System and method for controlled copying and moving of content between devices and domains based on conditional encryption of content key depending on usage state

A method, comprising:

• at a first device within a first authorized domain, checking a usage state record contained in a voucher which accompanies a piece of encrypted content, the voucher including the usage state record and an encrypted content key;
• if wherein the usage state record or a domain traversal flag in said voucher indicates that inter- domain copying is allowed:
• decrypting the encrypted content key with a device key;
• re-encrypting the decrypted content key with a public key of a target device within a second authorized domain;
• updating the usage state record;
• and storing the re-encrypted content key and the updated usage state record in a re- targeted voucher;
• and determining to send the encrypted content and the re-targeted voucher to the target device.

An apparatus, comprising:

• a processor;
• and at least one memory including computer program code, the at least one memory and the computer program code configured to, with the processor, cause the apparatus at least to perform:
• at a first device within an authorized domain, check a usage state record contained in a voucher which accompanies a piece of encrypted content, the voucher including the usage state record and an encrypted content key;
• if wherein the usage state record is not unrestricted and allows copying:
• decrypt the encrypted content key with a device key;
• re-encrypt the decrypted content key with a public key of a target device within said authorized domain;
• update the usage state record;
• and store the re-encrypted content key and the updated usage state record in a re- targeted voucher;
• and determine to send the encrypted content and the re-targeted voucher to the target device.

An apparatus, comprising:

• a processor;
• and at least one memory including computer program code, the at least one memory and the computer program code configured to, with the processor, cause the apparatus at least to perform:
• at a first device within a first authorized domain, check a usage state record contained in a voucher which accompanies a piece of encrypted content, the voucher including the usage state record and an encrypted content key;
• if wherein the usage state record or a domain traversal flag in said voucher indicates that inter-domain copying is allowed:
• decrypt the encrypted content key with a device key;
• re-encrypt the decrypted content key with a public key of a target device within a second authorized domain;
• update the usage state record;
• and store the re-encrypted content key and the updated usage state record in a re- targeted voucher;
• and determine to send the encrypted content and the re-targeted voucher to the target device.

A computer program product comprising computer executable program code recorded on a non-transitory computer readable storage medium, the computer executable program code comprising:

• code for causing, at a first device within an authorized domain, check of a usage state record contained in a voucher which accompanies a piece of encrypted content, the voucher including the usage state record and an encrypted content key;
• code for causing if wherein the usage state record is not unrestricted and allows copying:
• decryption of the encrypted content key with a device key;
• re-encryption of the decrypted content key with a public key of a target device within said authorized domain;
• update of the usage state record;
• and store of the re-encrypted content key and the updated usage state record in a re- targeted voucher;
• and code for causing determination to send the encrypted content and the re-targeted voucher to the target device.

A computer program product comprising computer executable program code recorded on a non-transitory computer readable storage medium, the computer executable program code comprising:

• code for causing, at a first device within a first authorized domain, check of a usage state record contained in a voucher which accompanies a piece of encrypted content, the voucher including the usage state record and an encrypted content key;
• code for causing if wherein the usage state record or a domain traversal flag in said voucher indicates that inter-domain copying is allowed:
• decryption of the encrypted content key with a device key;
• re-encryption of the decrypted content key with a public key of a target device within a second authorized domain;
• update of the usage state record;
• and store of the re-encrypted content key and the updated usage state record in a re-targeted voucher;
• and code for causing determination to send the encrypted content and the re-targeted voucher to the target device.

A method of moving protected content between first and second authorized domains, comprising:

• determining, by a server, whether domain traversal is allowed for encrypted content associated with a voucher, the voucher including a domain traversal flag and an encrypted content key, the second authorized domain to receive the encrypted content from the first authorized domain and the first authorized domain being currently authorized to store the content;
• wherein a usage state record and the domain traversal flag in the voucher indicates that inter- domain copying is allowed:
• decrypting, by the server, the encrypted content key with a private key of the server;
• re-encrypting, by the server, the decrypted content key with a public key of a target device within the second authorized domain;
• including, by the server, the domain traversal flag and the re-encrypted content key in a re-targeted voucher;
• and
• sending, by the server, the re-targeted voucher to the target device to thereby enable the target device to decrypt the re-encrypted content key with its private key and decrypt the encrypted content received from the first domain, using the decrypted content key.

An apparatus for moving protected content between first and second authorized domains comprising:

• a processor, and
• at least one memory including computer program code, the at least one memory and the computer program code configured to, with the processor, cause the apparatus at least to perform:
• determining, by a server, whether domain traversal is allowed for encrypted content associated with a voucher, the voucher including a domain traversal flag and an encrypted content key, the second authorized domain to receive the encrypted content from the first authorized domain and the first authorized domain being currently authorized to store the content;
• wherein a usage state record and the domain traversal flag in the voucher indicates that inter- domain copying is allowed:
• decrypting, by the server, the encrypted content key with a private key of the server;
• re-encrypting, by the server, the decrypted content key with a public key of a target device within the second authorized domain;
• including, by the server, the domain traversal flag and the re-encrypted content key in a re-targeted voucher;
• and
• sending, by the server, the encrypted content and the re-targeted voucher to the target device to thereby enable the target device to decrypt the re-encrypted content key with its private key and decrypt the encrypted content received from the first domain, using the decrypted content key.

A computer program product comprising computer executable program code recorded on a non-transitory computer readable storage medium, the computer executable program code for moving protected content between first and second authorized domains, which when executed, performs steps comprising:

• causing determining, by a server, whether domain traversal is allowed for encrypted content associated with a voucher, the voucher including a domain traversal flag and an encrypted content key, the second authorized domain to receive the encrypted content from the first authorized domain and the first authorized domain being currently authorized to store the content;
• wherein a usage state record and the domain traversal flag in the voucher indicates that inter- domain copying is allowed:
• causing decrypting, by the server, the encrypted content key with a private key of the server;
• causing re-encrypting, by the server, the decrypted content key with a public key of a target device within the second authorized domain;
• causing including, by the server, the domain traversal flag and the re-encrypted content key in a re-targeted voucher;
• and
• causing sending, by the server, the encrypted content and the re-targeted voucher to the target device to thereby enable the target device to decrypt the re-encrypted content key with its private key and decrypt the encrypted content received from the first domain, using the decrypted content key.