the content, but excludes a content key to decrypt the content. The content can be decrypted and consumed only if the policy identifies that it is permissible to decrypt and consume the content.

Growing community of inventors

Fort Mill, SC, United States of America

Quintin Swayne Burns