Systems and methods for issuing usage licenses for digital content and services

A computer-readable storage medium not including carrier waves having computer executable instructions thereon for performing a method comprising:

• generating at a client device rights data for a piece of digital content, the rights data representing a set of parameters for licensing the digital content and including:
• a plurality of specified licensee entities, each specified licensee entity in the generated rights data being one of a person, a group of persons, and a device;
• and
• for each of the plurality of licensee entities, a respective set of one or more rights that the licensee entity has in the digital content, each set of one or more rights being specifically applicable to and employable only by the corresponding licensee entity;
• encrypting at the client device the digital content according to a content key;
• protecting at the client device the generated rights data and the content key according to a public key of a licensor selected to issue a license for the digital content;
• submitting from the client device the protected generated rights data with the one or more specified licensee entities and each respective set of rights and the protected content key as a rights label to the licensor, the licensor signing the rights label according to a private key corresponding to the public key after verifying that the set of rights in the rights label can be enforced by the licensor and returning the signed rights label to the client device;
• and
• forming at the client device a piece of rights managed digital content by concatenating the signed rights label with the encrypted digital content.

A method for managing rights in digital content, the method comprising:

• generating a content encryption key;
• encrypting at a client device digital content using the content encryption key to form encrypted digital content;
• generating at the client device a rights description for the digital content including a list of a plurality of potential licensees, each potential licensee in the generated rights description being one of a person, a group of persons, and a device, the generated rights description further including for each of the plurality of potential licensees a respective set of one or more rights that the licensee has in the digital content, each set of one or more rights being specifically applicable to and employable only by the corresponding licensee;
• protecting at the client device the generated rights description and the content key according to a public key of a licensor selected to issue a license for the digital content;
• submitting from the client device the protected generated rights description with each potential licensee and each respective set of rights and the protected content key as a rights label to the licensor, the licensor signing the rights label according to a private key corresponding to the public key after verifying that the set of rights in the rights label can be enforced by the licensor and returning the signed rights label to the client device, the licensor storing entities named from the rights description of entities allowed to request a license, the licensor also storing entities named from the rights description of entities not allowed to request a license;
• and
• concatenating at the client device the encrypted digital content with the signed rights label that includes the rights description, the encrypted content key, and the digital signature over at least the rights description.

A method for managing rights in digital content, the method comprising:

• generating a content key and a rights description including a plurality of potential licensees, wherein at least the rights description is generated at a content preparation application executing on a client computer, each potential licensee in the received rights description being one of a person, a group of persons, and a device, the rights description further including for each of the plurality of potential licensees a respective set of one or more rights that the licensee has in the digital content, the rights description employed to generate a license specifically applicable to and employable only by each included potential licensee;
• encrypting at the client computer the content key and the rights description with each potential licensee and each respective set of rights according to a public key of a selected digital rights management server to form an encrypted content key and rights description;
• providing from the client computer the encrypted content key and rights description to the digital rights management server as a rights label for signing thereby according to a private key corresponding to the public key, the digital rights management server signing the rights label after verifying that the set of rights in the rights description of the rights label can be enforced by the digital rights management server;
• receiving at the client computer from the digital rights management server, a signed rights label that includes the encrypted content key, the encrypted rights description, and a digital signature over both the encrypted content key and the encrypted rights description and according to the private key;
• and
• concatenating at the client computer the signed rights label with the digital content as encrypted according to the content key.

A method for managing rights in digital content, the method comprising:

• receiving, from a content preparation application executing on a client computer, a rights label comprising an encrypted content key and a rights description, the rights description including:
• a list of a plurality of potential licensees, each potential licensee in the received rights description being one of a person, a group of persons, and a device, the rights description further including for each of the plurality of potential licensees a respective set of one or more rights that the licensee has in the digital content, the encrypted content key and rights description being associated with the digital content, the rights description employed to generate a license specifically applicable to and employable only by each potential licensee in the list;
• determining whether the encrypted content key was encrypted using a public key that is associated with a trusted entity;
• and
• if the encrypted content key was encrypted using a public key that is associated with a trusted entity, signing the rights label comprising the rights description and encrypted content key using a private key that corresponds to the public key after verifying that the set of rights in the rights description of the rights label can be enforced, the trusted entity storing the rights description and potential licensee list;
• and
• providing to the content preparation application on the client computer, a signed rights label that includes the rights description with each potential licensee and each respective set of rights, the encrypted content key, and a digital signature over both the rights description and the encrypted content key such that the signed rights label is concatenated at the client computer with the digital content as encrypted according to the encrypted content key.

A method for generating a rights label for managing rights in digital content, the method comprising:

• generating at a client device rights data for a piece of digital content, wherein the rights data is indicative of a set of parameters for licensing the digital content and comprising a plurality of specified licensee entities, each of the plurality of specified licensee entities in the generated rights data being one of a person, a group of persons, and a device;
• generating a first cryptographic key;
• encrypting at the client device the digital content with the first cryptographic key;
• generating a second cryptographic key;
• encrypting at the client device the first cryptographic key with the second cryptographic key;
• obtaining, from a digital rights management (DRM) server, a third cryptographic key, wherein the third cryptographic key comprises a public key of a private/public key pair;
• encrypting at the client device the first cryptographic key with the third cryptographic key;
• encrypting at the client device the rights data with the second cryptographic key;
• receiving at the client device from the DRM server the encrypted rights data signed with a fourth cryptographic key, wherein the fourth cryptographic key comprises a private key of the private/public key pair, wherein the DRM server signs the encrypted rights data after verifying that the rights data can be enforced by the DRM server;
• forming the rights label comprising the signed rights data and the encrypted first cryptographic key;
• and
• forming at the client device a piece of rights managed digital content by concatenating the rights label with the encrypted digital content.