# US 10,846,373 B2 · Method and system for securing a client's access to a DRM agent's services for a video player > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,846,373 B2 - Document ID: US10846373B2 - Status: Granted - Kind: B2 - Application number: 15/780,713 - Filed: 2015-12-03 - Published: 2018-12-20 - Granted: 2020-11-24 - Earliest claimed: 2015-12-03 - Assignees: Orca Interactive Ltd. - Applicants: Orca Interactive Ltd - Inventors: Yaacov Toueg - Web page: https://patentgrep.com/patent/US10846373B2 ## CPC - G06F 21/10: Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 2463/101: applying security measures for digital rights management - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The present invention provides a method for securing a client's access to a DRM agent's services. The method comprising, by the DRM agent, the steps of: receiving a get-token request, applying a function to generate a decryption request identifier Request ID and a token value Token, returning Request ID and Token to the client, inserting, into a hash table of token values with get-token requests identifiers as keys, a record comprising the token value Token associated to the key Request ID, receiving a decryption request comprising Request ID, a multimedia content encrypted chunk and a digest of the encrypted chunk, retrieve Token from hash table based on Request ID, processing digest using a public key and Token, checking match between the processed digest and the at least part of the encrypted chunk and, only in case of match: decrypting the encrypted chunk and returning the decrypted chunk to the client. ## Claims ### Claim 1 A method for securing a client's computerized module access to a Digital Rights Management (DRM) agent's services, said method comprising the steps of: sending, by the client, a get-token request to the DRM agent; applying the following steps by the DRM agent: receiving the get-token request; applying a function to generate a decryption request identifier (RequestID) and a token value (Token), and returning the RequestID and the Token to the client; inserting, into a hash table of token values with get-token requests identifiers as keys, recorded in a memory of the DRM agent, a record comprising the Token associated to the RequestID; applying the following steps by the client: receiving the RequestID and the Token from the DRM agent; computing a digest of a multimedia content encrypted chunk using the Token and a private key; computing a decryption request of the multimedia content encrypted chunk, wherein the decryption request comprising the RequestID, the encrypted chunk and the digest of the encrypted chunk; sending to the DRM agent, the decryption request of the encrypted chunk; and applying the following steps by the DRM agent: receiving, the decryption request; retrieving the Token, from the hash table, based on the RequestID; processing the digest using a public key and the Token; checking match between processed digest and at least part of the encrypted chunk; only in case of match: decrypting encrypted chunk and returning the decrypted chunk to the client; wherein at least one of receiving, processing, computing decrypting are performed by a processor. ### Claim 2 (depends on 1) The method of claim 1 wherein: the get-token request comprises an identifier ClientID of the client; the function uses ClientID as an input; the hash table's record further includes ClientID associated with the RequestID; the decryption request further comprises an identifier ClientID2 of the client; the retrieving of Token is jointly performed with the retrieving of ClientID, and the subsequent processing of the digest and encrypted chunk decryption are only performed in case of match between ClientID and ClientID2. ### Claim 3 (depends on 1) The method of claim 1 wherein checking match between processed digest and at least part of the encrypted chunk includes performing a XOR operation between the Token and the at least part of the encrypted chunk. ### Claim 4 (depends on 1) The method of claim 1 wherein, in case of no match, the client application is terminated. ### Claim 5 (depends on 1) The method of claim 1 further comprising the step of removing the record comprising the Token associated to the RequestID from the hash table after the decryption request is handled. ### Claim 6 (depends on 1) The method of claim 1 wherein the hash table management process, and the communication process with the client are protected in terms of mutual exclusion inside the DRM agent, in order to prevent the client to gain access to the hash table. ### Claim 7 (depends on 1) The method of claim 1 further using multiple public keys as a whitelist of authorized clients to support multiple client sources. ### Claim 8 (depends on 1) The method of claim 1, wherein the client further performs the steps of: sending a get-token request to the DRM agent; receiving RequestID and Token from the DRM agent; computing a digest of a multimedia content encrypted chunk using Token and a private key; computing a decryption request of the multimedia content encrypted chunk, comprising RequestID, the encrypted chunk and the digest of the encrypted chunk; sending to the DRM agent, the decryption request of the encrypted chunk; wherein at least one of receiving, processing, computing decrypting are performed by a processor. ### Claim 9 (depends on 8) The method of claim 8, wherein the client being comprised of a signature module for computing a digest of a multimedia content encrypted chunk using Token and a private key. ### Claim 10 A method for securing a client's computerized module access to a Digital Rights Management (DRM) agent's services, said method comprising the steps of: receiving the get-token request from the client; applying a function to generate a decryption request identifier (RequestID) and a token value (Token), and returning the RequestID and the Token to the client; inserting, into a hash table of token values with get-token requests identifiers as keys, recorded in a memory of the DRM agent, a record comprising the Token associated to the Request ID; receiving, a decryption request of a multimedia content encrypted chunk, wherein the decryption request comprising the RequestID, the encrypted chunk and a digest of the encrypted chunk; retrieving the Token, from the hash table, based on the RequestID; processing the digest using a public key and the Token; checking match between processed digest and at least part of the encrypted chunk; only in case of match: decrypt encrypted chunk and return the decrypted chunk to the client; wherein at least one of receiving, processing, computing decrypting are perfumed by a processor. ### Claim 11 A system for securing a client's access to a Digital Rights Management (DRM) agent's services, said system being comprised of: a microprocessor; a client algorithm engine for receiving a decryption request identifier (RequestID) and a token value (Token) from the DRM agent, computing a digest of a multimedia content encrypted chunk using the Token and a private key, computing a decryption request of the multimedia content encrypted chunk, wherein the decryption request comprising the RequestID, the encrypted chunk and the digest of the encrypted chunk, and sending to the DRM agent, the decryption request of the encrypted chunk; a get-token request handling engine for receiving a get-token request, applying a function to generate the RequestID and the Token, returning the RequestID and the Token to the client, and inserting, into a hash table of token values with get-token requests identifiers as keys, a record comprising the Token associated to the RequestID; a decryption request handling engine for receiving a decryption request of a multimedia content encrypted chunk comprising the RequestID, the encrypted chunk and a digest of the encrypted chunk, retrieving the Token, from the hash table based on the RequestID, processing the digest using a public key and the Token, checking match between processed digest and at least part of the encrypted chunk and, only in case of match: decrypting the encrypted chunk and returning the decrypted chunk to the client. ### Claim 12 (depends on 11) The system of claim 11 wherein: the get-token request comprises an identifier ClientID of the client; the function uses ClientID as an input; the hash table's record further includes ClientID associated with the key RequestID; the decryption request further comprises an identifier ClientID2 of the client. ### Claim 13 (depends on 11) The system of claim 11 wherein checking match between processed digest and at least part of encrypted chunk includes performing a XOR operation between Token and the at least part of encrypted chunk. ### Claim 14 (depends on 11) The system of claim 11 wherein, in case of no match, the client application is terminated. ### Claim 15 (depends on 11) The system of claim 11 further comprising means for protecting, in terms of mutual exclusion inside the DRM agent, the hash table management process and the communication process with the client in order to prevent the client to gain access to the hash table.