US20070033407A1 - Systems and methods for governing content rendering, protection, and management applications - Google Patents

Abstract

System and methods are disclosed for governing digital rights management systems and other applications through the use of supervisory governance applications and keying mechanisms. Governance is provided by enabling the supervisory applications to revoke access keys and/or to block certain file system calls, thus preventing governed applications from accessing protected electronic content.

Description

RELATED APPLICATIONS
• This application is a continuation of application Ser. No. 09/874,744, filed on Jun. 4, 2001, and claims the benefit of priority from U.S. Provisional Patent Application No. 60/209,454, entitled “Systems and Methods for Governing Content Rendering, Protection, and Management Applications,” filed Jun. 4, 2000, all of which are incorporated herein by reference.
COPYRIGHT AUTHORIZATION
• A portion of the disclosure of this patent document contains material which is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent file or records, but otherwise reserves all copyright rights whatsoever.
FIELD OF THE INVENTION
• The present invention relates generally to the management of electronic content. More specifically, systems and methods are disclosed for governing and managing content-rendering applications and content protection and management mechanisms.
BACKGROUND OF THE INVENTION
• Advances in electronic communications, storage, and processing technology have led to an increasing demand for digital content. Today, large quantities of information can be readily encoded and stored on compact and easily-transportable media, and can be conveniently accessed using high-speed connections to networks such as the Internet, or via wireless communication networks such as W-LAN, W-WAN, and cellular.
• However, despite the demand for digital content, and the availability of technology that enables its efficient creation and distribution, the threat of piracy has kept the market for digital goods from reaching its full potential, for while one of the great advantages of digital technology is that it enables information to be perfectly reproduced at little cost, this is also a great threat to the rights and interests of artists, content producers, businesses, and other copyright holders who often expend substantial amounts of time and money to create original works. As a result, content owners are often reluctant to distribute their works in electronic form—or are forced to distribute their works at inflated (or deflated) prices to account for piracy—thus limiting the efficiency and proliferation of the market for digital goods, both in terms of the selection of material that is available and the means by which that material is distributed.
• While increasing attention has been paid to the development of digital rights management (DRM) mechanisms to address the problems described above, the large number of competing—and typically incompatible—rights management systems have created interoperability and security problems of their own. As a result, content owners are often reluctant to entrust their content to any of the array of content management mechanisms and content-rendering applications that presently exist in the marketplace.
SUMMARY OF THE INVENTION
• The present invention provides systems and methods for enabling content owners, industry organizations, and other interested parties to supervise or govern the application programs, devices, and rights management systems that are used to render, protect, or otherwise access or use electronic content. It should be appreciated that the present invention can be implemented in numerous ways, including as a process, an apparatus, a system, a device, a method, a computer readable medium, or a combination thereof. Several inventive embodiments are described below.
• In one embodiment a supervisory management system is disclosed. A secure processing application acts as the supervisor of a second application. The secure processing application is used to access protected digital information that is stored in a secure electronic container. The secure processing application extracts secret information—such as an access key or a portion of an access key—that is needed by the second application to access protected content. Revocation of the second application's authorization to process protected content can be accomplished by revoking access to the secure container through the secure processing application. In one embodiment, the second application is a digital rights management system that is operable to manage the use of content to which the supervisory management system has granted access. The content may consist of encrypted content and rules that govern the content's use. In this embodiment, the second application is operable to ensure that the content is used in accordance with the rules. If it is determined that the second application is not adequately enforcing the rules, the supervisory management system can revoke the second application's ability to access the content and/or the second application's ability to grant access to the content.
• In another embodiment, a governance system is established by using a first application to act as a supervisory digital rights managements system that controls a second application. The second application is managed or controlled by linking with the first application. The first application filters or mediates the calls from the second application to certain native platform services. When the second application makes calls to its native platform prior to opening a file, the request is filtered through the first application, which applies rules and/or credential checks to regulate or manage the files to which the second application is granted access.
• In yet another embodiment a method is disclosed for utilizing one digital rights management application to govern the operation of another digital rights management application. A control application receives a request to access electronic content from the governed application. The control application also receives a keyshare from the governed application. The control application requests another keyshare from the governing digital rights management application. If certain conditions are satisfied, the governing application supplies its keyshare to the control application. The control application uses the two keyshares to retrieve information that is needed by the governed application to access the requested content. The control application retrieves the protected content and provides it to the governed application (or provides the information needed by the governed application to access the protected content).
• In another illustrative embodiment, a system for controlling access to electronic content is described. The system includes a first application program that is configured to request access to protected electronic content. The first application manages the electronic content in accordance with rules that are associated therewith. In addition, a second application program is provided for releasing the protected electronic content to the first application program in response to the first application's request. The second application is capable of receiving information from a third party or external source that indicates whether or not the second application should grant access to the protected electronic content to the first application.
• In another embodiment, a method is described for controlling an application's access to electronic content. When the application attempts to retrieve electronic content by invoking standard file system calls, these calls are routed to a special conformance library which invokes a governance engine. The governance engine is designed to perform integrity checks on the application program to detect improper modifications. If the application program has been improperly modified, the governance engine will deny access to the content by blocking the file system calls. Furthermore, the conformance library will also determine if the application program has received affirmative authorization to access electronic content. If no authorization is detected, then the application program will be denied access to the electronic content. Otherwise, the application is allowed to access the electronic content.
• These and other features and advantages of the present invention will be presented in more detail in the following detailed description and the accompanying figures which illustrate by way of example the principles of the invention.
BRIEF DESCRIPTION OF THE DRAWINGS
• The present invention will be readily understood by the following detailed description in conjunction with the accompanying drawings, wherein like reference numerals designate like structural elements, and in which:
• FIG. 1 illustrates a system for governing the operation of other digital rights management systems using a supervisory digital rights management system.
• FIG. 2 illustrates the use of a secure processing application to manage a second digital rights management application.
• FIG. 3A illustrates a conventional mechanism for accessing electronic content.
• FIG. 3B illustrates a system for governing a content rendering and/or management application in accordance with an embodiment of the present invention.
• FIG. 3C illustrates a system for governing a content rendering and/or management application in accordance with another embodiment of the present invention.
• FIG. 4 illustrates a method for governing content rendering applications and digital rights management systems.
DETAILED DESCRIPTION
• A detailed description of the invention is provided below. While the invention is described in conjunction with several embodiments, it should be understood that the invention is not limited to any one embodiment. Instead, the scope of the invention is defined only by the appended claims, and encompasses numerous alternatives, modifications, and equivalents. While numerous specific details are set forth in the following description in order to provide a thorough understanding of the present invention, the present invention may be practiced without some or all of these details. Moreover, for the purpose of clarity, certain technical material that is known in the art related to the invention has not been described in detail in order to avoid unnecessarily obscuring the present invention. For example, reference will be made to a number of terms and concepts that are well-known in the field of cryptography. Background information on cryptography can be found, for example, in Menezes et al.,Handbook of Applied Cryptography(CRC Press 1996)(“Menezes”), and Schneier,Applied Cryptography,2d ed. (John Wiley & Sons1995).
Governance Via a Secure Processing Application
• In one embodiment a secure processing application (e.g., a supervisory digital rights management system) is provided to govern the operation of a second application. The second application may include other digital rights management systems or other applications. For example, the second application might comprise a music player, video streaming application, text reader, or the like. The supervisory DRM system has the ability to revoke the second application's ability to access information that the second application needs in order to grant access to content. The content may be deployed in a globally interoperable fashion or in a non-interoperable fashion.
• Referring toFIG. 1, asecure processing application100 is installed on a PC client, computing device, and/orcommerce service101. As described in more detail below, thesecure processing application100 acts as the supervisor of asecond application103 which may also be installed onsystem101. Alternatively,application100 may be installed on a computer system that is remote from the system on whichapplication103 is installed.
• As shown inFIG. 1,secure processing application100 preferably includes (or is able to establish) a protectedprocessing environment110 and a protecteddatabase104. Thesecure processing application100 is preferably able to process protected data (e.g., cryptographic keys130) and to enforce rules or controls (e.g., control105) that are associated with the content.
• In one embodiment,secure processing application100 comprises an instance of the InterRights Point™ software or the Rights/System™ software produced by InterTrust Technologies Corporation of 4750 Patrick Henry Drive, Santa Clara, Calif., although one of ordinary skill in the art will recognize that other suitable secure processing applications and/or digital rights management applications could be used instead. For example, without limitation,secure processing application100 could comprise software and/or hardware that implements some or all of the virtual distribution environment functionality and features described in commonly-assigned U.S. Pat. No. 5,892,900, entitled “Systems and Methods for Secure Transaction Management and Electronic Rights Protection,” issued Apr. 6, 1999 (“the '900 patent”), which is hereby incorporated by reference in its entirety. In one embodiment,secure processing application100 is a relatively small footprint piece of software and/or hardware that is operable to perform the key management and revocation functionality set forth herein, but little if anything else. In a preferred embodiment,secure processing application100 is constructed using security and tamper resistance techniques such as those described in the '900 patent to ensure that it functions in a relatively secure and reliable fashion.
• As shown inFIG. 1,secure processing application100 is used to access protecteddigital information130 that is stored in a secureelectronic container106 and/or in protecteddatabase104. The secure electronic container can take any suitable form. For example, secureelectronic container106 might comprise a DigiBox® or DigiFile™ container produced by InterTrust Technologies Corporation, or might simply consist of an encrypted version of the protected digital information. In other embodiments, other secure container formats—such as those described in the '900 patent or available commercially—could be used. Similarly, protecteddatabase104 may also be implemented in any suitable manner, including without limitation as described in the '900 patent and/or commonly-assigned U.S. patent application Ser. No. 09/617,148, entitled “Trusted Storage Systems and Methods”, filed Jul. 17, 2000, which is hereby incorporated by reference.
• As shown inFIG. 1, in response to arequest112 fromapplication103 to accesscontent108,secure processing application100 extracts secret information—such as access key130—from secure container106 (e.g., by decrypting the relevant portion of secure container106) and/or protecteddatabase104, and forwards this information (or information derived from, controlled by, or otherwise related to this information) toapplication103. This secret information is needed byapplication103 to access protectedcontent108 and to render or makeavailable plaintext content109. Alternatively,secure processing application100 may itself decrypt protectedcontent108, thus obviating the need to forwardapplication103 theinformation130 needed to access the content. In either case, revocation ofapplication103's authorization to process protectedcontent108 can be effectuated simply by revokingapplication103's access to, or use of, thesecret information130 controlled bysecure processing application100. For example, acontrol105 could be delivered to secureapplication100 that indicates thatapplication103 is not to be granted access (or certain types of access) to the secret information contained insecure container106 or in protecteddatabase104. Similarly, another control could be delivered to indicate that access to the secret information should be restored. Additional information on exemplary implementations of controls such as these can be found in the '900 patent, which was previously incorporated by reference.
• In some embodiments, the operation and security of some portion ofapplication103 may be tested (e.g., before deployment) to ensure compliance with operational and security requirements of the content owner and/or system administrator. For example, the content owner or system administrator can establish the necessary criteria or minimal requirements thatapplication103 must satisfy in order to render or process protectedcontent108. If it is subsequently discovered thatapplication103 is no longer meeting these requirements, thenapplication103's ability to access and/or manage content can be revoked, e.g., in the manner described above.
• FIG. 2 illustrates an embodiment of a system related to the one shown inFIG. 1. As inFIG. 1,application103 may comprise a DRM system or content rendering application that seeks to manage or render protectedcontent108. As shown inFIG. 2, acontrol application120 is communicatively coupled to bothapplication100 andapplication103.Control application120 may, for example, be created or supplied by a trusted third party (e.g., a party other than the providers ofapplication100 and application103), or may be provided by the provider ofsecure processing application100.Control application120 controls access to database107, which may be provided by the same party that provided thecontrol application120, or by a different party, and may, likecontrol application120, be located on the same system asapplication100 and/orapplication103, or on a different system.
• As shown inFIG. 2,application103 provides keyshare and/orother identification information140 to controlapplication120. Thisinformation140 is used byapplication120 to obtain access to information stored in a database107. A keyshare may, for example, simply comprise a portion of a decryption key.Control application120 is also supplied with a keyshare134 (or an entire key) bysecure processing application100. As shown inFIG. 2,application100 may have retrieved keyshare (or key)134 from asecure container132 and may have used acontrol105 stored in its protecteddatabase104 to decide whether to supplykeyshare134 to controlapplication120. The use of controls to govern the use of content is described in more detail in the '900 patent, which was previously incorporated herein by reference.Control application120 useskeyshares134 and140—and possibly other keyshares maintained bycontrol application120 or obtained from other sources—to retrieve information142 (such as a decryption key) needed to provide access tocontent108.Control application120 supplies this information toDRM application103, which uses it to access protectedcontent108. Having obtained access tocontent108,DRM application103 governs it in accordance with any rules with which it is associated, and, if appropriate, may provideplaintext content109 to a user or rendering application. In some embodiments,control application120 may be operable to decrypt protectedcontent108 itself, thus avoiding the need to send the information needed to decrypt (or otherwise gain access to) protectedcontent108 toapplication100 orapplication103.
• The systems described above allow different DRM systems and applications to operate fairly independently (with respect to other key management techniques that may be available for protecting content), while also leveraging the hardware and/or software security features of thesecure processing application100. As noted above, the access key can be split between thesecure processing application100 and theDRM application103, so that ifapplication103 has superior software and/or hardware security capabilities to that ofapplication100, the protection offered byDRM application103 would not be compromised if the security ofapplication100 was compromised. As discussed above, shares of keys could be split among applications, portable devices, local content management modules, and secure containers. For example,secure container132 could hold a share of a key necessary for theapplication103 to establish a secure channel with a portable device, a share of a key used in the IEEE 1394 protocol, and so forth.
• In addition, in some embodiments controlapplication120 can effectively serve as a mediator between two or more digital rights management systems (e.g.,application100 and103), giving any digital rights management system the ability to supervise or control the operation of the others. Referring toFIG. 2, for example, certain content owners or distributors may want the ability to revoke access tocontent108 using either digitalrights management system100 or103, thus obtaining some level of redundant protection in case either one of the rights management systems is cracked. This could be accomplished using the arrangement shown inFIG. 2, where either one of the rights management system's ability to access protectedcontent108 and/or the information contained in trusted database107 could be controlled by sending appropriate commands or controls to the other rights management system. Thus, as shown inFIG. 2, protectedcontent108 could be packaged in the encoding format used byDRM application103, thus givingDRM system103 the ability to manage the distribution and use of the content; however, this encoded content would itself be protected (e.g., further encrypted) such thatDRM application100 would be able to supervise the operation ofapplication103 and revoke access tocontent108 if desired. Similarly, other pieces of content could be packaged in the encoding format used byDRM application100, thus givingDRM application100 the ability to manage the distribution and use of the content; however, this encoded content could itself be protected such thatDRM application103 would be able to supervise the operation ofapplication100, and revoke access to the content if desired. Moreover, if either DRM system was compromised, the content owner could, if desired, prevent further access to the content simply by sending an appropriate control to the DRM system that had not been compromised.
• In some embodiments, key distribution and revocation schemes such as those described in Naor et al. and the CPRM standard can be used to provide control over local DRM systems or devices. See Naor et al., “Revocation and Tracing Schemes for Stateless Receivers,” available at http://citeseer.nj.nec.com/420701.html (February 2001). In such embodiments, sets of keys (or keyshares) are distributed to local DRM systems or devices (or classes of local DRM systems or devices), and, as described above, those keys are used to access information needed by the local DRM system or device to access content or to perform certain functions. These keys can be revoked and/or updated using the mechanisms described in Naor et al. and the CPRM standard, thus providing a way to control/supervise the operation of the local DRM system or device. For example, if a finite geometry key distribution mechanism is used, and each device or application is given a series (or distinguished subset) of keys, revocation can be accomplished by removing a series of keys from the key geometry.
• An advantage of such an implementation is that a local DRM system (such asapplication103 inFIGS. 1 and 2) can be controlled without the necessity of also installing a secure processing application such asapplication100 on the local system, and/or without having to interactively communicate with such anapplication100 afterapplication103 has been deployed. A disadvantage of such a technique is that it can be relatively difficult to implement an efficient revocation mechanism, especially one that enables revocation of previously-packaged content.
Governance Via a Conformance Library and Credentials
• In another embodiment, an application running on a host computer system is governed by linking it to (or incorporating it with) a special conformance library. The conformance library filters or mediates certain requests from the governed application to the host computer system's native platform services (e.g., file input/output and the like). The conformance library invokes a supervisory application that determines whether the governed application has been improperly modified and whether it is authorized to perform the requested action. If the supervisory application determines that the governed application has not been improperly modified and is authorized to perform the requested action, then the governed application's request is forwarded to the appropriate host system service, which fulfills the request just as it would had the supervisory application not first intercepted it. Several illustrative embodiments of the foregoing process are described below in connection withFIGS. 3A, 3B, and3C.
• FIG. 3A illustrates the conventional manner by which anapplication302 accesseselectronic content304 on a host computer system.Application302 may, for example, comprise a digital rights management application, content viewer, or any other type of application that assists or contributes to the use, rendering, distribution, or management of digital information. As shown inFIG. 3A, whenapplication302 wishes to accesscontent304, it typically makes a call, via an application programming interface (API)306, to a library of functions and procedures provided by the host system for performing the detailed, low-level operations involved in retrieving the electronic content from the host system's storage and providing it to the requesting application.
• FIG. 3B shows how the conventional system ofFIG. 3A can be modified to provide governance over the operation of anapplication320. As shown inFIG. 3B, whenapplication320 wishes to access a piece ofelectronic content304, it makes a call to a modified version of the host system's file input/output API312. Calls to the modified API are handled byconformance library314, which is operable to route these calls to a governance engine (also referred to as a supervisory application)316 which determines whether the application's access request should be granted or denied. Ifsupervisory application316 determines that the request should be granted, it routes the request to the host system's file I/O library308 via the host system'sAPI306. The host system then performs the necessary operations to retrieve theelectronic content304 forapplication320.
• It will be appreciated that anapplication302 that was initially designed to operate in the manner shown inFIG. 3A need not undergo substantial modification to operate in the manner shown inFIG. 3B. For example,application302 can simply be modified to indicate that calls to the host system's file I/O library308 should be handled, instead, byconformance library314. This would typically involve a few relatively minor changes to the application's header files, and not to the body of the application (e.g., the actual form of the calls would remain unchanged, the only change being to the identification of the library that handles those calls). Thus, in such an embodiment, modified file I/O API312 would be virtually identical in form to the host system's file I/O API306. Alternatively, each occurrence in the application of certain file I/O calls could be modified to refer directly to a corresponding function in theconformance library314, although these modified calls would preferably be similar in form to the original file I/O calls (i.e., the modified file I/O API312 would preferably be similar to the host system's API306). Thus, in a preferred embodiment the application developer can integrate the supervisory application with the governed application quite easily, with little or no modification to the governed application, thus limiting the likelihood that bugs will be introduced into the application, or that call-paths through the governed application will be missed and governance compromised. In addition, the conformance library will typically be easy to test since it is preferably API-compatible with the standard platform interfaces.Application320 need not be integrated in any other capacity with the system ofgovernance engine316.
• FIG. 3C illustrates another embodiment of a system for governing an application in accordance with the present invention. Referring toFIG. 3C, agovernance application360 is linked via aconformance library351 to a governedapplication352. Theconformance library351 implements interfaces that that the governedapplication352 must call, thereby governing the file I/O calls (e.g., file system calls, the ability to load other code dynamically, other system calls such as Kernel32 or Win32 API calls, and the like) from the governedapplication352. Theconformance library351 effectively looks like a replacement set of file system I/O calls, and possibly a small set of additional calls (for example, GetProcAddress and LoadLibrary on Windows).
• A mediator/shim354 re-implements the actual file I/O calls through afilter355 where the governed calls are controlled by theconformance library351. The governance system effectively enforces the requirement that the file I/O call go through theconformance library351 first. The mediator/shim354 of theconformance library351 may incorporate additional logic which, e.g., (a) allows it to verify or validate that a legitimate authorization certificate/conformance certificate has been given by the content owner, and (b) to force a credential check on theapplication352 to ensure that it and/or theconformance library351 have not been modified.
• In a preferred embodiment, theconformance library351 makes calls togovernance engine360.Governance engine360 may, for example, be in the form of a commercial digital rights managements application, such as InterTrust's InterRights Point software or Rights/System software.Governance engine360 may be installed on the same computer system asapplication352, or may reside elsewhere, such as on a remote server.
• Thegovernance engine360 checks the credential(s)361 associated with theapplication352 and/or theconformance library351. For example, if thecredential361 comprises a digitally-signed cryptographic hash or checksum, thegovernance engine360 preferably verifies the authenticity of the digital signature, then computes the corresponding hash or checksum on the appropriate portions of the governedapplication352 and/orconformance library351 to determine whether the governed application and/or library have been modified. If a strong, one-way hashing algorithm such as SHA-1 is used to generate a hash of the application and/or conformance library (or selected portions thereof), then it will be computationally infeasible to modify the hashed portions without detection by the governance engine (i.e., the hash computed by the governance engine of the modified application will not be the same as the hash contained in the credential).
• If thegovernance engine360 determines that the application has not been modified, then thegovernance engine360 checks thecertificate362 associated with the application to determine whether the application is authorized to perform the action that it is seeking to perform. In one embodiment, the application'scertificate362 forms part ofcredential361. In other embodiments, the certificate may be maintained independently bygovernance engine360, the association between the certificate andapplication352 being accomplished via credential361 (e.g., the cryptographic hash or checksum of the application serving to identify the application to the governance engine as the possessor of the authorizations specified in the certificate (which might also contain the hash or checksum)).
• Thecertificate362 serves as a cross-reference to ensure that theapplication352 is authorized by the content owner as a certified or compliant application in conformance with desired characteristics. It is intended that the content owner will be provided with, or have access to, sufficient tools for generating “authorization certificates” forapplications352 that implement theconformance library351. The content owner may be responsible for establishing the appropriate criteria for the issuance of the certificates (and for checking for compliance therewith). In this regard, it will be appreciated that any suitable technique can be used to generate and utilize the conformance credentials and certificates, including without limitation the credentialing techniques described in the '900 patent, Menezes at pages 321-481, U.S. Pat. No. 6,157,721, entitled “Systems and Methods Using Cryptography to Protect Secure Computing Environments,” issued Dec. 5, 2000 (“the '721 patent”), U.S. patent application Ser. No. 09/628,692, entitled “Systems and Methods for Using Cryptography to Protect Secure and Insecure Computing Environments,” filed Jul. 28, 2000, U.S. Patent Application No. 60/210,479, entitled “Rights Management Systems and Methods,” filed Jun. 9, 2000, U.S. patent application Ser. No. 09/863,199, entitled “Trust Management Systems and Methods,” filed May 21, 2001, each of which is hereby incorporated by reference in its entirety, and U.S. patent application Ser. No. 09/879,743, entitled “Rights Management Systems and Methods,” filed Jun. 11, 2001, which claims benefit to Provisional Application No. 60/210,479, filed Jun. 9, 2000.
• In one embodiment, after the application vendor has implemented thelibrary351 and received acertificate362, it presents the application and certificate to the third-party governance service identified by the content owner. The third-party governance service generates acredential361 which wraps the certificate so that it cannot be tampered with (e.g., using a one-way cryptographic hash); the credential is strongly authenticated and bound to the application. The vendor receives everything back along with the credential. The application vendor distributes its product in the normal manner. In this embodiment, updates to the application may require re-credentialing. Applications that use the library need not ship the governance engine, but once enabled with the library, will only be able execute content-owner-controlled functions in the presence of the governance engine.
• FIG. 4 illustrates a method for governing content rendering applications and digital rights management systems using the system shown inFIG. 3C. As shown inFIGS. 3C and 4, when a content rendering application or digitalrights management system352 starts, it makes a call to initialize a conformance library351 (401).Conformance library351 opens a connection with a governance engine360 (402) and forces a credential check (403). Ifcredential361 is bad (i.e., a “No” exit from block404), the conformance library returns an initialization failure (405) that disables the application and returns a system error. Alternatively, other failure modes could be used, including, for example, continuing operation but providing the user with a means of obtaining a new credential.
• Referring back toFIG. 4, ifcredential361 is good (i.e., a “Yes” exit from block404),application352checks certificate362 to determine whether the application is authorized by the content owner to access content (406). If authorization is detected (i.e., a “Yes” exit from block407), theconformance library351 will pass subsequent API calls through to the host system's file I/O API, and theapplication352 will run normally (408). If authorization is not detected (i.e., a “No” exit from block407), the application's calls will not be passed through to the file system, and the application will thus be unable to perform the governed operations.
• It will be appreciated that a number of variations can be made to the process shown inFIG. 4 without departing from the principles of the present invention. For example, whileFIG. 4 shows a process for determining once, when an application is initiated, whether the application is authentic and is authorized to perform certain actions, it should be appreciated that alternatively, or in addition, the application's integrity and/or authorization could be checked by the supervisory application each time the application seeks to perform one of the governed operations, or at predefined intervals.
• In a preferred embodiment, theconformance library351 requires governance to be affected by an enforceable set of interactions with thegovernance engine360 using the application credentialing mechanism. However, unless the provider of thegovernance engine360 certifies theapplication352, thecredential361 imposes no other control over the operation of the application352 (and the application developer need not learn anything more about the governance engine provider's system). An application that incorporates this mechanism may pick up some additional runtime characteristics, such as runtime anti-debugging, tamper resistance, and/or the like.
• In one embodiment, the actual determination of whether a governed application has the right to render or use digital information is made by functions implemented by the conformance library that validate the content owner's certificate. However, the governance interaction of establishing a valid session with the governance engine and checking the credential is first performed in order to determine whether the conformance library should be allowed to access the certificate at all. If the credential is valid, the conformance library is allowed to retrieve the certificate, and if the certificate is valid, the conformance library allows the governed calls (e.g., file I/O calls) to proceed in the normal manner. Theconformance library351 thus implements logic that: (a) checks for a credential issued by the content owner or some other entity, and (b) implements non-subvertible linkage and calls to the underlying governance engine. Thus, in this embodiment, the provider of the governance engine effectively enables the management of the governed application, but the policies and rules that affect whether or not the application can actually render content or perform other controlled operations are established by authentication of the content owner's certificate. Thus, content owners can establish a third-party governance engine that enables strong enforcement of the content owners' policies without imposing additional policies of the third-party provider of the governance engine. Revocation can also be handled by using expiring credentials and/or certificates, and forcing updates on a predefined, periodic basis—for example, quarterly, yearly, daily, or on a different time period or basis.
• As indicated previously, in other embodiments the application's certificate (or additional certificates associated therewith) may be maintained and enforced by the governance engine itself, rather than the conformance library. This allows the content owner (and/or the provider of the governance engine) to dynamically revoke the certificates simply by sending appropriate commands to the governance engine (e.g., sending a new certificate or control that revokes the original certificate).
• Although the foregoing invention has been described in some detail for purposes of clarity, it will be apparent that certain changes and modifications may be practiced within the scope of the appended claims. It should be noted that there are many alternative ways of implementing both the processes and apparatuses of the present invention. Accordingly, the present embodiments are to be considered as illustrative and not restrictive, and the invention is not to be limited to the details given herein, but may be modified within the scope and equivalents of the appended claims.

Claims (16)

1-18. (canceled)

19. A method of controlling access to electronic content by an application program running on a host computer system, the method including:

generating a request to access a piece of electronic content, the request being generated by the application program and comprising, at least in part, a call to a conformance library running on the host computer system; and

in response to the call to the conformance library, connecting the conformance library to a governance engine on the host computer system, the governance engine being operable to govern, at least in part, the operation of the application program, the governance engine performing the following steps:

(i) performing an integrity check on the application program, the integrity check being operable to (a) detect improper modifications to at least part of the application program and (b) deny access to the piece of electronic content if an improper modification is detected; and

(ii) performing an authorization check, the authorization check being operable to (a) determine if the application program is authorized to access electronic content and (b) deny access to the piece of electronic content if authorization is not detected; and

retrieving the piece of electronic content from a file system of the host computer system if permitted by the governance engine.

20. A method as inclaim 19, wherein the application program comprises a content rendering application.

21. A method as inclaim 19, wherein the application program comprises a digital rights management program, the digital rights management program being operable to manage the use of the piece of electronic content in accordance with one or more rules with which the piece of electronic content is associated.

22. A method as inclaim 19, wherein performing the authorization check includes examining one or more digital certificates associated with the application program, the one or more digital certificates specifying, at least in part, the nature of the application program's authorization to access electronic content.

23. A method as inclaim 22, wherein one or more of the digital certificates is operable to expire at a predefined time, and wherein the application program's authorization to access electronic content expires when said one or more digital certificates expire.

24. A method as inclaim 23, wherein the governance engine is operable to receive one or more new digital certificates to replace one or more expired digital certificates, and wherein the application program's authorization to access electronic content is renewed when said one or more new digital certificates are received by the governance engine.

25. A method as inclaim 19, wherein performing the integrity check includes generating a cryptographic hash of at least part of the application program, and comparing the generated cryptographic hash to a previously generated cryptographic hash.

26. A method of controlling access to electronic content, the method comprising:

receiving, at a conformance library running on a computer system, a request from a governed application running on the computer system to access a piece of electronic content, wherein the conformance library implements one or more interfaces that the governed application calls to access the electronic content, and wherein the request to access the piece of electronic content comprises at least a first call to at least a first interface of said one or more interfaces that the conformance library implements;

connecting to a supervisory application, the supervisory application being operable to check a credential associated with the governed application, the supervisory application being further operable to disable access to the piece of electronic content by the governed application if the credential check fails; and

enabling access to the piece of electronic content by the governed application after completion of a successful credential check, wherein said enabling step includes making at least a second call to at least a second interface, and wherein the second interface comprises a file input/output interface of the computer system that corresponds to said first interface implemented by the conformance library.

27. The method ofclaim 26, further comprising invoking the supervisory application prior to the step of connecting to the supervisory application.

28. The method ofclaim 26, wherein the credential check comprises an integrity check on the governed application, the integrity check being operable to (a) detect improper modifications to at least part of the governed application and (b) deny access to the piece of electronic content if an improper modification is detected.

29. The method ofclaim 26, wherein the supervisory application is further operable to perform an authorization check, the authorization check being operable to (a) determine if the governed application is authorized to access the piece of electronic content and (b) deny access to the piece of electronic content if authorization is not detected.

30. A computer-readable storage medium storing instructions that, when executed by a computer, cause the computer to perform steps comprising:

receiving a request from a governed application running on the computer to access a piece of electronic content, wherein the request to access the piece of electronic content comprises at least a first call to at least a first interface;

connecting to a supervisory application running on the computer, the supervisory application being operable to check a credential associated with the governed application, the supervisory application being further operable to disable access to the piece of electronic content by the governed application if the credential check fails; and

enabling access to the piece of electronic content by the governed application upon completion of a successful credential check, wherein said enabling includes making at least a second call to at least a second interface, and wherein the second interface comprises a file input/output interface of the computer that corresponds to said first interface.

31. The medium ofclaim 30, further comprising instructions that, when executed by the computer, cause the computer to invoke the supervisory application prior to connecting to the supervisory application.

32. The medium ofclaim 30, wherein the credential check comprises an integrity check, the integrity check being operable to (a) detect improper modifications to at least part of the governed application and (b) deny access to the piece of electronic content if an improper modification is detected.

33. The medium ofclaim 30, further comprising instructions that, when executed by the computer, cause the computer to perform an authorization check, the authorization check being operable to (a) determine if the governed application is authorized to access the piece of electronic content, and (b) deny access to the piece of electronic content if authorization is not detected.

Images