Systems and methods are described for performing policy-managed, peer-to-peer service orchestration in a manner that supports the formation of self-organizing service networks that enable rich media experiences. In one embodiment, services are distributed across peer-to-peer communicating nodes, and each node provides message routing and orchestration using a message pump and workflow collator. Distributed policy management of service interfaces helps to provide trust and security, supporting commercial exchange of value. Peer-to-peer messaging and workflow collation allow services to be dynamically created from a heterogeneous set of primitive services. The shared resources are services of many different types, using different service interface bindings beyond those typically supported in a web service deployments built on UDDI, SOAP, and WSDL. In a preferred embodiment, a media services framework is provided that enables nodes to find one another, interact, exchange value, and cooperate across tiers of networks from WANs to PANs.

Interoperable systems and methods for peer-to-peer service orchestration

An architecture and methodology for designing, deploying, and managing a distributed application onto a distributed computing system is described.

Architecture for distributed computing system and automated design, deployment, and management of distributed applications

Systems and methods are described for performing digital rights management. In one embodiment, a digital rights management engine is provided that evaluates license associated with protected content to determine if a requested access or other use of the content is authorized. In some embodiments, the licenses contain control programs that are executable by the digital rights management engine.

Digital rights management engine systems and methods

Methods and apparatus for control of data and content protection mechanisms across a network using a download delivery paradigm. In one embodiment, conditional access (CA), digital rights management (DRM), and trusted domain (TD) security policies are delivered, configured and enforced with respect to consumer premises equipment (CPE) within a cable television network. A trusted domain is established within the user's premises within which content access, distribution, and reproduction can be controlled remotely by the network operator. The content may be distributed to secure or non-secure “output” domains consistent with the security policies enforced by secure CA, DRM, and TD clients running within the trusted domain. Legacy and retail CPE models are also supported. A network security architecture comprising an authentication proxy (AP), provisioning system (MPS), and conditional access system (CAS) is also disclosed, which can interface with a trusted authority (TA) for cryptographic element management and CPE/user device authentication.

Downloadable security and protection methods and apparatus

Apparatus and methods for provisioning of customer premise equipment (CPE) equipped with a secure microprocessor to receive e.g., digital video content by entering unique identification of the CPE at one or more servers located at the headend or other location of a content-based network. In one embodiment, the CPE comprises a download-enabled (e.g., DCAS) host with embedded cable modem and embedded set-top box functionality, and the provisioning includes enabling DOCSIS functionality of the CPE, assigning an IP address to the CPE and providing the CPE with a client image for the conditional access system chosen by the network operator. In one variant, the network operator can deactivate a provisioned device while connected to the network, as well when disconnected from the network. The network operator can also add, delete or replace conditional access client image in a provisioned device.

Apparatus and methods for provisioning in a download-enabled system

A system and method is disclosed for allowing content providers to protect against widespread copying of their content, while enabling them to give their customers more freedom in the way they use the content. In accordance with one embodiment, content providers identify their content as protected by watermarking the content. Consumers use compliant devices to access protected content. All of a user's compliant devices, or all of a family's devices, can be organized into an authorized domain. This authorized domain is used by content providers to create a logical boundary in which they can allow users increased freedom to use their content.

System and method for controlled copying and moving of content between devices and domains based on conditional encryption of content key depending on usage state

Enforcement of geographic and location based constraints on content distribution is provided to allow distribution of content to remote devices while preventing unauthorized use and consumption of the content. Content requested by a device may be protected using a variety of content protection mechanisms that support geographic constraints. The requesting device may be required to validate and/or obtain the device's physical location prior to being granted access to the protected content. The requesting device may validate and/or obtain its physical location by requesting location information from a location server or another geographic aware device. The distribution of the location information from the location server may be limited to a predefined proximity. The proximity limit on the dissemination of the location information prevents remote devices from fraudulently using the location information. Location information may be encapsulated and may be formatted as a content file.

Enforcing geographic constraints in content distribution

Domain membership vouchers are transmitted to devices (104) in response to domain membership requests and domain joining requests. These vouchers include domain identifiers and domain keys encrypted with the public keys of the requesting devices. Once received, the domain membership vouchers establish the devices as members of authorized domains (110). Such authorized domains allow the sharing of protected content among devices within a particular authorized domain.

Enforcing authorized domains with domain membership vouchers

A first device (108) transfers to a second device (110) content that is encrypted with a content key. The second device requests access to the content from an authorized agent (106). Upon a determination that any conditions for approving such a request are satisfied, the authorized agent decrypts a superdistribution key with its private key (154), and encrypts the resultant content key with the public key of the second device (142). This encryption produces a protected content key, which is sent to the second device. Upon receipt of this protected content key, the second device will be able to access the content by decrypting the protected content key with a private key of the second device (144). At this point, the second device may decrypt the content key with the content key.

Method and system for content distribution

A system and method is disclosed for providing DRM in a broadcast environment. In accordance with the embodiment, a DRM system distributes encrypted service keys over the mobile telephone network to a mobile terminal. The mobile terminal receives the encrypted service key and uses it to decrypt encrypted content keys received from a DVB set top box. The decrypted content keys are sent to the set box over local link where they are used to decrypt encrypted broadcast content. A power management technique for mobile receivers is also disclosed that enables the receiver hardware to power off during a portion of the rendering process.

Jukka Alve

Papers

System and method for controlled copying and moving of content between devices and domains based on conditional encryption of content key depending on usage state

Enforcing geographic constraints in content distribution

Enforcing authorized domains with domain membership vouchers

Method and system for content distribution

System and method for using DRM to control conditional access to broadband digital content