Systems and methods for secure transaction management and electronic rights protection

A method for securely managing at least one operation on a data item performed at least in part by an electronic arrangement disposed at a first site, said method comprising:

• (a) securely delivering a first procedure to said electronic arrangement at said first site from a second site different from said first site;
• (b) securely delivering, to said electronic arrangement at said first site from a third site different from said first and second sites, a second procedure separable or separate from said first procedure;
• and
• (c) performing, at least in part with said electronic arrangement at said first site, at least one operation on said data item, including using said first and second procedures in combination to at least in part securely manage said operation.

A method of securely controlling use by a third party of at least one protected operation with respect to a data item comprising:

• (a) supplying at least a first control from a first party to said third party;
• (b) supplying, to said third party, at least a second control from a second party different from said first party;
• (c) securely combining. at said third party's location, said first and second controls to form a control arrangement;
• (d) securely requiring use of said control arrangement in order to perform at least one protected operation using said data item;
• and
• (e) securely performing said at least one protected operation on behalf of said third party with respect to said data item by at least in part employing said control arrangement.

A secure method for combining data items into a composite data item comprising:

• (a) securely providing, from a first location to a second location, a first data item having at least a first control associated therewith;
• (b) securely providing, from a third location to said second location, a second data item having at least a second control associated therewith;
• (c) forming, at said second location, a composite of said first and second data items;
• (d) securely combining. at said second location, said first and second controls to form a control arrangement;
• and
• (e) performing at least one operation on said composite of said first and second data items based at least in part on said control arrangement.

A secure method for controlling a protected operation comprising:

• (a) securely delivering at least a first control and a second control representing rights of first and second entities, respectively, to an electronic appliance used by a third entity;
• and
• (b) controlling at least one protected operation at least in part in response to a request by said third entity based at least in part on a combination of said first and second controls, including at least one of the following steps:
• resolving at least one conflict between said first and second controls based on a predefined order;
• providing an interaction with said third entity to form said combination;
• and
• dynamically negotiating between said first and second controls.

A method for using at least one resource processed by a secure operating environment, said method comprising:

• securely receiving a first load module provided by a first entity external to said operating environment;
• securely receiving a second load module provided by a second entity external to said operating environment, said second entity being different from said first entity;
• and
• securely processing, using at least one resource, a data item associated with said first and second load modules, including securely applying said first and second load modules to manage use of said data item.

A secure operating environment system for managing at least one resource comprising:

• a communications arrangement that securely receives a first control of a first entity external to said operating environment, and securely receives a second control of a second entity external to said operating environment, said second entity being different from said first entity;
• and
• a protected processing environment, operatively connected to said communications arrangement, that:
• (a) securely processes, using at least one resource, a data item logically associated with said first and second controls, and
• (b) securely applies said first and second controls to manage said resource for controlling use of said data item.