Source: http://www.google.com/patents/US20030163428?dq=6,606,102
Timestamp: 2014-08-30 23:05:07
Document Index: 492809939

Matched Legal Cases: ['art 120', 'art 122', 'arts 208', 'arts 208', 'arts 210', 'arts 208', 'arts 210', 'arts 212', 'art 120', 'arts 208', 'art 122', 'art 216', 'art 120', 'art 122', 'art 120', 'art 122', 'art 120', 'art 122', 'art 120', 'art 122']

Patent US20030163428 - System for controlling access and distribution of digital property - Google PatentsSearch Images Maps Play YouTube News Gmail Drive More »Sign in<nobr>Advanced Patent Search</nobr>PatentsA method and device are provided for controlling access to data. Portions of the data are protected and rules concerning access rights to the data are determined. Access to the protected portions of the data is prevented, other than in a non-useable form; and users are provided access to the data only...http://www.google.com/patents/US20030163428?utm_source=gb-gplus-sharePatent US20030163428 - System for controlling access and distribution of digital propertyAdvanced Patent SearchPublication numberUS20030163428 A1Publication typeApplicationApplication numberUS 10/219,890Publication dateAug 28, 2003Filing dateAug 16, 2002Priority dateJan 11, 1996Also published asCA2242596A1, CA2242596C, EP0880840A1, EP0880840A4, US5933498, US6314409, US20010021926, US20030172034, US20090222673, US20140123218, WO1997025798A1Publication number10219890, 219890, US 2003/0163428 A1, US 2003/163428 A1, US 20030163428 A1, US 20030163428A1, US 2003163428 A1, US 2003163428A1, US-A1-20030163428, US-A1-2003163428, US2003/0163428A1, US2003/163428A1, US20030163428 A1, US20030163428A1, US2003163428 A1, US2003163428A1InventorsPaul Schneck, Marshall AbramsOriginal AssigneeVeridian Information Solutions, Inc.Export CitationBiBTeX, EndNote, RefManReferenced by (7), Classifications (50), Legal Events (9) External Links: USPTO, USPTO Assignment, EspacenetSystem for controlling access and distribution of digital propertyUS 20030163428 A1Abstract A method and device are provided for controlling access to data. Portions of the data are protected and rules concerning access rights to the data are determined. Access to the protected portions of the data is prevented, other than in a non-useable form; and users are provided access to the data only in accordance with the rules as enforced by a mechanism protected by tamper detection. A method is also provided for distributing data for subsequent controlled use of those data. The method includes protecting portions of the data; preventing access to the protected portions of the data other than in a non-useable form; determining rules concerning access rights to the data; protecting the rules; and providing a package including: the protected portions of the data and the protected rules. A user is provided controlled access to the distributed data only in accordance with the rules as enforced by a mechanism protected by tamper protection. A device is provided for controlling access to data having protected data portions and rules concerning access rights to the data. The device includes means for storing the rules; and means for accessing the protected data portions only in accordance with the rules, whereby user access to the protected data portions is permitted only if the rules indicate that the user is allowed to access the portions of the data. Images(27) Claims(80)
[0217] Access Cost=(unit, price) [0218] Each time a unit of data (e.g., book, volume, chapter, page, paragraph, word, map, record, song, image, kilobyte, etc.) is opened, a cost of price is incurred. [0219] Print Cost=(unit, price) [0220] Each time a unit (e.g., page, file, image, etc.) is printed, a cost of price is incurred. [0221] Copy/Transmit Cost=(unit, price) [0222] Each time a unit (e.g., volume, file, record, page, kilobyte, image, etc.) is output, a cost of price is incurred. [0223] Execute only [0224] The user may execute a program but may not read, print, modify or copy it. This rule protects against disclosure of an algorithm. [0225] A permission list consists of rules governing the qualities and quantities of access made available by the owner to a particular user or group or class of users, and defines those ways in which the user may (and may not) interact with the owner's data/information. An encrypted permission list (for example, encrypted rules 124 in FIG. 2) is made available by the owner to the user, generally in exchange for fees (in the commercial domain) (for example, payment 110 in FIG. 1). The system denies the user direct access to manipulate the permission list, although in some cases it may allow the user to view the permission list. (The permission list may include rules governing access to the permission list itself). Use of a permission list may be limited to a particular computer system, a particular token (such as a smart card), a user-supplied password, or any combination of these or other items. [0226] At the discretion of the intellectual property (data) owner, a permission list may also be valid for future releases of the data. This allows, for example, a software owner to plan for future releases that resolve problems discovered in an initial software release. In this example, the user of a particular version of a program, for instance, Version 6, might be allowed to use a subsequent version of the program, version 6.1, without further payment and without needing to obtain a new permission list or license. One who had not already licensed Program Version 6 would be required to purchase a new permission list/license in order to use Program Version 6.1. [0227] A permission list may authorize and permit the user of intellectual property to create a derivative product for which the original owner may or may not have rights. In the case of a derivative product for which the owner of the original intellectual property has no rights, the owner of the derivative intellectual property can unilaterally issue a permission list governing use of that intellectual property. [0228] Program execution occurs when a computer device follows a series of steps, or instructions, expressed in some symbology. The program may be linear, with one step always following its predecessor without variation, or the program may involve branching based on comparison of variables related to internal or external events and status. In the field of computer science a distinction is sometimes made according to the time at which the instructions comprising the program are translated into the computer's machine language in order to control the operation of the computer. Accordingly, terms such as assembly, compilation, and interpretation are used. This distinction is not important with respect to the present invention. The term execution is used herein to refer to all forms of program execution. [0229] Controlling Primary Distribution [0230] As noted above, digital information is transmitted openly. Accordingly, the data are typically distributed in an encrypted form. [0231] Enforcing an Authorized User List [0232] In some cases, it is useful to have a rule which controls access to data for certain specific users or classes of users. For example, data may only be accessible to people over the age of eighteen, or to people having a rank greater than or equal to that of captain, or to managers have a security clearance greater than top-secret. In these cases, each user can be provided with a separate set of rules for that specific user. In other words, each user can be provided with a unique set of rules. However, if the status of a user changes, then the rules for that user have to be changed. Accordingly, it is useful and convenient to have the rules be parameterized based on the status of the user and then have the user's status provided to the access mechanism 114 in a secure fashion. [0233] The invention can be used in combination with software and other identification technology (for example, biometric sensors) to limit data access to users that possess an appropriate physical or logical token (for example, a dongle or password), or personal characteristic (for example, a fingerprint pattern). The secure hardware (via tamper detection) eliminates the potential for modifying and subverting the identification software. [0234] An embodiment having such a configuration is shown in FIG. 14, wherein the access mechanism 114 is connected to an external secure device 182 in order to obtain the user's status. Channel 183, connecting the secure device 182 and the access mechanism 114 is preferably a secure channel (within the security boundary 167), however, if it is insecure, the device 182 must send information to the access mechanism 114 in a protected (e.g., encrypted) manner. [0235] Controlling Access and Use [0236] The invention can restrict the qualities or quantities of access to data in any manner that can be calculated or enumerated. A non-exhaustive, representative set of examples is given below. [0237] Access Control Qualities [0238] (a) Local Display (for example, display of data on the computer's monitor). [0239] (b) Printing (i.e., fixation in a form intelligible to a person). [0240] (c) Copying (i.e., fixation on an electronic medium such as a disk or tape). [0241] (d) Transmission (see below regarding controlling secondary distribution). [0242] (e) Modification (i.e., changes to a copy of the primary distribution). [0243] Access Control Quantities [0244] (a) Number of read-accesses (where �read access� refers to any kind of examination or retrieval of data/information). [0245] (b) Size of read-access. [0246] (c) Expiration date. [0247] (d) Intensity of access (number/total volume of read-accesses in a unit of time). [0248] (e) Resolution of access (for example, in the context of a map this would be the maximum scale allowed; for sensor data this would be the precision (number of bits) returned to the user). [0249] (f) Delay (Accesses are permitted to data after a delay of n time units. This allows different user groups to view the same dataset with different results to queries. For example, a stock broker would be able to view the latest data, while a customer, paying less for the service, might receive data that are delayed by 15 minutes.) [0250] Access Control Granularity [0251] The above access control policies can be applied differently to different portions of the intellectual property. For example, a document's chapters might be controlled at different levels of quantity and quality; a map's information might be controlled differently at different latitudes and longitudes; portions of an image may be restricted in availability, resolution, and the like. [0252] Controlling Secondary Distribution [0253] The invention provides absolute control of secondary distribution of data (for example, preventing or restricting potential use). [0254] Transmission of (an unencrypted copy of) the primary distribution data (either to a network or to an output device such as a tape or disk) can only be effected when the system, acting under the rules embodied in the owner's permission list, allows external output. Denial of permission to transmit an unencrypted copy may result in no output or may result in transmission of an encrypted copy (for which the recipient must then negotiate permissions in order to use). Alternately, denial of permission to transmit may result in the transmission of random data, thereby denying the user knowledge of whether or not encrypted data was transferred. [0255] Since all storage of data on internal non-volatile memory devices (for example, disks, flash memory, and the like) is encrypted, this ensures that a physical attack on the system will not result in compromise of plaintext. [0256] Controlling Printing or Display [0257] Printing or display of data is controlled in a manner similar to that used for controlling secondary distribution. One option is to disallow the ability to send particular information to a printer or display If printing or display is allowed, the data stream to the output device is encrypted to ensure that an unauthorized user cannot intercept data sent to an external printer or display (that is, to a printer or display outside the tamper-detect protected enclosure). This necessitates that the receiving device contain a decryption subsystem. Thus, as shown in FIG. 8, data from access mechanism 114 via I/O controller 165 to either the controlled printer 178 or the controlled display 180 is encrypted on channels 174 and 176, respectively. [0258] As discussed above when addressing the threat of capture of the output signal, an encryption mechanism is used for protecting data transfers to printer or display so that, if the data owner wishes, printing or display may be restricted to a specific printer or display device. [0259] Instead of disallowing printing or display, these functions may be allowed with limitations as imposed by the owner. For example, output might contain a header/footer on each page indicating the identity of the authorized user; a watermark might be printed in the background; or other identifying material might be placed on each image. Of course, the data stream would be encrypted (as above) to prevent interception. [0260] Document marking and identification techniques can be used to discourage the illicit copying of documents distributed in either paper or electronic form. The exact form of printer characters as well as line and word shifting have been used for document marking and identification (�Document Marking and Identification using both Line and Word Shifting,� Low, S. H., et al. 1995 INFOCOM Proceedings, IEEE, pp. 853-, 1995). [0261] One of the major technical and economic challenges faced by electronic publishing is that of preventing individuals from easily copying and illegally or without authorization distributing electronic documents. Cryptographic protocols used to discourage the distribution of illicit electronic copies are described in �Copyright Protection for Electronic Publishing over Computer Networks,� Choudhury, A. K., et al., IEEE Network, pp. 12-20, May-June 1995. [0262] Preferably, each controlled peripheral device (e.g., controlled printer 178 or display 180) is provided with an access mechanism which allows the device to process data it receives. This allows the data being sent to a controlled peripheral device from a system using an access mechanism to be treated as either a copy of data or a derivative work that is being sent to another user (that happens to be a peripheral). In other words, if a peripheral device contains an access mechanism, the data sent to the device can be packaged data. Using this approach, requires that the receiving access mechanism (the peripheral's access mechanism) may include the rules (permission list(s)) in order to obtain the key needed to decrypt the data in order to print or display them (or do whatever the peripheral does with data). If no permission list is included and the data are encrypted by the printer's public key, the printer's access mechanism decrypts the data and prints them (just as they would have been printed had the unencrypted data stream been received by a standard printer). [0263] The access mechanism in the controlled peripheral device need not be a full system whenever the peripheral device is limited in function, for example, to only printing or displaying data. The peripheral and its access mechanism subsystem must be in a tamper-detecting enclosure. [0264] As noted, it is envisioned that a computer or other device equipped with an access mechanism will be used with a controlled output device (printer or display) so equipped. If the data owner allows (via the rules) output (e.g., printing) to a controlled output device (e.g., printer) (equipped with an access mechanism), then there are two possibilities. The access mechanism in the user's computer can process any required payment and send the data, encrypted with the device's public key, to the printer or display for output. Alternately, the access mechanism processes the data as a derivative work (discussed below), packaging rules with the data, and the output device is responsible for separate payment (for example, allowing retention and multiple copies). [0265] In order to limit the number of copies output, a short time window is included in the rules so that the recipient cannot capture (record) the file and replay it multiple times to the output device. Additionally, the access mechanism in the output device can contain a relatively small non-volatile memory that would hold the checksum of a file that is not to be output again for a certain time period, say, for 15 minutes from the first output (and an output permission list in the rules would specify �n copies, only valid for 15 minutes from x to x+15�). [0266] In the case of standard output devices (non-controlled, i.e., without access mechanisms), data are provided unencrypted (to the extent that the rules permit and payment has been provided). [0267] Controlling Distributions of Derivative Works [0268] In many application environments where intellectual property is created it is common to include extracts from other intellectual property. Such environments include writing scholarly papers, reviews, regulations, etc. The intellectual property containing the extract is a so-called derivative work. The intellectual property from which the extract was copied is called the parent work. [0269] This invention controls the distribution of derivative works (that is, works created using information owned by another). Transmission of (an unencrypted copy of) a derivative work (to a network, to an output device such as a tape or disk, or to a printer or display device or the like) can only be effected when the system, acting under the rules embodied in permission lists created by each of the owners of any intellectual properties used in the derivative work, allows external output. Denial of permission to transmit an unencrypted copy may result in no output or may result in transmission of an encrypted copy (or, as noted above, may result in the transmission of random data). Use of an encrypted copy of a derivative work will, in general, require permissions from the owners of the derivative work as well as of the original works. The permission list associated with a work is incorporated into the permission list of any derivative work, either directly or by reference. License fees and restrictions imposed by the owner of a work are inherited by any derivative works. An n-th generation derivative work inherits the license fees and restrictions of each of its n−1 ancestors. If permission lists (rules) are incorporated by reference, the access mechanism ensures that the referenced permission lists (rules) are present (or it will deny access). [0270] For example, if printing of an original work requires a watermark, then printing of any derivative work (if allowed at all) will require a watermark. This monotonicity/cascading of restrictions (i.e., each generation of a work must be at least as restricted as the prior generation) ensures that a derivative work that is only trivially changed from the original does not escape restrictions imposed on the original. [0271] Creation of a derivative work for subsequent distribution requires an distributor 190 similar to distributor 102 shown in FIGS. 1 and 5. However, derivative work distributor 190 (shown in FIG. 15) includes an access mechanism 114 and can process, as input data, packaged data 108 a. The output produced by distributor 190 is packaged data 108 b which includes any rules (or references to rules) required by data which is derived from the input packaged data 108 a. The access mechanism 114 within distributor 190 incorporates a global rule which enforces the distribution of rules with derivative works. [0272] As noted earlier, the difference between the embodiments of the distributors 102 and 190, shown in FIGS. 1 and 15, respectively, is that the distributor 102 shown in FIG. 1 does not include an access mechanism 114. Accordingly, the distributor 102 deals only with newly created data (that is, with non-derivative data). The embodiment shown in FIG. 15 includes that of FIG. 1, and can also deal with input of protected data (previously packaged by a distributor). The embodiment of the system shown in FIG. 1 can be implemented purely in software, whereas the embodiment shown in FIG. 15 requires some hardware implementation. [0273] It is envisioned that a standard computer, equipped with an access mechanism 114 will function as an authoring/distribution system. This allows all computer users to become authors and to incorporate previously published material into derivative works. [0274] The rules associated with the parent work determine whether creation of derivative intellectual property is permitted, as well as the inheritance rules for incorporating the rules of the parent into the derivative work. Note that the rules derived from the parent apply only to the extract and that these rules applying to the extract need not be identical to the rules of the parent. The rules applying to the extract are specified by the owner of the parent, not by the creator of the derivative work. [0275] For example, the rules applying to the extract might require payment to the owner of the parent for use of the derivative work containing the extract. If the creator of the derivative also required payment, the user of the derivative would make payments to two owners for use of the derivative. In an automated system the details of such multiple payments would be invisible to a user. [0276] This invention enables such payment arrangements that would otherwise be prohibitively difficult and complex. [0277] Another example relates to integrity and moral rights of the owner of the parent. The owner might extract was made without alteration that certain related information were included (for example, to prevent the extract from being taken out of context). [0278] Data extracted from the parent comes with rules already attached or associated. These rules propagate into the derivative, but are applicable only to the extract. Extracts from the same parent may or may not share rules. Extracts from multiple parents may result in multiple rules applying to different extracts. As noted, a derivative work may contain references to data and rules rather than the actual data and rules. For certain commercial products it may be desirable to have the final packaged data 108 b be fully self-contained. Accordingly, the packaged data 108 b output from this distributor 190 may require further processing in order to optimize it for commercial distribution. Such optimization might include, for example, obtaining and including copies of all rules and data referenced in the package. [0279] Extract Authentication [0280] Digital signatures authenticate digital information by providing proof that information received is precisely that which was sent, with no changes. This system provides a similar capability to authenticate extracts (quotes) of information. [0281] Application environments, such as providing a legal trail of evidence or authenticating that a quotation is accurate, are enhanced by the ability to prove that the information has not been subject to unauthorized alteration. [0282] Authenticated extraction is implemented by creating an extraction editor, that runs in the access mechanism 114. This extraction editor, possibly under human direction, can extract selected text but is unable to change the extract. When extraction is complete, the access mechanism 114 digitally signs the extract with a digital signature. This digital signature includes identification of the specific computer in which the access mechanism 114 is executing as well as identification of the specific extraction editor used. [0283] The extraction editor can, optionally, be permitted or required to insert ellipsis to indicate deletions, and certain specified insertions, such as, for example, �[sic],� might be allowed. [0284] In another embodiment, a so-called hyperlink can be used in newly created data to indicate the insertion location of a quotation. When an output operation is performed, the access mechanism 114 creates a separate quotation, with its own checksum and digital signature. Any recipient of data containing the hyperlink can verify that the contents of the hyperlink were captured by access mechanism 114 and delivered unchanged. [0285] Controlling Use of Executable Software [0286] Control of Primary Distributions [0287] The invention enables the creator of executable software to restrict the use of the software to only those who have acquired permissions for various of its capabilities. Executable software will be distributed in encrypted form, externally treated as data, as described above. In general, execution of a program can be controlled for multiple purposes in a number of ways. Purchase of a license to execute software can be evidenced by a cryptographically protected certificate which is decrypted internally by the access mechanism 114. The executable software can check for the presence of the certificate, or for permission keys or other information contained in the certificate, once or many times during execution. Since the algorithm embodied in an executable program may be valuable intellectual property, the access mechanism 114 can prevent a licensee from reading, copying, or modifying unencrypted executable code. In order to prevent disclosure of the unencrypted executable code, it is kept wholly within the security perimeter of the access mechanism 114 for execution. [0288] Elimination of the Distributor (Middleman) [0289] The invention enables the executable software owner to make copies easily available on a network server in encrypted form. Users may download the executable software and then separately purchase the rights to utilize the executable software. Thus, a standard purchase of software may be accomplished electronically, dealing with the owner's electronic commerce system. Thereby, the entire process of acquiring the executable software package and then purchasing the rights to use it may be effected without going through a distributor. [0290] Offering discounted upgrades to software licensees is also simplified. When a licensee claims eligibility for a discounted upgrade the executable software owner can check the record of purchase of rights for the prior version of the product. Once again, the entire process can be automated. [0291] Simplification of Configuration Management [0292] The executable software owner can elect to make available on a network server product improvements that operate with existing permission lists, thus immediately releasing product improvements and fixes. [0293] Multiple levels of product capability can be incorporated into a single release and can be selectively enabled by different permission lists. The tailoring of different distributions, with differing capabilities is no longer necessary. [0294] Active Control of Capability of Executable Software [0295] The invention's control of distribution of data or information (that are not executable software) may be characterized as passive or transparent in that no changes are required in the data or information for them to be protected. The permission list that controls their use may be separately created, packaged, and supplied. [0296] The control of primary distribution of data or information as well as the secondary distribution or distribution of modifications (derivatives) of data or information is passive. However, the invention's control of executable software capability is active and requires that the executable software developer use the programming interface provided by the system. At each point where the developer requires authorization, the executable software requests-a permission-check. As a result, the process of FIG. 16 is performed. If the requisite authorization is received, the function of the software is performed. If authorization is denied, an alternative action is chosen. The system may itself take certain actions including, for example, terminating a program or erasing data, when authorization is denied. As executable software is distributed in encrypted form, it can only be decrypted and executed (used) on a machine employing the access mechanism of the present invention. [0297] With reference to FIG. 16, first the operation is identified (step S1600) and the rules are checked (step S1602). Next it is determined whether the rules permit the operation (step S1604). If the operation is not permitted (or it is permitted but payment is not acceptable (step S1606)), then it is determined whether any system action is required (step S1608). If no system action is required, the return code for �not allowed� is set and control is returned (step S1610), otherwise the system action is performed (step S1612) after which the return code for �not allowed� is set and control is returned (step S1610). [0298] If the operation is permitted (step S1604) and payment is acceptable (step S1606), then the return code for �allowed� is set (step S1616). [0299] The invention can be used to restrict the qualities or quantities of executable software execution in any manner that can be calculated or enumerated. Representative non-exhaustive examples of restrictions are given below. These restrictions may combined in any fashion. [0300] Levels of Capability [0301] Access to Specific Parts of Code or Features [0302] Control of sizes or quantities that can be handled. For example, files may be allowed up to a specific size; complexity or accuracy of a solution may be limited, number of parameters or data points may be restricted, etc. [0303] Quantitative Modifiers of Levels of Capability [0304] Control of expiration dates, time of use, number and frequency of uses and permitted users. For example, rights to use of a file of data (whatever it contains) may expire on a certain date; access to certain data may be limited to certain times of day, days of the week or specific dates; a user may only be allowed to access certain data a specified number of times (or a specified number of times per day); or access to some data may be restricted based on the identity of the user. [0305] Control of Secondary and Derivative [0306] Executable Software Distributions [0307] This is handled in the same fashion as are data files, as described above. [0308] Control of Executable Software as a Module of Other Executable Software [0309] When protected executable software is incorporated into or used by other executable software on the system for which it was licensed, any limitations on its execution are maintained in the new context. [0310] Restricting Use to Certified Software [0311] The access mechanism 114 can be factory configured to restrict operation only to such software as is certified (e.g., by using a digital signature to ensure that the software was received unaltered from a certified source). Other contemplated applications include key escrow (also called �data recovery�) systems (described below), systems for counting election ballots, systems for exchanging cryptographic data or algorithms, and systems for safeguarding financial, medical, or other personal data. Further, a system employing an access mechanism may be used to ensure that such software is not modified after being received or accessed for execution. [0312] Process Control [0313] Computer control of processes is the basis for automation and quality control in many industries. This technology extends into various specialties such as computer-aided manufacturing, control systems engineering, concurrent engineering, expert systems, intelligent sensors, just-in-time manufacturing, programmable logic controllers, robotics, robotic programming languages, and visualization techniques in engineering. [0314] Formula, processes, procedures, and techniques may convey product differentiation, aesthetic and functional innovation, and increased cost-effectiveness. The computer programs and data involved in process control may constitute valuable intellectual property. The mechanisms of the present invention permit such data to be stored in process-control computers, transmitted to suppliers and subcontractors and otherwise employed without unauthorized disclosure, substitution, or modification. [0315] The permissions associated with process control data may, for example, allow execution only�reading or observing the data would be prohibited. Execution may be restricted to specific equipment and to specific times. In general, the process controller is external to the equipment implementing the process. Hence, communication between the process controller and the process equipment must be cryptographically protected. Like the access mechanism in a controlled computer peripheral discussed herein, the access function in the process equipment need not be a full system whenever the peripheral device is limited and can not output data. [0316] Key Escrow (Data Recovery) Systems [0317] This system allows a provider of key escrow cryptographic executable software to require, by using a rule, certification that a key has been installed and deposited with a specified certification authority in order for the executable software to function. The access mechanism ensures the integrity of executable software that uses cryptographic executable software (whether or not key escrow), guarding against change or replacement. [0318] Control of Classified Data [0319] The invention can be used to support limitations on the (primary and secondary) distribution of data, access to data, and distribution of derivative data where the data are classified. Similarly, the execution of classified programs, or programs operating on classified data may be controlled by the system. [0320] Ensured Issuance of Receipts [0321] This system can be used to ensure that a receipt is issued under a number of circumstances, as demonstrated by representative examples given below. A software program (or electronic mail message) may request that a receipt be issued whenever it is loaded or executed (or when a mail message is received); a receipt may be issued when a mail message is read for the first time; or a program will not be loaded or executed (or mail opened for reading) unless the user first agrees to allow a receipt to be issued. [0322] Ensuring Privacy [0323] This system can be used to ensure privacy of sensitive records in a database. Examples include financial, census, medical, and political databases and the like. The system can allow inquiries that provide statistical summaries but do not reveal information about individuals. The rules would be used to limit the queries that might be posed. [0324] Owner Control/Privileges [0325] At the time of purchase the identity of the owner may be stored within the access mechanism. The access mechanism may allow the owner to place a global set of rules (a global permission list) in the mechanism. These global rules could control, for example, hours of access (e.g., when the computer might be operated) based on a clock within the access mechanism or an external time reference with which the access mechanism communicates; acceptable software which can be run using the access mechanism (i.e., a list of those software products that would be allowed to be used, thus enforcing a system administrator's configuration control rules); user and-password lists, and the like. A user can thereby customize a particular access mechanism. [0326] The rules may also include or specify certain programs to be run under certain conditions. For example, if the rules specify that all printed output must contain a watermark, the rules might also provide the watermark generating program. In these cases, the programs are either pre-loaded into the access mechanism 114, or are loaded when needed. These programs will then be executed when the corresponding rules or functions are invoked. For example, various types of watermark programs can reside in the access mechanism 114, and, depending on the rules, the appropriate one of these can be selected and executed. [0327] Note that the data structures in FIGS. 2 and 6 depict logical organizations of the data. However, the actual physical format of the data depends on the type of the data as well as on the manner in which the data are to be used. Further, as noted above, the data package may be distributed in many ways, including networks, magnetic media, CD-ROM, semiconductor memory modules, and wireless broadcast and the like. In certain types of data distribution, e.g., continuous cable or wireless broadcast, a user may wish to begin accessing the data at an arbitrary point during its distribution. For example, if the data represent a broadcast movie which begins at 8 p.m., a particular user may only begin viewing at 8:30 p.m. In this case the user will have to initiate reception of the distribution while it is in progress. Accordingly, as shown in FIG. 17(a), in some embodiments, the packaged data are distributed in discrete packets 236 of data. The packets 236 include information 238 which enables a user to synchronize with the data distribution and further enables the user to begin accessing the data according to the rules. An example of such a packetized stream of data is shown in FIG. 17(b) wherein the stream 234 consists of discrete packets 236 of data, each packet containing synchronization data 238. [0328] Examples [0329] The following examples indicate some envisioned data and its packaging and rules. These examples are only intended to show some of the envisioned uses of the present invention, and are in no way intended to limit its uses. [0330] Books [0331] With reference to FIG. 18(a), a digital book 191 consists of an abstract 192, an index 194, and various chapters 196. Each chapter 196 comprises sections 198, and each section comprises text 200 and FIG. 202. The distributor can decide to package the book 191 such that the abstract 192 and the index 194 are available for browsing, but all other data are protected (encrypted). If the rules specify that the text is restricted in certain ways, then the packaged data structure 108 has the form shown in FIG. 18(b), wherein encrypted body part 120 includes all chapters 196, unencrypted body part 122 includes the abstract 192 and index 194, and encrypted rules 124 contains the encrypted version of the rules. [0332] Movies [0333] With reference to FIG. 19(a), a movie 204 can be made such that different parts of the movie combine to form either a trailer 206, a G-rated version (from G-rated parts 208), an R-rated version (formed from G-rated parts 208 and R-rated parts 210) or an X-rated version (formed from G-rated parts 208, R-rated parts 210 and X-rated parts 212). The packaged data structure 108 for this movie has the form shown in FIG. 19(b), wherein encrypted body part 120 includes all the G, R and X-rated parts 208-212, unencrypted body part 122 includes the trailer 206, and encrypted rules 124 contains the encrypted version of the age-based rules which control viewing of the various versions of the movie. [0334] In one embodiment, as shown in FIG. 19(c), a movie may be released with a main body 207 (having elements common to all three versions) and sections for each of the G, R and X-rated parts (208, 210, 212, respectively). Sections of the movie are selected from one of the rated parts, depending on the permission level (G, R or X) set. FIG. 19(d) shows packaged data structure 108 for such an arrangement. [0335] Software [0336] With reference to FIG. 20(a), a software program such as, for example, a word-processor 214 may include a controlled file access part 216, an editor 218, a grammar checker 220, and other features 222. The rules obtained by the user will govern the features of the software that may be used and the quantities of data that may be processed. The rules shown in FIG. 20(c) indicate that the user may not employ the grammar checker and may operate on no more than nine files. The packaged data structure for this software (without rules) 150 is shown in FIG. 20(b), wherein encrypted body part 120 includes the file access mechanism 216, the grammar checker 220 and various other functions 222, and unencrypted body part 122 includes the editor 218. The encrypted rules 124 are shown separately in FIG. 20(c). [0337] Documents [0338] With reference to FIG. 21(a), a document such as a legal document 224 comprises paragraphs 226 of words 228. In order to limit access to non-redacted portions of the document, the rules would require blacking out all redacted words. Accordingly, the corresponding packaged data structure is shown in FIG. 21(b), wherein encrypted body part 120 includes the redacted portions of the document and unencrypted body part 122 contains the non-redacted portions of the document. [0339] Map Image Data [0340] With reference to FIG. 22(a), map image data 230 may be available at three resolutions (high, medium and low). The rules may specify that people with a security clearance of greater than �top-secret� can view the data at high resolution, and all non-military users can only view the map data at low resolution. The corresponding packaged data structure is shown in FIG. 22(b), wherein encrypted body part 120 includes all data beyond low resolution (that is, those data required for medium and high resolution) and unencrypted body part 122 contains the low resolution data. [0341] Global Positioning System (GPS) Software [0342] With reference to FIG. 23(a), GPS software includes an output routine 232 which can produce output at various degrees of accuracy. The degree of accuracy depends on the security clearance of the user. A corresponding packaged data structure is shown in FIG. 23(b), wherein encrypted body part 120 includes the resolution calculation routine 232 and unencrypted body part 122 contains the other parts of the GPS software 230. [0343] Relationship Among Rule Sets [0344] In some embodiments, the access mechanism may be supplied with a set of rules built-in. In such an access mechanism the built-in rules might include rules that can or cannot be overruled (made less restrictive) by rules provided with packaged data. These initial rules can perform a number of functions and implement a number of policies. As examples, the access mechanisms provided in controlled output devices can include built-in rules (that cannot be overruled) which limit the device only to being an output device; or, the access mechanism provided with a VCR or a videodisc player can include rules (that cannot be overruled) which require the device to enforce the copyright laws of the country in which the device is sold. Whether or not internal built-in rules can be overruled by rules provided externally can be specified in the internal rules themselves. [0345] While the present invention may be used to protect intellectual property by controlling access to that property, the mechanisms discussed herein are technical in nature and are independent of any form of legal protection�a purely technological approach has been presented to controlling access to data. Indeed, the invention offers the intellectual property owner the opportunity to restrict access and use of his or her data beyond the protections that may be available in law. The protection offered by the present invention may be used to enforce rights in intellectual property whether the protection at law is categorized as copyright, trade secret, contract, or something else. The cost-benefit tradeoff of seeking protection at law must be made by those with a vested interest in the intellectual property. [0346] Typical computer systems are implemented at various levels, each level effectively defining a different virtual machine. Generally, each level of implementation can access the levels below it. In many systems it is desirable to have each level only access the level immediately below it. In that way, various policies can be enforced. [0347] Typically the higher level virtual machines are implemented in software and the lower level machines are implemented in hardware. However, there is no precise hardware/software boundary between levels. [0348] With reference to FIG. 24, for example, a computer system has a high-level application environment (level L4). These applications invoke (call) operating system level (L3) processes to perform various system functions. The OS level (L3) processes in turn invoke lower-level Basic Input/Output System (BIOS) machine dependent instructions as required (level L2). Note that application level (L4) programs might be permitted to bypass the OS level (L3) and invoke BIOS level (L2) processes directly, thereby avoiding any OS level (L3) policy checking and enforcement. [0349] As an example, an application (executing a level L4) program which wishes to open a particular named file would invoke an operating system �open� procedure for that named file. The OS determines the location of the file (using, for example, an internal map between file names and locations) and then invokes a lower level (L2) BIOS routine to perform the actual seek to the file and the open and read. However, the application program might be permitted to bypass the operating system's �open� process and invoke the BIOS routines directly. [0350] It is desirable to implement the access control mechanisms of the present invention at a low level, preferably at or below the BIOS level (level L1). This prevents users from by-passing the access control mechanisms of the invention and thereby circumventing the rule enforcement. [0351] Thus, a system for controlling access and distribution of digital property is provided. One skilled in the art will appreciate that the present invention can be practiced by other than the described embodiments, which are presented for purposes of illustration and not limitation, and the present invention is limited only by the claims that follow. Referenced byCiting PatentFiling datePublication dateApplicantTitleUS7519825 *Jan 17, 2005Apr 14, 2009House Of Development LlcElectronic certification and authentication systemUS7814023 *Sep 8, 2005Oct 12, 2010Avaya Inc.Secure download managerUS7983988 *Oct 15, 2003Jul 19, 2011Siemens AktiengesellschaftProgressive licensing of component-based MES softwareUS8160967 *Dec 30, 2004Apr 17, 2012Wibu-Systems AgAuthorization code recovering methodUS8392999May 24, 2010Mar 5, 2013White Cyber Knight Ltd.Apparatus and methods for assessing and maintaining security of a computerized system under developmentUS20130159123 *Dec 16, 2011Jun 20, 2013Lincoln W. HochbergContent access management in a social networking system for locally stored contentWO2009146333A1 *May 27, 2009Dec 3, 2009Bhagyarekha PlainfieldSystems and methods for secure data entry and storage* Cited by examinerClassifications U.S. Classification705/51International ClassificationG06F1/00, G06F21/00, H04N7/167, G11B20/10, G09C5/00, H04L9/16, G06F21/24, H04L9/32, G06F12/14Cooperative ClassificationH04L2209/56, H04L9/0822, H04L2463/101, G06F2221/2143, G06F2221/2141, G06F2211/007, G06F2221/0704, G06F21/34, G06F2221/0797, G06F2221/0724, G06F2221/2149, G06F2221/0742, G06F2221/2137, G06F2221/2145, G06F21/10, H04L63/0428, G06F2221/0737, G06F21/32, G06F21/6209, H04L9/08, G06F21/577, G06Q30/018, G06F21/71, G06F21/86, G06F21/72, G11B20/00673, G06F21/6245, G06F21/62European ClassificationH04L9/08, G06F21/71, G06F21/72, G06Q30/018, G06F21/62B5, G06F21/86, H04L63/04B, G06F21/10, G06F21/62A, G06F21/57C, G06F21/34, G06F21/32Legal EventsDateCodeEventDescriptionMay 28, 2013ASAssignmentEffective date: 20130523Free format text: MERGER;ASSIGNOR:ZOFILLIP PRO GROUP LLC;REEL/FRAME:030494/0301Owner name: INTELLECTUAL VENTURES II LLC, DELAWAREApr 13, 2011ASAssignmentOwner name: GENERAL DYNAMICS ADVANCED INFORMATION SYSTEMS, INCFree format text: CORRECTIVE ASSIGNMENT TO CORRECT THE NAMES OF THE CONVEYING AND RECEIVING PARTIES FOR SECURITY AGREEMENT PREVIOUSLY RECORDED ON REEL 018224 FRAME 0924. ASSIGNOR(S) HEREBY CONFIRMS THE CONVEYING PARTY IS BEECHTREE VERIFIDES MANAGEMENT LLC AND RECEIVING PARTY IS GENERAL DYNAMICS ADVANCED INFORMATION SYSTEMS, INC.;ASSIGNOR:BEECHTREE VERIFIDES MANAGEMENT LLC;REEL/FRAME:026116/0741Effective date: 20060831Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:GENERAL DYNAMICS ADVANCED INFORMATION SYSTEMS, INC.;REEL/FRAME:026120/0977Effective date: 20090915Owner name: BEECHTREE VERIFIDES MANAGEMENT, LLC, NEW YORKOct 14, 2009ASAssignmentOwner name: ZOFILLIP PRO GROUP LLC, DELAWAREFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:VERIFIDES TECHNOLOGY CORP.;REEL/FRAME:023373/0104Effective date: 20090916Jul 23, 2009ASAssignmentOwner name: BEECHTREE VERIFIDES MANAGEMENT LLC, NEW YORKFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:GENERAL DYNAMICS ADVANCED INFORMATION SYSTEMS, INC.;REEL/FRAME:023000/0200Effective date: 20060822Owner name: GENERAL DYNAMICS ADVANCED INFORMATION SYSTEMS, INCFree format text: MERGER;ASSIGNOR:VERIDIAN SYSTEMS DIVISION, INC.;REEL/FRAME:023000/0267Effective date: 20041217Owner name: MRJ, INC., VIRGINIAFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:THE MITRE CORPORATION;REEL/FRAME:022999/0924Effective date: 19971215Owner name: THE MITRE CORPORATION, MASSACHUSETTSFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:SCHNECK, PAUL B.;ABRAMS, MARSHALL D.;REEL/FRAME:023000/0025Effective date: 19960110Owner name: VERIDIAN INFORMATION SOLUTIONS, INC., MICHIGANFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:VERIDIAN INFORMATION SOLUTIONS, INC.;REEL/FRAME:023000/0164Effective date: 20030827Owner name: VERIDIAN INFORMATION SOLUTIONS, INC., VIRGINIAFree format text: MERGER;ASSIGNOR:MRJ, INC.;REEL/FRAME:023000/0069Effective date: 20000406Owner name: VERIFIDES TECHNOLOGY CORP., NEW YORKFree format text: MERGER;ASSIGNOR:BEECHTREE VERIFIDES MANAGEMENT LLC;REEL/FRAME:023000/0212Effective date: 20061030Jun 25, 2007ASAssignmentOwner name: VERIFIDES TECHNOLOGY CORP., NEW YORKFree format text: MERGER;ASSIGNOR:BEECHTREE VERIFIDES MANAGEMENT, LLC.;REEL/FRAME:019466/0552Effective date: 20061030Nov 22, 2006ASAssignmentOwner name: BEECHTREE VERIFIDES MANAGEMENT LLC, NEW YORKFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:GENERAL DYNAMICS ADVANCED INFORMATION SYSTEMS, INC.;REEL/FRAME:018563/0198Effective date: 20060822Sep 7, 2006ASAssignmentOwner name: BEECHTREE VERIFIDES MANAGEMENT LLC, NEW YORKFree format text: SECURITY AGREEMENT;ASSIGNOR:GENERAL DYNAMICS ADVANCED INFORMATION SYSTEMS, INC.;REEL/FRAME:018224/0924Effective date: 20060831Nov 7, 2005ASAssignmentOwner name: GENERAL DYNAMICS ADVANCED INFORMATION SYSTEMS, INCFree format text: MERGER;ASSIGNOR:VERIDIAN SYSTEMS DIVISION, INC.;REEL/FRAME:016976/0800Effective date: 20050101Owner name: VERIDIAN SYSTEMS DIVISION, INC., MICHIGANFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:VERIDIAN INFORMATION SOLUTIONS, INC.;REEL/FRAME:016984/0986Effective date: 20030827Aug 16, 2002ASAssignmentOwner name: MITRE CORPORATION, THE, MASSACHUSETTSFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:SCHNECK, PAUL B.;ABRAMS, MARSHALL D.;REEL/FRAME:013218/0493Effective date: 19960110Owner name: MRJ, INC., VIRGINIAFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:MITRE CORPORATION, THE;REEL/FRAME:013218/0040Effective date: 19971215RotateOriginal ImageGoogle Home - Sitemap - USPTO Bulk Downloads - Privacy Policy - Terms of Service - About Google Patents - Send FeedbackData provided by IFI CLAIMS Patent Services©2012 Google