# US 11,030,279 B2 · Secure DRM-agnostic key rotation

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,030,279 B2
- Document ID: US11030279B2
- Status: Granted
- Kind: B2
- Application number: 16/553,926
- Filed: 2019-08-28
- Published: 2020-03-19
- Granted: 2021-06-08
- Earliest claimed: 2016-11-28
- Assignees: OpenTV, Inc.
- Applicants: OpenTV, Inc.
- Inventors: Debra Hensgen; Charles Stevens
- Web page: https://patentgrep.com/patent/US11030279B2

## CPC

- G06F 21/105: {Arrangements for software license management or administration, e.g. for managing licenses at corporate level}
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 63/068: {using time-dependent keys, e.g. periodically changing keys (cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088)}
- H04N 21/26216: {involving the channel capacity, e.g. network bandwidth (admission control, resource allocation in open networks H04L12/5692; flow control in packet networks H04L47/10; establishing a schedule or organising the servicing of application requests taking into account QoS H04L67/61)}
- H04N 21/26613: {for generating or managing keys in general (key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04)}
- H04N 21/8355: involving usage data, e.g. number of copies or viewings allowed
- G06F 21/107: {License processing; Key processing}
- G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04N: PICTORIAL COMMUNICATION, e.g. TELEVISION

## Abstract

Systems and methods for managing provisioning of keys prior to a key rotation are provided. A license server generates a license that is associated with a renewal time. The renewal time is a time that is prior to a key rotation time, and triggers a receiver device to send a renewal request prior to the key rotation time. The renewal time may be a randomized time prior to the key rotation time that differs for different receiver devices. The license is transmitted to the receiver device. The license server then receives a renewal request from the receiver device that is triggered at the renewal time. The license server generates a next license that comprises a next key, whereby the next key is a decryption key for decrypting the encrypted signal after the key rotation time. The next license is transmitted to the receiver device prior to the key rotation time.

## Claims

### Claim 1

A method comprising:
determining a renewal time during which a user device obtains renewal of access to a piece of content, the renewal time being transmitted with an initial license and comprising a time prior to a key rotation time, the renewal time being incrementally different for the user device and one or more other user devices accessing the piece of content, the renewal time comprising a time between a current time and the key rotation time when a current key expires and key rotation occurs, a request to renew the access to the piece of content being triggered during the renewal time;
in response to a license request received from the user device, generating the initial license to the piece of content, the initial license comprising a first key to decrypt the piece of content, the initial license being associated with the renewal time;
in response to the generating of the initial license, transmitting, via a network, the initial license with the renewal time to the user device;
receiving, from the user device via the network at the renewal time, the request to renew the access to the piece of content;
in response to the request to renew the access to the piece of content, generating, by one or more processors, a next license to the piece of content, the next license comprising a next renewal time prior to a next key rotation time and a second key to decrypt the piece of content as encrypted after the key rotation time, the next renewal time comprising an incremental change applied to the next key rotation time and different incremental changes are applied to the next key rotation time for the user device and the one or more other user devices; and
in response to the generation of the next license, transmitting the next license to the user device prior to the key rotation time.

### Claim 2 (depends on 1)

The method of claim 1, wherein the renewal time is a randomized time between the current time and the key rotation time.

### Claim 3 (depends on 1)

The method of claim 1, wherein:
the renewal time comprises another incremental change subtracted from the key rotation time; and
different incremental changes are applied to the key rotation time for the user device and the one or more other user devices.

### Claim 4 (depends on 1)

The method of claim 1, wherein the generating the initial license comprises including an indication of the renewal time in the initial license.

### Claim 5 (depends on 1)

The method of claim 1, wherein the transmitting the initial license comprises transmitting the initial license in a package that includes an indication of the renewal time.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
providing a different renewal time that is randomized for the one or more other user devices.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
providing a different renewal time that is staggered for the one or more other user devices.

### Claim 8 (depends on 1)

The method of claim 1, wherein:
the user device obtains the piece of content from a content distribution network; and
the transmitting the initial license and the transmitting the next license are by a server associated with the content distribution network.

### Claim 9

A system comprising:
one or more hardware processors; and
a memory storing instructions that, when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations comprising:
determining a renewal time during which a user device obtains renewal of access to a piece of content, the renewal time being transmitted with an initial license and comprising a time prior to a key rotation time, the renewal time being incrementally different for the user device and one or more other user devices accessing the piece of content, the renewal time comprising a time between a current time and the key rotation time when a current key expires and key rotation occurs, a request to renew the access to the piece of content being triggered during the renewal time;
in response to a license request received from the user device, generating the initial license to the piece of content, the initial license comprising a first key to decrypt the piece of content, the initial license being associated with the renewal time;
in response to the generating of the initial license, transmitting, via a network, the initial license with the renewal time to the user device;
receiving, from the user device via the network at the renewal time, the request to renew the access to the piece of content;
in response to the request to renew the access to the piece of content, generating a next license to the piece of content, the next license comprising a next renewal time prior to a next key rotation time and a second key to decrypt the piece of content as encrypted after the key rotation time, the next renewal time comprising an incremental change applied to the next key rotation time and different incremental changes are applied to the next key rotation time for the user device and the one or more other user devices; and
in response to the generation of the next license, transmitting the next license to the user device prior to the key rotation time.

### Claim 10 (depends on 9)

The system of claim 9, wherein the renewal time is a randomized time between the current time and the key rotation time.

### Claim 11 (depends on 9)

The system of claim 9, wherein:
the renewal time comprises another incremental change subtracted from the key rotation time; and
different incremental changes are applied to the key rotation time for the user device and the one or more other user devices.

### Claim 12 (depends on 9)

The system of claim 9, wherein the generating the initial license comprises including an indication of the renewal time in the initial license.

### Claim 13 (depends on 9)

The system of claim 9, wherein the transmitting the initial license comprises transmitting the initial license in a package that includes an indication of the renewal time.

### Claim 14 (depends on 9)

The system of claim 9, wherein the operations further comprise:
providing a different renewal times that is randomized for the one or more other user devices.

### Claim 15 (depends on 9)

The system of claim 9, wherein:
the user device obtains the piece of content from a content distribution network; and
the transmitting the initial license and the transmitting the next license are by a server associated with the content distribution network.

### Claim 16

A non-transitory machine-readable medium storing instructions that, when executed by one or more hardware processors of a machine, cause the machine to perform operations comprising:
determining a renewal time during which a user device obtains renewal of access to a piece of content, the renewal time being transmitted with an initial license and comprising a time prior to a key rotation time, the renewal time being incrementally different for the user device and from one or more other user devices accessing the piece of content, the renewal time comprising a time between a current time and the key rotation time when a current key expires and key rotation occurs, a request to renew the access to the piece of content being triggered during the renewal time;
in response to a license request received from the user device, generating the initial license to the piece of content, the initial license comprising a first key to decrypt the piece of content, the initial license being associated with the renewal time;
in response to the generating of the initial license, transmitting, via a network, the initial license with the renewal time to the user device;
receiving, from the user device via the network at the renewal time, the request to renew the access to the piece of content;
in response to the request to renew the access to the piece of content, generating a next license to the piece of content, the next license comprising a next renewal time prior to a next key rotation time and a second key to decrypt the piece of content as encrypted after the key rotation time, the next renewal time comprising an incremental change applied to the next key rotation time and different incremental changes are applied to the next key rotation time for the user device and the one or more other user devices; and
in response to the generation of the next license, transmitting the next license to the user device prior to the key rotation time.