# US 8,751,800 B1 · DRM provider interoperability

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,751,800 B1
- Document ID: US8751800B1
- Status: Granted
- Kind: B1
- Application number: 13/437,789
- Filed: 2012-04-02
- Granted: 2014-06-10
- Earliest claimed: 2011-12-12
- Assignees: Google Inc.
- Applicants: David Kimbal Dorwin
- Inventors: David Kimbal Dorwin
- Web page: https://patentgrep.com/patent/US8751800B1

## CPC

- G06F 40/143: Markup, e.g. Standard Generalized Markup Language [SGML] or Document Type Definition [DTD]
- G06F 11/3003: {Monitoring arrangements specially adapted to the computing system or computing system component being monitored}
- G06F 21/105: {Arrangements for software license management or administration, e.g. for managing licenses at corporate level}
- G06F 21/60: Protecting data
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules
- G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself}
- G06T 11/00: Two-dimensional [2D] image generation
- H04L 9/0631: {Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 47/801: {Real time traffic}
- H04L 47/805: {QOS or priority aware}
- H04L 63/00: {Network architectures or network communication protocols for network security (cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00)}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)}
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04L 63/102: {Entity profiles}
- H04L 65/1108: Web based protocols, e.g. webRTC
- H04L 65/613: for the control of the source by the destination (control signals issued by the client directed to the server or network components specially adapted for selective content distribution H04N21/637)
- H04L 65/762: {at the source (reformatting of additional data in video distribution servers H04N21/2355)}
- H04N 21/2347: involving video stream encryption
- H04N 21/24: Monitoring of processes or resources, e.g. monitoring of server load, available bandwidth, upstream requests {(monitoring of server performance or load G06F11/34; arrangements for observation, testing or troubleshooting for broadcast or for distribution combined with broadcast H04H20/12)}
- H04N 21/4405: involving video stream decryption
- G06F 21/1062: {Editing}
- G06F 21/1073: {Conversion}
- G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G11B 20/00086: {Circuits for prevention of unauthorised reproduction or copying, e.g. piracy (indicating unauthorised use of record carriers in general G11B23/28; scrambling for television signal recording H04N5/913; network architectures or network protocols for network security H04L63/00; cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00)}
- H04L 9/32: including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials}
- H04L 65/80: Responding to QoS
- H04L 2209/603: Digital right managament [DRM]
- H04L 2463/101: applying security measures for digital rights management
- H04L 2463/103: applying security measure for protecting copyright
- H04N 21/25825: {involving client display capabilities, e.g. screen resolution of a mobile phone (optimising the visualisation of content during browsing in the Internet G06F16/9577; processing of terminal status or physical abilities in wireless networks H04W8/22; authentication in wireless network security H04W12/06)}
- H04N 21/25833: {involving client hardware characteristics, e.g. manufacturer, processing or storage capabilities (allocation of resources considering hardware capabilities in multiprogramming arrangements G06F9/5044; allocation of resources considering software capabilities in multiprogramming arrangements G06F9/5055)}
- H04N 21/41407: {embedded in a portable device, e.g. video client on a mobile phone, PDA, laptop (constructional details of equipment or arrangements specially adapted for portable computer application G06F1/1626; arrangements specially adapted for mobile receivers in broadcast systems H04H20/57)}
- H04N 21/4516: {involving client characteristics, e.g. Set-Top-Box type, software version or amount of memory available}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06T: IMAGE DATA PROCESSING OR GENERATION, IN GENERAL
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04N: PICTORIAL COMMUNICATION, e.g. TELEVISION
- G11B: INFORMATION STORAGE BASED ON RELATIVE MOVEMENT BETWEEN RECORD CARRIER AND TRANSDUCER (recording measured values in a way that does not require playback through a transducer G01D9/00; recording or playback apparatus using mechanically marked tape, e.g. punched paper tape, or using unit records, e.g. punched or magnetically marked cards G06K; transferring data from one type of record carrier to another G06K1/18; circuits for coupling output of reproducer to radio receiver H04B1/20; gramophone pick-ups or like acoustic electromechanical transducers or circuits therefor H04R)

## Abstract

Embodiments are directed towards providing interoperability by establishing a trust relationship between a provider of a media player usable by a consumer and a content provider. A trust relationship is verified through using a public-private key certification authority. When a request for content is received from a consumer, the request might indicate what content protection mechanisms are available in the consumer's device. When a trust relationship is determined to exist between the content provider and the media player providers, the content provider encrypts a license separately for each of a plurality of different content protection mechanisms available at the consumer's device. The encrypted licenses are provided to the consumer's device, where the media player may be selected to play the content based on a self integrity check the media player may perform, and its ability to use a private key associated with a corresponding public key to decrypt the license.

## Claims

### Claim 1

A system, comprising:
a network device associated with a content provider, having one or more processors configured to perform actions, including:
establishing a trust relationship using a cryptographic protocol with a content decryption module (CDM) provider's network device for a version of a CDM and the network device associated with the content provider;
when information is received from a client device indicating that the client device supports at least the version of the CDM;
determining for which of the supported CDMs the network device has an established trust relationship with a corresponding CDM provider;
using the established trust relationships for the supported CDMs, accessing a public key associated with the version of the CDM supported by the client device; and
encrypting a license using the accessed public key, the license protecting access to media content; and
when it is determined that no information is received from the client device indicating the client device supports at least the version of the CDM:
using trust relationships established between the network device and a plurality of different CDM providers to access respective public keys associated with CDMs from the plurality of different CDM providers,
encrypting the license with each of the accessed public keys to generate a plurality of encrypted licenses, and
providing each of the encrypted licenses to the client device; and
the client device, comprising:
a plurality of CDMs, wherein one of the plurality of CDMs is the version of the CDM, and wherein the version of the CDM performs actions, including:
receiving from the network device, the encrypted license;
determining an integrity of the version of the CDM and a media player against tampering;
in response to determining that the integrity of the version of the CDM and the media player is confirmed, decrypting the license using a private key associated with the public key, and using the decrypted license to enable access to media content protected by the license; and
in response to determining that the integrity of the version of the media player is not confirmed, denying access to the private key for decryption of the license and access to the media content protected by the license.

### Claim 2 (depends on 1)

The system of claim 1, wherein the network device performs actions,
wherein sending each of the plurality of encrypted licenses to the client device, comprises wherein at least one other CDM in the plurality of CDMs is selected at the client device to decrypt one of the plurality of encrypted licenses using a private key associated with a corresponding public key for the other CDM.

### Claim 3 (depends on 1)

The system of claim 1, wherein the network device performs actions, further including:
querying the client device to determine which of the plurality of CDMs the client device supports.

### Claim 4 (depends on 1)

The system of claim 1, wherein the network device performs actions, further including:
receiving from the client device, information indicating that the client device supports the version of the CDM absent sending a query request to the client device to determine which version of the CDM is supported by the client device.

### Claim 5 (depends on 1)

The system of claim 1, wherein encrypting the license, further comprises encrypting one or more content decryption keys that are configured to enable decryption of the media content at the client device by using the private key to decrypt the one or more content decryption keys.

### Claim 6 (depends on 1)

The system of claim 1, wherein the client device further comprises:
one or more media players that is configured to select one or more of the plurality of CDMs to access the media content.

### Claim 7

A network device, comprising:
a memory for storing protected content; and
one or more processors that perform actions, including:
establishing a trust relationship cryptographically with a network device associated with a content decryption module (CDM) provider for a version of a CDM and the network device, wherein the network device is associated with a provider of the protected content;
when information is received from a client device indicating that the client device supports at least the version of the CDM;
determining for which of the supported CDMs the network device has an established trust relationship with a corresponding CDM provider;
using the established trust relationships for the supported CDMs, accessing a public key associated with the version of the CDM;
encrypting a license/decryption key to access content using the accessed public key; and
providing the encrypted license/decryption key to a client device having at least the version of CDM, wherein the version of the CDM is configured to access a protected private key corresponding to the public key, decrypt the encrypted license/decryption key using the private key, and enable access to the content, based in part on an integrity of the client device including the integrity of at least the version of the CDM, the integrity being determined by at least the version of the CDM; and
when it is determined that no information is received from the client device indicating the client device supports at least the version of the CDM:
using trust relationships established between the network device and a plurality of different CDM providers to access respective public keys associated with CDMs from the plurality of different CDM providers,
encrypting the license/decryption key with each of the accessed public keys to generate a plurality of encrypted licenses/decryption keys, and
providing each of the encrypted licenses/decryption keys to the client device.

### Claim 8 (depends on 7)

The network device of claim 7, wherein the one or more processors perform actions, further including:
sending each of the plurality of encrypted licenses/decryption keys to the client device, wherein at least one other CDM in the plurality of CDMs is selected by the client device to decrypt one of the plurality of encrypted licenses/decryption keys using a private key associated with a corresponding public key for the other CDM.

### Claim 9 (depends on 7)

The network device of claim 7, wherein the one or more processors perform actions, further including:
querying the client device to determine which of a plurality of CDMs the client device supports; and
wherein providing each of the encrypted licenses/decryption keys to the client device, further comprises the client device selects which CDM to employ to decrypt one of the plurality of encrypted licenses/decryption keys to enable access to the content.

### Claim 10 (depends on 7)

The network device of claim 7, wherein the one or more processors perform actions, further including:
receiving from the client device, information indicating that the client device supports another CDM absent sending a query request to the client device to determine which CDM is supported by the client device.

### Claim 11 (depends on 7)

The network device of claim 7, wherein the one or more processors perform actions, further including:
determining that a trust relationship is not established for at least one other CDM provider for another CDM; and
based on the determination of no established trust relationship for the one other CDM provider, refusing to employ another public key associated with the other CDM provider to encrypt and send to the client device the license/decryption key.

### Claim 12 (depends on 7)

The network device of claim 7, wherein the one or more processors perform actions, further including:
receiving information indicating that at least one of a private key is compromised or an integrity of at least one component of the client device is compromised, and based on the received information refusing to use the compromised public key or to send the license/decryption key to the compromised client device.

### Claim 13 (depends on 7)

The network device of claim 7, wherein establishing the trust relationship further comprises receiving at least one attestation from a third-party indicating a level of quality of the CDM provider or version of the CDM.

### Claim 14

An apparatus comprising a non-transitory computer readable medium, having computer-executable instructions stored thereon, that in response to execution by a computing device, cause the computing device to perform operations, comprising:
establishing a trust relationship over a network using a cryptographic mechanism with a network device associated with a content decryption module (CDM) provider for a version of a CDM and the computing device that is associated with a content provider;
when information is received from a client device indicating that the client device supports at least the version of the CDM;
determining for which of the supported CDMs the network device has an established trust relationship with a corresponding CDM provider;
using the established trust relationships for the supported CDMs, accessing a public key associated with the version of the CDM;
encrypting a license/decryption key to access content using the accessed public key; and
providing the encrypted license/decryption key to a client device having at least the version of CDM, wherein the version of the CDM is configured to access a protected private key corresponding to the public key, decrypt the encrypted license/decryption key using the private key, and enable access to the content, based in part on an integrity of the client device from tampering including the version of the CDM, the integrity being determined by the version of the CDM; and
when it is determined that no information is received from the client device indicating the client device supports at least the version of the CDM:
using trust relationships established between the network device and a plurality of different CDM providers to access respective public keys associated with CDMs from the plurality of different CDM providers,
encrypting the license/decryption key with each of the accessed public keys to generate a plurality of encrypted licenses/decryption keys, and
providing each of the encrypted licenses/decryption keys to the client device.

### Claim 15 (depends on 14)

The apparatus of claim 14, wherein
sending each of the plurality of encrypted licenses/decryption keys to the client device, further comprises wherein at least one other CDM in the plurality of CDMs is selected by the client device to decrypt an one of the plurality encrypted licenses/decryption keys using a private key associated with a corresponding public key for the other CDM.

### Claim 16 (depends on 14)

The apparatus of claim 14, wherein the operations further comprise:
querying the client device to determine which of a plurality of CDMs the client device supports; and
wherein providing each of the encrypted licenses/decryption keys to the client device, further comprises the client device selects which CDM to employ to decrypt one of the plurality of encrypted licenses/decryption keys to enable access to the media content.

### Claim 17 (depends on 14)

The apparatus of claim 14, wherein the operations further comprise:
receiving from the client device, information indicating that the client device supports another CDM;
determining that a trust relationship is established for the supported other CDM;
based on the results of the determination of the trust relationship for the supported other CDM, encrypting the license/decryption key using another public key associated with the other CDM; and
determining that a trust relationship is not established for at least one other CDM provider for another CDM; and
based on the determination of no established trust relationship, refusing to employ another public key associated with the other CDM provider to encrypt and send to the client device the license/decryption key;
sending to the client device the license/decryption key encrypted with the other public key, wherein the client device selects which CDM to employ to decrypt the encrypted license/decryption key.

### Claim 18 (depends on 14)

The apparatus of claim 14, wherein the operations further comprise:
receiving information indicating that at least one of a public key is compromised, an integrity of at least one component of the client device is compromised, and based on the received information refusing to use the compromised public key, or to send the license/decryption key to the compromised client device.

### Claim 19 (depends on 14)

The apparatus of claim 14, wherein establishing the trust relationship comprises receiving at least one attestation from a third-party indicating a level of quality of the CDM provider or version of the CDM.

### Claim 20 (depends on 14)

The apparatus of claim 14, wherein the trust relationship is based at least in part on a contract agreement between a content provider and the CDM provider.