Obtaining a signed rights label (SRL) for digital content and obtaining a digital license corresponding to the content based on the SRL in a digital rights management system

A method for providing a digital license from a license server to a user, the license for allowing the user to render corresponding published digital content, the content being encrypted according to a content key CK to result in CK(content), CK(content) being accompanied by a signed rights label SRL, the method comprising:

• receiving the SRL and a user key as part of a request for the license from the user, the SRL including a rights label comprising CK protected according to a public key for the license server PU-DRM, rights data protected according to PU-DRM, the SRL also including the license server's digital signature of the rights label based on a private key PR-DRM corresponding to PU-DRM and based at least in part on the protected rights data, whereby the license server signs both the rights data and the content key CK that are protected according to PU-DRM,;
• accessing the license server's signature of the rights label in the received SRL;
• verifying by the license server its own signature of the received SRL based on PU-DRM and based at least in part on the protected rights data;
• accessing the protected rights data in the SRL;
• reviewing the accessed rights data to determine whether the user is entitled to the license;
• and
• if so:
• accessing the protected CK in the SRL;
• protecting the accessed CK according to the received user key;
• and
• issuing the license to the user, the license including CK protected according to the user key.

A method in combination with digital content and a digital license corresponding to the content and issued by a license server to a user to render the content,

• the content being encrypted according to a content key CK to result in CK(content), CK(content) being accompanied by a signed rights label SRL, the license including CK protected according to a user key, whereby the user can access CK from the license and apply CK to CK(content) to result in the content, the license further including DES 1 encrypted according to the user key,
• the method comprising:
• retrieving DES1 encrypted according to the user key from the license;
• decrypting DES1 encrypted according to the user key to result in DES1;
• retrieving DES1(rightsdata) from the SRL including CK encrypted according to a symmetric key DES1 to result in DES1(CK), rights data encrypted according to the symmetric key DES1 to result in DES1(rightsdata), DES1 encrypted according to a public key for the license server PU-DRM to result in PU-DRM(DES1), and a digital signature based on a private key PR-DRM corresponding to PU-DRM and based at least in part on DES1 (rightsdata);
• applying DES1 to DES1(rightsdata) to result in the rights data;
• altering the rights data as desired;
• encrypting the altered rights data according to DES1 to result in DES1 (alteredrightsdata);
• submitting DES1 (alteredrightsdata) and DES1 (CK) as a republished rights label to the license server for signing thereby, the license server validating the republished rights label and, if valid, creating a digital signature based on PR-DRM and based at least in part on DES1(alteredrightsdata) to result in a signed republished rights label SRRL and returning the SRRL, whereby the license server signs both the altered rights data and the content key CK;
• receiving the returned SRRL and concatenating such received SRRL with CK(content) to form a content package;
• and
• distributing the content package to one or more users;
• receiving from a user a request for a license corresponding to the content, the request comprising the SRRL as retrieved from the content package, whereby the license server verifying its own signature of the rights label in the received SRRL based on PU-DRM and based at least in part on DES1(alteredrightsdata), accesses DES1(alteredrightsdata) in the SRRL and reviews same to determine whether the user is entitled to the license, and if so issues the license to the user, the license including CK in a protected form accessible to the user.

A method of self-publishing digital content to enable a license server to issue a digital license corresponding to the content to one or more users desiring to render the content, the method comprising:

• receiving from the license server an authorizing certificate including a public key PU-CERT and a corresponding private key PR-CERT encrypted according to a public key of the user PU-USER to result in PU-USER(PR-CERT), the certificate being signed by a private key of the license server PR-DRM;
• encrypting the content according to a content key CK to result in CK(content);
• protecting the content key CK according to a public key of the license server PU-DRM corresponding to PR-DRM;
• generating rights data associated with the content;
• protecting the rights data according to PU-DRM;
• submitting the protected rights data and the protected content key CK) as a rights label;
• obtaining PR-CERT from the received authorizing certificate;
• signing the submitted rights label with the obtained PR-CERT based at least in part on the protected rights data to result in a signed rights label SRL, whereby the license server signs both the rights data and the content key CK that are protected according to PU-DRM;
• concatenating the SRL and the authorizing certificate with CK(content) to form a content package;
• and
• distributing the content package to the one or more users;
• receiving from a user a request for the license corresponding to the content, the request comprising the SRL and certificate as retrieved from the content package, whereby the license server verifies its own signature of the certificate based on PU-DRM, obtains PU-CERT from the certificate, whereby the license server verifies its own signature of the SRL based on the obtained PU-CERT, accesses the protected rights data in the SRL and reviews same to determine whether the user is entitled to the license, and if so issues the license to the user, the license including CK in a protected form accessible to the user.