# US 8,751,799 B2 · Method and apparatus for providing content > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,751,799 B2 - Document ID: US8751799B2 - Status: Granted - Kind: B2 - Application number: 13/092,758 - Filed: 2011-04-22 - Published: 2011-11-24 - Granted: 2014-06-10 - Earliest claimed: 2010-05-20 - Assignees: Absio Corporation - Applicants: Mitchell J. Tanenbaum; Daniel L. Kruger - Inventors: Mitchell J. Tanenbaum; Daniel L. Kruger - Web page: https://patentgrep.com/patent/US8751799B2 ## CPC - H04L 9/0822: {using key encryption key} - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L 63/045: {wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14)} - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - G06F 21/1086: {Superdistribution} - G06F 2211/008: Public Key, Asymmetric Key, Asymmetric Encryption - G06Q 2220/10: Usage protection of distributed data files - H04L 2209/26: Testing cryptographic entity, e.g. testing integrity of encryption key or encryption algorithm - H04L 2209/60: Digital content management, e.g. content distribution - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract Methods and systems for enabling content to be securely and conveniently distributed to authorized users are provided. More particularly, content is maintained in encrypted form on sending and receiving devices, and during transport. In addition, policies related to the use of, access to, and distribution of content can be enforced. Features are also provided for controlling the release of information related to users. The distribution and control of contents can be performed in association with a client application that presents content and that manages keys. ## Claims ### Claim 1 A method for distributing content, comprising: creating first content on a first device; encrypting the first content using a first content key; storing the encrypted first content on the first device; identifying a first recipient for the first content; encrypting the encrypted first content, the first content key, and first information related to the first content using a public key of the first recipient; delivering the encrypted first content, first content key, and at least first information related to the first content to a second device, as encrypted using the public key of the first recipient, over a communication network; receiving the encrypted first content, first content key, and at least first information related to the first content, as encrypted using the public key of the first recipient, at the second device; decrypting the encrypted first content, first content key, and at least first information related to the first content, as encrypted using the public key of the first recipient, by applying a private key of the first recipient using a client application running on the second device; storing the encrypted first content in an object store on the second device; storing the encrypted at least first information related to the first content in the object store on the second device; storing the first content key in a first key ring on the second device, wherein the first key ring is encrypted using a first system key; applying the first system key to the encrypted first key ring using the client application running on the second device to access the first content key; using the unencrypted first content key, the first client application decrypting the encrypted first content to access the first content; displaying by the client application the first content, wherein actions that a user takes with respect to the first content are limited by permissions associated with the first content; and after using the unencrypted first content key to decrypt the encrypted first content, overwriting the unencrypted first content key in memory. ### Claim 2 (depends on 1) The method of claim 1, further comprising: creating second content on the first device; encrypting the second content using a second content key. ### Claim 3 (depends on 1) The method of claim 1, further comprising: displaying the at least first information related to the first content on the second device using the client application. ### Claim 4 (depends on 1) The method of claim 1, further comprising: receiving a first system decryption key at the second device. ### Claim 5 (depends on 4) The method of claim 4, further comprising: applying the first content key to the encrypted first content using the client application programming and the first system decryption key on the second device, wherein displaying by client application the first content includes displaying the first content on the second device. ### Claim 6 (depends on 1) The method of claim 1, wherein the encrypted first content is delivered to the second device through a content system server. ### Claim 7 A system for distributing content, comprising: a first device; a first client application running on the first device; first data storage associated with the first device; a first encrypted document stored in an object store on the first data storage of the first device; first encrypted information related to the first encrypted document stored in the object store on the first data storage of the first device; an encrypted first content key for decrypting the first encrypted document stored as part of a first content key ring on the first data storage of the first device, wherein a first system key is required to be applied by the first client application to decrypt the encrypted first content key and to thereby access the first content key, wherein the first client application enables the first content key to be used to decrypt the first encrypted document, wherein the first content key for decrypting the first encrypted document stored as part of the first content key ring cannot be directly accessed by a user of the first device, and wherein a first private key must be applied in order to access each of the first encrypted document, the first encrypted information related to the first encrypted document, and the first encrypted content key, wherein the first system key must be applied by the first application to access and decrypt the first encrypted content key, wherein the first encrypted document is unencrypted and displayed by the first client application after the unencrypted first content key is applied by the first client application to decrypt the encrypted first document, wherein actions that user takes with respect to the first document are limited according to permission associated with the first document, and wherein the unencrypted first content key in memory is overwritten. ### Claim 8 (depends on 7) The system of claim 7, further comprising: a display associated with the first device, wherein the first encrypted document is presented on the display through the first client application using the first content key to decrypt the first document. ### Claim 9 (depends on 8) The system of claim 8, wherein at least some of the first encrypted information related to the first encrypted document is presented on the display without application of the first content key to the first encrypted information. ### Claim 10 (depends on 7) The system of claim 7, further comprising: a communication network; a first communication interface on the first client device, wherein the first communication interface is operably interconnected to the communication network, and wherein the first device is operable to create a document package for delivery over the communication network, the document package including the first encrypted document, and the first content key to be used to decrypt the first document, wherein at least the first content key is encrypted by a first recipient public key. ### Claim 11 (depends on 10) The system of claim 10, further comprising: second data storage associated with the first device, wherein the client application is stored on the second data storage. ### Claim 12 (depends on 10) The system of claim 10, further comprising: a second device; a client application running on the second device; first data storage associated with the second device; a first encrypted document stored on the first data storage of the second device; a first content key for decrypting the first encrypted document stored as part of a first content key ring on the first data storage of the second device, wherein the client application on the second device enables the first content key to be used to decrypt the first encrypted document, and wherein the first content key for decrypting the first encrypted document stored as part of the first content key ring cannot be accessed by a user of the second device. ### Claim 13 A method for distributing content, comprising: receiving a first data wrapper containing first encrypted content at a first computer, a first content key, and at least first information related to the first encrypted content; applying using first computer programming running on the first computer a first user key to the first data wrapper, wherein the first encrypted content is removed from the first data wrapper and stored in an object store in encrypted form, wherein the first content key is stored in a key ring in encrypted form as an encrypted first content key and wherein the information related to the first encrypted content is stored in the object store in encrypted form; applying using the first computer programming running on the first computer a first system key to the encrypted first content key to thereby obtain the first content key; applying using the first computer programming running on the first computer the first content key to the first encrypted content, wherein the first encrypted content is decrypted to form first decrypted content; displaying using the first computer programming the first decrypted content, wherein actions a user takes with respect to the first decrypted content are limited according to the permissions associated with the first decrypted content; and overwriting the first content key in memory. ### Claim 14 (depends on 13) The method of claim 13, wherein the first decrypted content is available to a user of the first computer through a first client application. ### Claim 15 (depends on 13) The method of claim 13, wherein a first client application controls access to the first decrypted content. ### Claim 16 (depends on 15) The method of claim 15, wherein access to the first decrypted content includes at least one of: viewing the first decrypted content, forwarding the first decrypted content, modifying the first decrypted content, excerpting from the decrypted content. ### Claim 17 (depends on 13) The method of claim 13, wherein the first data wrapper additionally includes content metadata, wherein at least some of the content metadata is accessible subsequent to applying a first permission key to the wrapper, and prior to applying the first content key to the first encrypted content. ### Claim 18 (depends on 13) The method of claim 13, wherein the first content key is received at the first computer when the first data wrapper is received at the first computer. ### Claim 19 (depends on 13) The method of claim 13, further comprising: forwarding the first encrypted content from the first computer to a second computer in a second data wrapper, wherein the first content key is not included in the contents of the second data wrapper; receiving at the second computer a third data wrapper, wherein the third data wrapper contains the first content key, and wherein the third data wrapper is provided to the second computer by a content system server. ### Claim 20 (depends on 7) The system of claim 7, wherein the first system key is required to open each of the first encrypted document, the first encrypted information related to the first encrypted document, and the encrypted first content key.