# US 8,787,579 B2 · Key-based content management and access systems and methods > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,787,579 B2 - Document ID: US8787579B2 - Status: Granted - Kind: B2 - Application number: 12/164,364 - Filed: 2008-06-30 - Published: 2009-12-31 - Granted: 2014-07-22 - Earliest claimed: 2008-06-30 - Assignees: Verizon Patent and Licensing Inc. - Applicants: Don Relyea; Brian Roberts; Michelle Felt - Inventors: Don Relyea; Brian Roberts; Michelle Felt - Web page: https://patentgrep.com/patent/US8787579B2 ## CPC - H04L 63/10: {for controlling access to devices or network resources} - G06F 21/10: Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/102: {Entity profiles} - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - G11B 20/0021: {involving encryption or decryption of contents recorded on or reproduced from a record carrier} - G11B 20/00731: {involving a digital rights management system for enforcing a usage restriction} - H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)} - H04L 2463/101: applying security measures for digital rights management - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G11B: INFORMATION STORAGE BASED ON RELATIVE MOVEMENT BETWEEN RECORD CARRIER AND TRANSDUCER (recording measured values in a way that does not require playback through a transducer G01D9/00; recording or playback apparatus using mechanically marked tape, e.g. punched paper tape, or using unit records, e.g. punched or magnetically marked cards G06K; transferring data from one type of record carrier to another G06K1/18; circuits for coupling output of reproducer to radio receiver H04B1/20; gramophone pick-ups or like acoustic electromechanical transducers or circuits therefor H04R) ## Abstract An exemplary method includes receiving data representative of a content instance over a network from an access device associated with a user, storing the content instance, encrypting the content instance in response to a command initiated by the user, providing a key configured to facilitate decryption of the encrypted content instance, transmitting data representative of the encrypted content instance to a requesting access device, receiving data representative of a request to access the key from the requesting access device over the network, and performing a predefined action related to the key in response to the request and in accordance with at least one access rule, the at least one access rule based on at least one of a user profile and an access device profile. ## Claims ### Claim 1 A method comprising: receiving data representative of a content instance over a network from an access device associated with a first user; storing said content instance; encrypting said content instance in response to a command initiated by said first user by way of one or more graphical user interfaces; providing, in response to said command initiated by said first user to encrypt said content instance, a key configured to facilitate decryption of said content instance; creating, subsequent to said command initiated by said first user to encrypt said content instance and based on input provided by said first user by way of said one or more graphical user interfaces, at least one access rule corresponding to said content instance, said at least one access rule specifying an allowed level of access to said content instance for each of a plurality of different users and an allowed level of access to said content instance for each of a plurality of different types of access devices, wherein said allowed level of access to said content instance for each of said plurality of different types of access devices comprises a full access level to said content instance for a first type of access device included in the plurality of different types of access devices, a read-only access level to said content instance for a second type of access device included in the plurality of different types of access devices, and a no access level to said content instance for a third type of access device included in the plurality of different types of access devices; transmitting data representative of said content instance to a requesting access device associated with a requesting user; receiving, from said requesting access device, data representative of a request to access said key over said network; and performing a predefined action related to said key in response to said request and in accordance with said at least one access rule. ### Claim 2 (depends on 1) The method of claim 1, further comprising providing an interface configured to allow said first user to specify said at least one access rule. ### Claim 3 (depends on 1) The method of claim 1, wherein said predefined action comprises transmitting said key to said requesting access device. ### Claim 4 (depends on 3) The method of claim 3, further comprising using said key to decrypt said content instance. ### Claim 5 (depends on 4) The method of claim 4, further comprising deleting data representative of said key from said requesting access device after said content instance is decrypted. ### Claim 6 (depends on 1) The method of claim 1, further comprising requiring said requesting access device to request said key over said network each time said requesting access device attempts to access said content instance. ### Claim 7 (depends on 1) The method of claim 1, wherein said predefined action comprises denying said requesting access device access to said key. ### Claim 8 (depends on 1) The method of claim 1, further comprising defining said at least one access rule to grant said requesting access device associated with an access device profile at least one type of access to said content instance. ### Claim 9 (depends on 1) The method of claim 1, further comprising encrypting said key and providing another key configured to facilitate decryption of said key. ### Claim 10 (depends on 1) The method of claim 1, further comprising modifying said at least one access rule in response to another command initiated by said first user. ### Claim 11 (depends on 10) The method of claim 10, wherein said modifying of said at least one access rule comprises revoking access to said content instance for a user associated with said requesting access device. ### Claim 12 (depends on 1) The method of claim 1, wherein said at least one access rule specifies a content formatting procedure for said content instance transmitted to said requesting access device associated with said requesting user. ### Claim 13 (depends on 1) The method of claim 1, wherein said at least one access rule comprises restricting access to said content instance based on the network address of said requesting access device. ### Claim 14 (depends on 1) The method of claim 1, wherein said at least one access rule is further based on a user profile of the requesting user. ### Claim 15 A system comprising: a content management subsystem configured to maintain data representative of a plurality of content instances associated with a first user; and an access subsystem associated with said first user and selectively and communicatively coupled to said content management subsystem over a network; wherein said content management subsystem is configured to encrypt said content instance in response to a command initiated by said first user by way of one or more graphical user interfaces, and provide, in response to said command initiated by said first user to encrypt said content instance, a key configured to facilitate decryption of said content instance; wherein said access subsystem is configured to transmit data representative of a content instance to said content management subsystem, and create, subsequent to said command initiated by said first user to encrypt said content instance and based on input provided by said first user by way of said one or more graphical user interfaces, at least one access rule corresponding to said content instance, said at least one access rule specifying an allowed level of access to said content instance for each of a plurality of different users and an allowed level of access to said content instance for each of a plurality of different types of access devices, wherein said allowed level of access to said content instance for each of said plurality of different types of access devices comprises a full access level to said content instance for a first type of access device included in the plurality of different types of access devices, a read-only access level to said content instance for a second type of access device included in the plurality of different types of access devices, and a no access level to said content instance for a third type of access device included in the plurality of different types of access devices; and wherein said content management subsystem is further configured to receive, from a requesting access device associated with a requesting user, data representative of a request to access said key, and perform a predefined action related to said key in response to said request and in accordance with said at least one access rule. ### Claim 16 (depends on 15) The system of claim 15, wherein said predefined action comprises transmitting said key to said requesting access device. ### Claim 17 (depends on 15) The system of claim 15, wherein said predefined action comprises denying said requesting access device access to said key. ### Claim 18 (depends on 15) The system of claim 15, wherein said at least one access rule is configured to grant said requesting access device associated with said requesting user at least one type of access to said content instance. ### Claim 19 (depends on 15) The system of claim 15, wherein said content management subsystem is further configured to encrypt said key and provide another key configured to facilitate decryption of said key. ### Claim 20 (depends on 15) The system of claim 15, wherein said content management subsystem is further configured to modify said at least one access rule in response to another command initiated by said first user. ### Claim 21 A system comprising: a communication facility configured to receive data representative of a content instance over a network from an access device associated with a first user; a data store configured to store said data representative of said content instance; and a processing facility configured to: encrypt said content instance in response to a command initiated by said first user by way of one or more graphical user interfaces and provide, in response to said command initiated by said first user to encrypt said content instance, a key configured to facilitate decryption of said content instance, and create, subsequent to said command initiated by said first user to encrypt said content instance and based on input provided by said first user by way of said one or more graphical user interfaces, at least one access rule corresponding to said content instance, said at least one access rule specifying an allowed level of access to said content instance for each of a plurality of different users and an allowed level of access to said content instance for each of a plurality of different types of access devices, wherein said allowed level of access to said content instance for each of said plurality of different types of access devices comprises a full access level to said content instance for a first type of access device included in the plurality of different types of access devices, a read-only access level to said content instance for a second type of access device included in the plurality of different types of access devices, and a no access level to said content instance for a third type of access device included in the plurality of different types of access devices; wherein said communication facility is further configured to transmit data representative of said content instance to a requesting access device and receive, from said requesting access device, data representative of a request to access said key over said network; and wherein said processing facility is further configured to perform a predefined action related to said key in response to said request and in accordance with said at least one access rule. ### Claim 22 (depends on 21) The system of claim 21, wherein said predefined action comprises directing said communication facility to transmit said key to said requesting access device. ### Claim 23 (depends on 21) The system of claim 21, wherein said predefined action comprises denying said requesting access device access to said key. ### Claim 24 (depends on 21) The system of claim 21, wherein said at least one access rule is configured to grant said requesting access device associated with said requesting user at least one type of access to said content instance.