REGISTER  |  SIGN IN
United States Patent5917912
Ginter , ; et al.June 29, 1999
Title
System and methods for secure transaction management and electronic rights protection
Abstract
The present invention provides systems and methods for secure transaction management and electronic rights protection. Electronic appliances such as computers equipped in accordance with the present invention help to ensure that information is accessed and used only in authorized ways, and maintain the integrity, availability, and/or confidentiality of the information. Such electronic appliances provide a distributed virtual distribution environment (VDE) that may enforce a secure chain of handling and control, for example, to control and/or meter or otherwise monitor use of electronically stored or disseminated information. Such a virtual distribution environment may be used to protect rights of various participants in electronic commerce and other electronic or electronic-facilitated transactions. Distributed and other operating systems, environments and architectures, such as, for example, those using tamper-resistant hardware-based processors, may establish security at each node. These techniques may be used to support an all-electronic information distribution, for example, utilizing the "electronic highway."
Inventors:Ginter; Karl L. (Beltsville, MD), Shear; Victor H.  (Bethesda, MD), Spahn; Francis J.  (El Cerrito, CA), Van Wie; David M.  (Sunnyvale, CA)
Assignee:InterTrust Technologies Corporation (Sunnyvale, CA)
Appl. No.:780545
Filed:January 8, 1997
Current U.S. Class:713/187 719/312 705/40 713/164 
Field of Search:380/4,25 395/186,683,684
U.S. Patent Documents
3573747April 1971Adams et al.
3609697September 1971Blevins
3796830March 1974Smith
3798359March 1974Feistel
3798360March 1974Feistel
3798605March 1974Feistel
3806882April 1974Clarke
3829833August 1974Freeny, Jr.
3906448September 1975Henriques
3911397October 1975Freeny, Jr.
3924065December 1975Freeny, Jr.
3931504January 1976Jacoby
3946220March 1976Brobeck et al.
3956615May 1976Anderson et al.
3958081May 1976Ehrsam et al.
3970992July 1976Boothroyd et al.
4048619September 1977Forman, Jr. et al.
4071911January 1978Mazur
4112421September 1978Freeny, Jr.
4120030October 1978Johnstone
4163280July 1979Mori et al.
4168396September 1979Best
4196310April 1980Forman et al.
4200913April 1980Kuhar et al.
4209787June 1980Freeny, Jr.
4217588August 1980Freeny, Jr.
4220991September 1980Hamano et al.
4232193November 1980Gerard
4232317November 1980Freeny, Jr.
4236217November 1980Kennedy
4253157February 1981Kirschner et al.
4262329April 1981Bright et al.
4265371May 1981Desai et al.
4270182May 1981Asija
4278837July 1981Best
4305131December 1981Best
4306289December 1981Lumley
4309569January 1982Merkle
4319079March 1982Best
4323921April 1982Guillou
4328544May 1982Baldwin et al.
4337483June 1982Guillou
4361877November 1982Dyer et al.
4375579March 1983Davida et al.
4433207February 1984Best
4434464February 1984Suzuki et al.
4442486April 1984Mayer
4446519May 1984Thomas
4454594June 1984Heffron et al.
4458315July 1984Uchenick
4462076July 1984Smith, III
4462078July 1984Ross
4465901August 1984Best
4471163September 1984Donald et al.
4484217November 1984Block et al.
4494156January 1985Kadison et al.
4513174April 1985Herman
4528588July 1985Lofberg
4528643July 1985Freeny, Jr.
4553252November 1985Egendorf
4558176December 1985Matyas et al.
4558413December 1985Schmidt et al.
4562306December 1985Chou et al.
4562495December 1985Bond et al.
4577289March 1986Comerford et al.
4584641April 1986Guglielmino
4588991May 1986Atalla
4589064May 1986Chiba et al.
4593353June 1986Pickholtz
4593376June 1986Volk
4595950June 1986Lofberg
4597058June 1986Izumi et al.
4634807January 1987Chorley et al.
4644493February 1987Chandra et al.
4646234February 1987Tolman et al.
4652990March 1987Pailen et al.
4658093April 1987Hellman
4670857June 1987Rackman
4672572June 1987Alsberg
4677434June 1987Fascenda
4680731July 1987Izumi et al.
4683553July 1987Mollier
4685056August 1987Barnsdale et al.
4688169August 1987Joshi
4691350September 1987Kleijne et al.
4696034September 1987Wiedemer
4701846October 1987Ikeda et al.
4712238December 1987Gilhousen et al.
4713753December 1987Boebert et al.
4740890April 1988William
4747139May 1988Taaffe
4757533July 1988Allen et al.
4768087August 1988Taub et al.
4791565December 1988Dunham et al.
4796181January 1989Wiedemer
4799156January 1989Shavit et al.
4807288February 1989Ugon et al.
4817140March 1989Chandra et al.
4823264April 1989Deming
4827508May 1989Shear
4858121August 1989Barber et al.
4864494September 1989Kobus
4868877September 1989Fischer
4903296February 1990Chandra et al.
4924378May 1990Hershey et al.
4930073May 1990Cina, Jr.
4949187August 1990Cohen
4977594December 1990Shear
4999806March 1991Chernow et al.
5001752March 1991Fischer
5005122April 1991Griffin et al.
5005200April 1991Fisher
5010571April 1991Katznelson
5023907June 1991Johnson et al.
5047928September 1991Wiedemer
5048085September 1991Abraham et al.
5050213September 1991Shear
5091966February 1992Bloomberg et al.
5103392April 1992Mori
5103476April 1992Waite et al.
5111390May 1992Ketcham
5119493June 1992Janis et al.
5128525July 1992Stearns et al.
5136643August 1992Fischer
5136646August 1992Haber et al.
5136647August 1992Haber et al.
5136716August 1992Harvey et al.
5146575September 1992Nolan, Jr.
5148481September 1992Abraham et al.
5155680October 1992Wiedemer
5168147December 1992Bloomberg
5185717February 1993Mori
5201046April 1993Goldberg et al.
5201047April 1993Maki et al.
5208748May 1993Flores et al.
5214702May 1993Fischer
5216603June 1993Flores et al.
5221833June 1993Hecht
5222134June 1993Waite et al.
5224160June 1993Paulini et al.
5224163June 1993Gasser et al.
5235642August 1993Wobber et al.
5245165September 1993Zhang
5260999November 1993Wyman
5263158November 1993Janis
5265164November 1993Matyas et al.
5276735January 1994Boebert et al.
5280479January 1994Mary
5285494February 1994Sprecher et al.
5301231April 1994Abraham et al.
5311591May 1994Fischer
5319705June 1994Halter et al.
5337360August 1994Fischer
5341429August 1994Stringer et al.
5343527August 1994Moore
5347579September 1994Blandford
5351293September 1994Michener et al.
5355474October 1994Thuraisngham et al.
5373561December 1994Haber et al.
5390247February 1995Fischer
5390330February 1995Talati
5392220February 1995van den Hamer et al.
5392390February 1995Crozier
5394469February 1995Nagel et al.
5410598April 1995Shear
5412717May 1995Fischer
5421006May 1995Jablon
5422953June 1995Fischer
5428606June 1995Moskowitz
5438508August 1995Wyman
5442645August 1995Ugon
5444779August 1995Daniele
5449895September 1995Hecht et al.
5449896September 1995Hecht et al.
5450493September 1995Maher
5453601September 1995Rosen
5453605September 1995Hecht et al.
5455407October 1995Rosen
5455861October 1995Faucher et al.
5455953October 1995Russell
5457736October 1995Dolphin
5457746October 1995Dolphin
5463565October 1995Cookson et al.
5473687December 1995Lipscomb et al.
5473692December 1995Davis
5479509December 1995Ugon
5485622January 1996Yamaki
5491800February 1996Goldsmith et al.
5497479March 1996Hornbuckle
5497491March 1996Mitchell et al.
5499298March 1996Narasimhalu et al.
5504757April 1996Cook et al.
5504818April 1996Okano
5504837April 1996Griffeth et al.
5508913April 1996Yamamoto et al.
5509070April 1996Schull
5513261April 1996Maher
5530235June 1996Stefik et al.
5530752June 1996Rubin
5533123July 1996Force et al.
5534975July 1996Stefik et al.
5537526July 1996Anderson et al.
5539735July 1996Moskowitz
5539828July 1996Davis
5550971August 1996Brunner et al.
5553282September 1996Parrish et al.
5557518September 1996Rosen
5563946October 1996Cooper et al.
5568552October 1996Davis
5572673November 1996Shurts
5592549January 1997Nagel et al.
5606609February 1997Houser et al.
5613004March 1997Cooperman et al.
5621797April 1997Rosen
5629980May 1997Stefik et al.
5633932May 1997Davis et al.
5634012May 1997Stefik et al.
5636292June 1997Rhoads
5638443June 1997Stefik
5638504June 1997Scott et al.
5640546June 1997Gopinath et al.
5655077August 1997Jones et al.
5687236November 1997Moskowitz et al.
5689587November 1997Bender et al.
5692180November 1997Lee
5710834January 1998Rhoads
5740549April 1998Reilly et al.
5745604April 1998Rhoads
5748763May 1998Rhoads
5748783May 1998Rhoads
5748960May 1998Fischer
5754849May 1998Dyer et al.
5757914May 1998McManis
5758152May 1998LeTourneau
5765152June 1998Erickson
5768426June 1998Rhoads
Foreign Patent Documents
0 370 146Nov., 1988EP
0 456 386 A2Nov., 1991EP
0 469 864 A2Feb., 1992EP
0 469 864 A3Feb., 1992EP
0 593 305 A2Apr., 1994EP
0 651 554 A1May., 1995EP
0 668 695 A2Aug., 1995EP
0 695 985 A1Jan., 1996EP
0 696 798 A1Feb., 1996EP
0 725 376Jan., 1996EP
0 778 513 A2Jun., 1997EP
0 795 873 A2Sep., 1997EP
0 84 441Jul., 1983EP
0128672Dec., 1984EP
0180460May., 1986EP
0399822A2Nov., 1990EP
0421409A2Apr., 1991EP
0565314A2Oct., 1993EP
0715243A1Jun., 1996EP
0715244A1Jun., 1996EP
0715245A1Jun., 1996EP
0715246A1Jun., 1996EP
0715247A1Jun., 1996EP
0749081A1Dec., 1996EP
1-068835Mar., 1989JP
2-242352Sep., 1990JP
2-247763Oct., 1990JP
2-294855Dec., 1990JP
2264796Sep., 1993GB
2294348Apr., 1996GB
2295947Jun., 1996GB
3803982A1Jan., 1990DE
4-369068Dec., 1992JP
5-181734Jul., 1993JP
5-257783Oct., 1993JP
5-268415Oct., 1993JP
57-726May., 1982JP
6-175794Jun., 1994JP
6-215010Aug., 1994JP
62-241061Oct., 1987JP
6225059Aug., 1994JP
64-68835Mar., 1989JP
7-056794Mar., 1995JP
7-084852Mar., 1995JP
7-141138Jun., 1995JP
7-200317Aug., 1995JP
7-200492Aug., 1995JP
7-244639Sep., 1995JP
8-137795May., 1996JP
8-152990Jun., 1996JP
8-185298Jul., 1996JP
9 004 79Dec., 1984BE
A0135422Mar., 1985EP
A2136175Sep., 1984GB
WO 85/03584Aug., 1985WO
WO 94/01821Jan., 1994WO
WO 94/16395Jul., 1994WO
WO 94/18620Aug., 1994WO
WO 94/22266Sep., 1994WO
WO 94/27406Nov., 1994WO
WO 96/00963Jan., 1996WO
WO 96/03835Feb., 1996WO
WO 96/05698Feb., 1996WO
WO 96/06503Feb., 1996WO
WO 97/03423Jan., 1997WO
WO 97/48203Dec., 1997WO
WO90/02382Mar., 1990WO
WO92/06438Apr., 1992WO
WO92/22870Dec., 1992WO
WO93/01550Jan., 1993WO
WO94/03859Feb., 1994WO
WO9406103Mar., 1994WO
WO95/14289May., 1995WO
WO96/13013May., 1996WO
WO96/21192Jul., 1996WO
WO97/07656Mar., 1997WO
WO97/32251Sep., 1997WO
WOA8502310May., 1985WO
Other References
Applications Requirements for Innovative Video Programming: How to Foster (or Cripple) Program Development Opportunities for Interactive Video Programs Delivered on Optical Media; A Challenge for the Introduction of DVD (Digital Video Disc) (Oct. 19-20, 1995, Sheraton Universal Hotel, Universal City CA). .
Bruner, Rick E., PowerAgent, NetBot help advertisers reach Internet shoppers, Aug. 1997 (Document from Internet). .
CD ROM, Introducing . . . The Workflow CD-ROM Sampler, Creative Networks, MCIMail: Creative Networks, Inc., Palo Alto, California. .
Clark, Tim, Ad service gives cash back, www.news.com, Aug. 4, 1997, 2 pages (Document from Internet). .
Dempsey, et al., D-Lib Magazine, July/August 1996 The Warwick Metadata Workshop: A Framework for the Deployent of Resource Description, Jul. 15, 1966. .
Firefly Network, Inc., www.ffly.com, What is Firefly? Firefly revision: 41.4 Copyright 1995, 1996. .
Gleick, James, "Dead as a Dollar" The New York Times Magazine, Jun. 16, 1996, Section 6, pp. 26-30, 35, 42, 50, 54. .
Harman, Harry H., Modern Factor Analysis, Third Edition Revised, University of Chicago Press Chicago and London, Third revision published 1976. .
Herzberg, Amir et al., Public Protection of Software, ACM Transactions on Computer Systems, vol. 5, No. 4, Nov. 1987, pp. 371-393. .
Holt, Stannie, Start-up promises user confidentiality in Web marketing service, Info World Electric, Aug. 13, 1997 (Document from Internet). .
Jiang, et al, A concept-Based Approach to Retrieval from an Electronic Industrialn Directory, International Journal of Electronic Commerce, vol. 1, No. 1, Fall 1996, pp. 51-72. .
Jones, Debra, Top Tech Stories, PowerAgent Introducts First Internet `Infomediary` to Empower and Protect Consumers, Aug. 13, 1997 3 pages (Document from Internet). .
Lagoze, Carl, D-Lib Magazine, July/August 1996, The Warwick Framework, A Container Architecture for Diverse Sets of Metadata. .
Maclachlan, Malcolm, PowerAgent Debuts Spam-Free Marketing, TechWire, Aug. 13, 1997, 3 pages (Document from Internet). .
Mossberg, Walter S., Personal Technology, Threats to Privacy On-Line Become More Worrisome, Wall Street Journal, Oct. 24, 1996. .
Negroponte, Electronic Word of Mouth, Wired Oct. 1996, p. 218. .
PowerAgent Inc., Proper Use of Consumer Information on the Internet White Paper, Jun. 1997, Document from Internet, 9 pages (Document from Internet). .
PowerAgent Press Releases, What the Experts are Reporting on PowerAgent, Aug. 13, 1997, 6 pages (Document from Internet). .
PowerAgent Press Releases, What the Experts are Reporting on PowerAgent, Aug. 4, 1997, 5 pages (Document from Internet). .
PowerAgent Press Releases, What the Experts are Reporting on PowerAgent, Aug. 13, 1997, 3 pages (Document from Internet). .
Resnick, et al., Recommender Systems, Communications of the ACM, vol. 40, No. 3, Mar. 1997, pp. 56-89. .
Rothstein, Edward, The New York Times, Technology, Connections, Making th eInternet come to you, through `push` technology . . . p. D5, Jan. 20, 1997. .
Rutkowski, Ken, PowerAgent Introduces First Internet `Infomediary` to Empower and Protect Consumers, Tech Talk News Story, Aug. 4, 1997 (Document from Internet). .
Sager, Ira (Edited by), Bits & Bytes, Business Week, Sep. 23, 1996, p. 142E. .
Schurmann, Jurgen, Pattern Classification, A Unified View of Statistical and Neural Approaches, John Wiley & Sons, Inc., 1996. .
Special Report, The Internet:Fulfilling the Promise The Internet: Bring Order From Chaos; Lynch, Clifford, Search the Internet; Resnick, Paul, Filtering Information on the Internet; Hearst, Marti A., Interfaces for Searching the Web; Stefik, Mark, Trusted Systems; Scientific American, Mar. 1997, pp. 49-56, 62-64, 68-72, 78-81. .
Stefik, Mark, Introduction to Knowledge Systems, Chapter 7, Classification, pp. 543-607, 1995 by Morgan Kaufmann Publishers, Inc. .
Voight, Joan, Beyond the Banner, Wired, Dec. 1996, pp. 196, 200, 204. .
Vonder Haar, Steven, PowerAgent Launches Commercial Service, Inter@ctive Week, Aug. 4, 1997 (Document from Internet). .
Amerke, David, et al., News Release, AT&T, Jan. 9, 1995, AT&T encryption system protects information services, 1 page. .
AT&T Technology, vol. 9, No. 4, New Products, Systems and Services, pp. 16-19. .
Barassi, Theodore Sedgwick Esq., The Cybernotary: Public Key Registration and Certificaiton and Authentication of International Legal Transactions, 4 pages. .
Communications of the ACM, Jun. 1996, vol. 39, No. 6. .
Cunningham, Donna, et al., News Release, AT&T, Jan. 31, 1995, AT&T, VLSI Technology join to improve info highway security, 3 pages. .
Data Sheet, About the Digital Notary Service, Surety Technologies, Inc., 1994-1995, 6 pages. .
DiscStore (Electronic Pulishing Resources 1991). .
Document from Internet, cgi@ncsa.uiuc.edu, CGI Common Gateway Interface, 1 page, 1996. .
Electronic Publishing Resources Inc. Protecting Electronically Published Properties Increasing Publishing Profits (Electronic Publishing Resources 1991). .
Greguras, Fred, Softic Symposium '95, Copyright Clearances and Moral Rights, Nov. 30, 1995 (as updated Dec. 11, 1995), 3 pages. .
HOTJAVA.TM.: The Security Story, 4 pages. .
Invoice? What is an Invoice? Business Week, Jun. 10, 1996. .
JAVASOFT, Frequently Asked Questions -- Applet Security, What's Java.TM.? Products and Services, Java/Soft News, Developer's Cornier,Jun. 7, 1996, 8 pages. .
Kohntopp, M., Sag's durch die Blume, Apr. 1996, marit@schulung.netuse.de .
Milbrandt, E., Stenanography Info and Archive, 1996. .
News Release, Premenos Announces Templar 2.0 -- Next Generation Software for Secure Internet EDI, webmaster@templar.net, 1 page, Jan. 17, 1996. .
News Release, The Document Company Xerox, Xerox Announces Software Kit For Creating Working Documents With Dataglyphs, Nov. 6, 1995, Minneapolis, MN, 13 pages. .
Premenos Corp. White Paper: The Future of Electronic Commerce, A Supplement to Midrange Systems, Internet webmaster@premenos.com, 4 pages. .
Press Release, National Semiconductor and EPR Partner For Information Metering/Data Security Cards (Mar. 4, 1994). .
ROI (Personal Library Software, 1987 or 1988). .
ROI-Solving Critical Electronic Publishing Problems (Personal Library Software, 1987 or 1988). .
Shear, Solutions for CD-ROM Pricing and Data Security Problems, pp. 530-533, CD ROM Yearbook 1988-1989 (Microsoft Press 1988 or 1989). .
Stefik, Internet Dreams: Archetypes, Myths, and Metaphors, Letting Loose the Light: Igniting Commerce in Electronic Publication, pp. 219-253, (1996) Massachusetts Institute of Technology. .
Stefik, Mark, Letting Loose the Light, Igniting Commerce in Electronic Publication, (1994, 1995) Palo Alto, California. .
Templar Overview,: Premenos, Internet info@templar.net, 4 pages. .
Templar Software and Services: Secure, Reliable, Standards-Based EDI Over the Internet, Prementos, Internet info@templar.net, 1page. .
The Benefits of ROI For Database Protection and Usage Based Billing (Personal Library Software, 1987 or 1988). .
Weber, Dr. Robert, Digital Rights Management Technologies, A Report to the International Federation of Reproduction Rights Organisations, Oct. 1995,pp. 1-49. .
Weber, Dr. Robert, Digital Rights Management Technologies, Oct. 1995, 21 pages. .
Weber, Metering Technologies for Digital Intellectual Property, A Report to the International Federation of Reproduction Rights Organisations, pp. 1-29; Oct. 1994, Boston, MA, USA. .
WEPIN Store, Stenography (Hidden Writing) (Common Law 1995). .
World Wide Web FAQ, How can I put an access counter on my home page?, 1 page, 1996. .
Yellin, F. Low Level Security in Java, 8 pages. .
Yee, "Using Secure Coprocessors," CMU-CS-94-149, School of Computer Science, Carnegie Mellon University, Pittsburgh, PA 15213. .
Tygar et al., "Dyad: A System for Using Physically Secure Coprocessors," School of Computer Science, Carnegie Mellon University, Pittsburgh, PA 15213 (undated). .
Tygar et al., "Dyad: A System for Using Physically Secure Coprocessors," School of Computer Science, Carnegie Mellon University, Pittsburgh, PA 15213 (May 1991). .
Maxemchuk, "Electronic Document Distribution," AT&T Bell Laboratories, Murry Hill, New Jersey 07974. .
Choudhury, et al., "Copyright Protection for Electronic Publishing over Computer Networks," At&T Bell Laboratores, Murray Hill, New Jersey 07974 (Jun. 1994). .
Weingart, "Physical Security for the .mu.ABYSS System," IBM Thomas J. Watson Research Center, Yorktown Heights, New York 10598 (1987). .
White, "ABYSS: A Trusted Architecture for Software Protection," IBM Thomas J. Watson Research Center, Yorktown Heights, New York 10598 (1987). .
Neumann, et al., "A Provably Secure Operating System: The System, Its Applications, and Proofs," Computer Science Laboratory Report CSL-116, Second Edition, SRI International (May, 1980). .
Caruso, "Technology, Digital Commerce 2 plans for watermarks, which can bind proof of authorship to electronic works," New York Times (Aug. 1995). .
"Electronic Currency Requirements, XIWT (Cross Industry Working Group)," no date. .
"NII, Architecture Requirements, XIWT," no date. .
Arthur K. Reilly, "Standards committee T1--Telecommunications,"Input to the `International Telecommunications Hearings,` Panel 1: Component Technologies of the NII/GII, no date. .
Dan Bart, Comments in the Matter of Public Hearing and Request for Comments on the International Aspects of the National Information Infrastructure, Aug. 12, 1994. .
"Open System Environment Architectural Framework for National Infrastructure Services and Standards, in Support of National Class Distributed Systems," Distributed System Engineering Program Sponsor Group, Draft 1.0, Aug. 5, 1994. .
"Information Infrastructure Standards Panel: NII `The Information Superhighway`," NationsBank -- HGDeal -- ASC X9, 15 pages. .
Jud Hofmann, "Interfacing the NII to User Homes," Electronic Industries Association, Consumer Electronic Bus Committee, 14 slides, no date. .
"Framework for National Information Infrastructure Services," NIST, Jul. 1994, 12 slides. .
Claude Baggett, "Cable's Emerging Role in the Information Superhighway," Cable Labs, 13 slides. .
"IISP Break Out Session Report for Group Number 3, Standards Development and Tracking System," no date. .
"XIWT Cross Industry Working Team," 5 pages, Jul. 1994. .
"Computer Systems Policy Project (CSSP), Perspectives on the National Information Infrastructure: Ensuring Interoperability (Feb. 1994)," Feb. 1994. .
"Framework for National Information Infrastructure Services," Draft, U.S. Department of Commerce, Jul. 1994. .
"EIA and TIA White Paper on National Information Infrastructure,"published by the Electronic Industries Association and the Telecommunications Industry Association, Washington, D.C., no date. .
Michael Baum, "Worldwide Electronic Commerce: Law, Policy and Controls Conference," program details, Nov. 11, 1993. .
Bruce Sterling, "Literary freeware: Not for Commercial Use," remarks at Computers, Freedom and Privace Conference IV, Chicago, Mar. 26, 1994. .
"The 1:1 Future of the Electronic Marketplace: Return to a Hunting and Gathering Society," 2 pages, no date. .
D. Linda Garcia, testimony before a hearing on science, space and technology, May 26, 1994. .
Wired 1.02, "Is Advertising Really dead?, Part 2," 1994. .
Hugh Barnes, memo to Henry LaMuth, subject: George Gilder articles, May 31, 1994. .
Daniel J. Weitzner, A Statement on EFF's Open Platform Campaign as of Nov., 1993, 3 pages. .
"Serving the Community: A Public-Interest Vision of the National Information Infrastructure," Computer Professionals for Social Responsibility, Executive Summary, no date. .
Steven Schlossstein, International Economy, "America: The G7's Comeback Kid," Jun./Jul. 1993. .
Lance Rose, "Cyberspace and the Legal Matrix: Laws or Confusion?," 1991. .
"Cable Television and America's Telecommunications Infrastructure," National Cable Television Association, Apr. 1993. .
Adele Weder, "Life on the Infohighway," 4 pages, no date. .
T. Valovic, Telecommunications, "The Role of Computer Networking in the Emerging Virtual Marketplace," pp. 40-44. .
Dr. Joseph N. Pelton, Telecommunications, "Why Nicholas Negroponte is Wrong About the Future of Telecommunication," pp. 35-40, Jan. 1993. .
Nicholas Negroponte, Telecommunications, "Some Thoughts on Likely and expected Communications scenarios: A Rebuttal," pp. 41-42, Jan. 1993. .
Tom Stephenson, Advanced Imaging, "The Info Infrastructure Initiative: Data SuperHighways and You," pp. 73-74, May 1993. .
Steve Rosenthal, New Media, "Mega Channels," pp. 36-46, Sep. 1993. .
News Release, The White House, Office of the President, "Background on the Administration's Telecommunications Policy Reform Initiative," Jan. 11, 1994. .
Steve Rosenthal, New Media, "Interactive Network: Viewers Get Involoved," pp. 30-31, Dec. 1992. .
Steve Rosenthal, New Media, "Interactive TV: The Gold Rush Is On," pp. 27-29, Dec. 1992. .
EFFector Online vol. 6 No. 6, "A Publication of the Electronic Frontier Foundation," 8 pages, Dec. 6, 1993. .
Mike Lanza, electronic mail, "George Gilder's Fifth Article -- Digital Darkhorse -- Newspapers," Feb. 21, 1994. .
Steven Levy, Wired, "E-Money, That's What I Want," 10 pages, Dec. 1994. .
Keven Kelly, Whole Earth Review, "E-Money,"pp. 40-59, Summer 1993. .
Green paper, "Intellectual Property and the National Information Infrastructure, a Preliminary Draft of the Report of the Working Group on Intellectual Property Rights," Jul. 1994. .
Communications of the ACM, "Intelligent Agents," Jul. 1994, vol. 37, No. 7. .
"Encapsulation: An Approach to Operating System Security," Bisbey, II et al., Oct. 1973, pp. 666-675. .
"Encryption Methods in Data Networks," Blom et al., Ericsson Technics, No. 2, 1978, Stockholm, Sweden. .
First CII Honeywell Bull International Symposium on Computer Security and Confidentiality, Jan. 26-28, 1981, Conference Text, pp. 1-21. .
Codercard, Spec Sheet -- Basic Coder Subsystem, No date given. .
"Micro Card" -- Micro Card Technologies, Inc., Dallas, Texas, No date given. .
"A Method of Software Protection Based on the Use of Smart Cards and Cryptographic Techniques," Scnaumueller-Bichl et al., No date given. .
.vertline. "The New Alexandria" No. 1, Alexandria Institute, pp. 1-12, Jul.-Aug. 1986. .
Denning et al., "Data Security," 11 Computing Surveys No. 3, Sep. 1979. .
Kent, "Protecting Externally Supplied Software in Small Computers" (MIT/LCS/TR-255 Sep. 1980). .
Proceedings of the IEEE, vol. 67, No. 3, Mar. 1979, "Privacy and Authentication: An Introduction to Cryptography," Whitfield Diffie and Martin E. Hellman, pp. 397-427. .
Digest of Papers, VLSI: New Architectural Horizons, Feb. 1980, "Preventing Software Piracy With Crypto-Microprocessors," Robert M. Best, pp. 466-469. .
IEEE Transactions on Information Theory, vol. 22, No. 6, Nov. 1976, "New Directions in Cryptography," Whitfield Diffie and Martin E. Hellman, pp. 644-651. .
Low, et al., "Anonymous Credit Cards," AT&T Bell Laboratories, Proceedings of the 2nd ACM Conference on Computer and Communication Security, Fairfax, Virginia, Nov. 2-4, 1994. .
Ivgar et al., "Cryptography: It's Not Just For Electronic Mail Anymore," CMU-CS-93-107, School of Computer Science Carnegie Mellon University, Pittsburgh, Pennsylvania, Mar. 1, 1993. .
Smith, et al., "Signed Vector Timestamps: A Secure Protocol for Partial Order Time," CMU-93-116, School of Computer Science Carnegie Mellon University, Pittsburgh, Pennsylvania, Oct. 1991; version of Feb. 1993. .
Kristol et al., "Anonymous Internet Mercantile Protocol," AT&T Bell Laboratories, Murray Hill, New Jersey, Draft: Mar. 17, 1994. .
Low et al., "Document Marking and Identification using both Line and Word Shifting," AT&T Bell Laboratories, Murray Hill, New Jersey, Jul. 29, 1994. .
Low et al., "Anonymous Credit Cards and its Collusion Analysis," AT&T Bell Laboratories, Murray Hill, New Jersey, Oct. 10, 1994. .
Ryoichi Mori and Masaji Kawahara, The Transactions of the Eieice, V, "Superdistribution: The Concept and the Architecture," E73 (Jul. 1990), No. 7, Tokyo, Japan. .
Argent Information Q&A Sheet, http://www.digital-watermark.com/, Copyright 1995, The DICE Company, 7 pages. .
Struif, Bruno "The Use of Chipcards for Electronic Signatures and Encryption" in: Proceedings for the 1989 Conference on VSLI and Computer Peripherals, IEEE Computer Society Press, 1989, pp. 4/155-4/158. .
Dusse, Stephen R. and Burton S. Kaliski "A Cryptographic Library for the Motorola 56000" in Damgard, I. M., Advances in Cryptology-Proceedings EUROCRYPT 90, Springer-Verlag, 1991, pp. 230-244. .
DSP56000/DSP56001 Digital Signal Processor User's Manual, Motorola, 1990, p. 2-2. .
Rankine, G., "Thomas -- A Complete Single-Chip RSA Device," Advances in Cryptography, Proceedings of CRYPTO 86, pp. 480-487 (A.M. Odlyzko Ed., Springer-Verlag 1987). .
Guillou, L.: "Smart Cards and Conditional Access", pp. 480-490 Advances in Cryptography, Proceedings of EuroCrypt 84 (Beth et al, Ed., Springer-Verlag 1985). .
Dyson, Esther, "Intellectual Value," Wired Magazine, Jul. 1995, pp. 136-141 and 182-184. .
IBM Technical Disclosure Bulletin, "Multimedia Mixed Object Envelopes Supporting a Graduated Fee Scheme via Encryption," vol. 37, No. 03, Mar. 1994, Armonk, NY. .
IBM Technical Disclosure Bulletin, "Transformer Rules for Software Distribution Mechanism-Support Products," vol. 37, No. 04B, Apr. 1994, Armonk, NY. .
Suida, Karl, Mapping New Applications Onto New Technologies, "Security Services in Telecommunications Networks," Mar. 8-10, 1988, Zurich. .
Portland Software's ZipLock, Internet information, Copyright Portland Software, 1996-1997, 12 pages..~
Primary Examiner: Barron, Jr.; Gilberto
Attorney, Agent or Firm:Nixon & Vanderhye P.C.
Parent Case Text


This is a divisional of Ser. No. 08/388,107, filed Feb. 13, 1995, abandoned .
Claims

We claim:
1. A process which takes place in an apparatus including a secure processing unit, comprising the following steps:
accessing a first record containing information directly or indirectly identifying one or more elements of a first component assembly, at least one of said elements including at least some executable programming;
using said information to identify and locate said one or more elements;
said step of identifying and locating one or more elements includes locating one or more load modules, said load module(s) locating step comprising:
searching in at least one memory of said secure processing unit to determine whether at least one of said one or more load modules is located in said memory;
if at least one of said one or more load modules is located in a memory of said secure processing unit, loading and using said load module without decrypting said load module; and
if at least one of said one or more load modules is located outside of a memory of said secure processing unit, decrypting said load module prior to use of said load module;
accessing said located one or more elements;
securely assembling said one or more elements to form at least a portion of said first component assembly; and
executing at least some of said executable programming.

2. A process as in claim 1 in which at least one memory of said secure processing unit contains at least one load module relating to a budget method.

3. A process as in claim 1 in which at least one memory of said secure processing unit contains at least one load module relating to a billing method.

4. A process as in claim 1 in which at least one memory of said secure processing unit contains at least one load module relating to an audit method.

5. A process as in claim 1 in which at least one memory of said secure processing unit contains at least one load module relating to an aggregate method comprising budgeting, billing and auditing functions.

6. A process comprising the following steps:
accessing a first record containing information directly or indirectly identifying one or more elements of a first component assembly,
at least one of said elements including at least some executable programming,
at least one of said elements constituting a load module,
said load module including executable programming and a header;
at least a portion of said header is a public portion which is characterized by a relatively lower level of security protection; and
at least a portion of said header is a private portion which is characterized, at least some of the time, by a level of security protection which is relatively higher than said relatively lower level of security protection,
using said information to identify and locate said one or more elements;
accessing said located one or more elements;
securely assembling said one or more elements to form at least a portion of said first component assembly;
executing at least some of said executable programming; and
checking said record for validity prior to performing said executing step.

7. A process as in claim 6 in which:
said relatively lower level of security protection comprises storing said public header portion in an unencrypted state; and
said relatively higher level of security protection comprises storing said private header portion in an encrypted state.

8. A process comprising the following steps:
accessing a first record containing information directly or indirectly identifying one or more elements of a first component assembly,
at least one of said elements including at least some executable programming,
at least one of said elements constituting a load module,
said load module including executable programming and a header;
said header including an execution space identifier identifying at least one aspect of an execution space required for use and/or execution of the load module associated with said header;
said execution space identifier provides the capability for distinguishing between execution spaces providing a higher level of security and execution spaces providing a lower level of security;
using said information to identify and locate said one or more elements;
accessing said located one or more elements;
securely assembling said one or more elements to form at least a portion of said first component assembly;
executing at least some of said executable programming; and
checking said record for validity prior to performing said executing step.

9. A process as in claim 8 in which said execution space providing a higher level of security comprises a secure processing environment.

10. A process as in claim 9 in which said secure processing environment contains at least one secure processing unit.

11. A process as in claim 10 in which said execution space providing a lower level of security comprises a host event processing environment.

12. A process as in claim 11 in which said host event processing environment does not contain a secure processing unit.

13. A process as in claim 8 further comprising:
comparing said execution space identifier against information identifying the execution space in which said executing step is to occur; and
taking an action if said execution space identifier requires an execution space with a security level higher than that of the execution space in which said executing step is to occur.

14. A process as in claim 13 in which said action includes terminating said process prior to said executing step.

15. A process as in claim 14 in which said action includes failing to include said load module in said component assembly.

16. A process as in claim 15 further comprising:
following said action, attempting to locate a second load module, incorporating a second execution space identifier, for inclusion in said component assembly.

17. A process as in claim 6 in which:
said private header portion includes a check value calculated based on the contents of said public portion; and
said process further includes the step of using said check value to determine whether said public portion has been altered or replaced in an unauthorized manner.

18. A process as in claim 6 in which said private header portion includes one or more tags.

19. A process as in claim 18 in which at least one of said tags comprises an access tag.

20. A process as in claim 19 further comprising:
checking said access tag at some point before said execution step, in order to determine if use of said load module will be allowed.

21. A process as in claim 6 in which said private header portion includes one or more digital signatures.

22. A process as in claim 21 further comprising:
checking said digital signature at some point before said executing step; and
taking at least one action depending on the outcome of said checking step.

23. A process as in claim 22 in which said at least one action includes terminating said process prior to said executing step.

24. A process as in claim 22 in which said at least one action includes allowing said executing step to proceed.

25. A process as in claim 22 in which:
said at least one action includes replacing the load module containing said digital signature with a second load module, and
said process further includes incorporating said second load module into said component assembly.

26. A process as in claim 22 in which said digital signature checking step includes identifying the creator of said digital signature.

27. A process as in claim 6 in which said private header portion includes at least one check value representing at least one aspect of the state of said load module.

28. A process as in claim 27 further comprising:
comparing said check value to an expected value; and
taking at least one action based on the results of said comparison.

29. A process as in claim 28 in which said at least one action includes terminating said process prior to said executing step.

30. A process as in claim 28 in which:
said load module comprises a first load module;
at least one action includes accessing a second load module; and
said securely assembling step comprises assembling said component assembly using said second load module but not said first load module.

31. A process comprising the following steps:
accessing a first record containing information directly or indirectly identifying one or more elements of a first component assembly,
at least one of said elements including at least some executable programming consisting of at least two code segments;
a first of said code segments being written in a first programming language; and
a second of said code segments being written in a second programming language different from said first programming language,
at least one of said elements constituting a load module, said load module including executable programming;
using said information to identify and locate said one or more elements;
accessing said located one or more elements;
securely assembling said one or more elements to form at least a portion of said first component assembly;
choosing said first code segment for inclusion in said component assembly;
including said first code segment in said component assembly; and
excluding said second code segment from said component assembly;
executing at least some of said first code segment executable programming; and
checking said record for validity prior to performing said executing step.

32. A process as in claim 31, in which:
said executing step takes place in a processing environment; and
said choosing step includes identifying said first code segment as being more suited for execution at said processing environment than said second code segment.

33. A process as in claim 32 in which said step of identifying said first code segment as being more suited is based at least in part on the programming language in which said first code segment is written.

34. A process comprising the following steps:
at a first processing environment receiving a first record from a second processing environment remote from said first processing environment;
said first record containing identification information directly or indirectly identifying one or more elements of a component assembly;
at least one of said elements including at least some executable programming;
a first of said elements being designed to carry out or participate in metering of user activities;
a second of said elements being designed to carry out or participate in budgeting functions said second element specifying a credit method;
said component assembly allowing access to or use of specified information;
accessing said first record;
using said identification information to identify and locate said one or more elements;
said element locating step including locating said first element at said second processing environment and locating said second element at a third processing environment located remotely from said first processing environment and said second processing environment;
accessing said located one or more elements;
said element accessing step including retrieving said first element from said second processing environment and retrieving said second element from said third processing environment;
securely assembling said one or more elements to form at least a portion of said component assembly specified by said first record; and
executing at least some of said executable programming,
said executing step taking place at said first processing environment;
said executing step including metering use of said specified information, using said first element.

35. A process comprising the following steps:
at a first processing environment receiving a first record from a second processing environment remote from said first processing environment;
said first record being received in a secure container;
said first record containing identification information directly or indirectly identifying one or more elements of a first component assembly;
at least one of said elements including at least some executable programming;
said component assembly allowing access to or use of specified information;
said secure container also including a first of said elements;
accessing said first record;
using said identification information to identify and locate said one or more elements;
said locating step including locating a second of said elements at a third processing environment located remotely from said first processing environment and said second processing environment;
accessing said located one or more elements;
said element accessing step including retrieving said second element from said third processing environment;
securely assembling said one or more elements to form at least a portion of said first component assembly specified by said first record; and
executing at least some of said executable programming,
said executing step taking place at said first processing environment.

36. A process as in claim 35 in which:
said first element comprises a metering method; and
said executing step includes using said first element to meter use of said specified information.

37. A process as in claim 36 in which:
said second element comprises a credit method; and
said executing step includes charging against credit supplied by said credit method in return for use of said specified information.

38. A process comprising the following steps:
creating an initial channel;
after creation of said initial channel, creating a first channel;
said initial channel allocating said first channel to handle a first component assembly;
accessing a first record containing information directly or indirectly identifying one or more elements of said first component assembly, at least one of said elements including at least some executable programming;
using said information to identify and locate said one or more elements;
accessing said located one or more elements;
within said first channel, securely assembling said one or more elements to form at least a portion of said first component assembly; and
executing at least some of said executable programming.

39. A process as in claim 38 in which said step of said initial channel allocating said first channel includes:
making, with said initial channel, one or more calls to a secure database manager; and
returning, from said secure database manager, a channel blueprint from a secure database.

40. A process as in claim 39 in which said step of creating a first channel is based at least it part on said channel blueprint.

41. A process as in claim 40 in which:
said channel blueprint includes at least one tag; and
said step of creating a first channel includes checking said tag to determine the validity or suitability of said channel blueprint.

42. A process as in claim 41 in which said first channel includes a channel header.

43. A process as in claim 42 in which said step of creating a first channel includes incorporating information into said first channel header.

44. A process as in claim 43 in which said incorporated information includes user identification information.

45. A process as in claim 44 in which said incorporated information includes object identification information.

46. A process as in claim 45 in which said incorporated information includes a reference to the type of function to be processed by said first channel.

47. A process as in claim 46 in which said step of creating a first channel includes:
accessing a control method; and
binding said control method to said first channel.

48. A process as in claim 47 in which said assembling step includes binding at least one of said elements to said first channel.

49. A process as in claim 48 in which said assembling step includes said control method obtaining memory allocations required for said executing step.

50. A process as in claim 49 in which said step of accessing said one or more located elements includes accessing, with said control method, at least one of said elements from a secure database.

51. A process as in claim 50 in which said step of assembling includes calling, with said control method, an encryption manager to decrypt at least one of said elements.

52. A process as in claim 51 in which said step of assembling includes calling a tag manager with said control method, and comparing, with said tag manager, a tag contained in one of said elements with an expected value or range of values.

53. A process as in claim 52 in which:
said first channel further includes an event queue;
said method further comprising writing at least one event into said event queue.

54. A load module comprising:
a load module header including a public portion and a private portion:
said public portion including identification information;
said private portion including at least one correlation tag;
said correlation tag including information used to determine whether a method has authorization to call or load the load module; and
a load module body including:
executable programming which calls or includes:
programming which controls at least one aspect of use of at least one file, said programming calling or including programming which provides information relating to the user of said file to an external site;
said programming providing information provides such information in a summary fashion which does not include information deemed confidential by said user; and
a reference to data;
at least some of said data being associated with or used by said executable programming.

55. An operating system comprising:
component assembling programming which assembles a plurality of elements into a component, said component assembling programming including;
validation programming used to validate said elements, said validation programming including:
tag checking programming used to check the identity, validity or integrity of elements by comparing tags incorporated in said elements to expected values; and
element identification and referencing programming; and
an object switch which controls and communicates objects, said object switch including:
a stream router;
one or more stream interfaces;
a container manager used to manage secure containers;
said container manager contains programming which recognizes secure containers and performs operations on said secure containers;
buffering and storage programming; and
an object switch interface.

56. An operating system as in claim 55, in which:
said operations include:
constructing secure containers;
opening secure containers; and
routing secure containers.

57. A component assembly comprising:
a first load module and a second load module, each load module comprising:
a load module header, made up of a public portion and a private portion;
said public portion including identification information;
said private portion including at least one correlation tag;
said correlation tag including information used to determine whether a method has authorization to call or load the load module; and
a load module body, including:
executable programming which calls or includes:
programming which controls at least one aspect of use of at least one file,
said programming controlling at least one aspect of use of at least one file calls or includes programming which provides information relating to the user of said file to an external site;
said programming providing information provides such information in a summary fashion which does not include information deemed confidential by said user; and
a reference to data;
at least some of said data being associated with or used by said executable programming.

58. A component assembly comprising:
a first load module received from a first source and a second load module received from a second source remote from said first source, each load module comprising:
a load module header, made up of a public portion and a private portion;
said public portion including identification information;
said private portion including at least one correlation tag;
said correlation tag including information used to determine whether a method has authorization to call or load the load module; and
a load module body, including:
executable programming; and
a reference to data;
at least some of said data being associated with or used by said executable programming.
Description
FIELD(S) OF THE INVENTION(S)

This invention generally relates to computer and/or electronic security.

More particularly, this invention relates to systems and techniques for secure transaction management. This invention also relates to computer-based and other electronic appliance-based technologies that help to ensure that information is accessed and/or otherwise used only in authorized ways, and maintains the integrity, availability, and/or confidentiality of such information and processes related to such use.

The invention also relates to systems and methods for protecting rights of various participants in electronic commerce and other electronic or electronically-facilitated transactions.

The invention also relates to secure chains of handling and control for both information content and information employed to regulate the use of such content and consequences of such use. It also relates to systems and techniques that manage, including meter and/or limit and/or otherwise monitor use of electronically stored and/or disseminated information. The invention particularly relates to transactions, conduct and arrangements that make use of, including consequences of use of, such systems and/or techniques.

The invention also relates to distributed and other operating systems, environments and architectures. It also generally relates to secure architectures, including, for example, tamper-resistant hardware-based processors, that can be used to establish security at each node of a distributed system.

BACKGROUND AND SUMMARY OF THE INVENTION(S)

Telecommunications, financial transactions, government processes, business operations, entertainment, and personal business productivity all now depend on electronic appliances. Millions of these electronic appliances have been electronically connected together. These interconnected electronic appliances comprise what is increasingly called the "information highway." Many businesses, academicians, and government leaders are concerned about how to protect the rights of citizens and organizations who use this information (also "electronic" or "digital") highway.

Electronic Content

Today, virtually anything that can be represented by words, numbers, graphics, or system of commands and instructions can be formatted into electronic digital information. Television, cable, satellite transmissions, and on-line services transmitted over telephone lines, compete to distribute digital information and entertainment to homes and businesses. The owners and marketers of this content include software developers, motion picture and recording companies, publishers of books, magazines, and newspapers, and information database providers. The popularization of on-line services has also enabled the individual personal computer user to participate as a content provider. It is estimated that the worldwide market for electronic information in 1992 was approximately $40 billion and is expected to grow to $200 billion by 1997, according to Microsoft Corporation. The present invention can materially enhance the revenue of content providers, lower the distribution costs and the costs for content, better support advertising and usage information gathering, and better satisfy the needs of electronic information users. These improvements can lead to a significant increase in the amount and variety of electronic information and the methods by which such information is distributed.

The inability of conventional products to be shaped to the needs of electronic information providers and users is sharply in contrast to the present invention. Despite the attention devoted by a cross-section of America's largest telecommunications, computer, entertainment and information provider companies to some of the problems addressed by the present invention, only the present invention provides commercially secure, effective solutions for configurable, general purpose electronic commerce transaction/distribution control systems.

Controlling Electronic Content

The present invention provides a new kind of "virtual distribution environment" (called "VDE" in this document) that secures, administers, and audits electronic information use. VDE also features fundamentally important capabilities for managing content that travels "across" the "information highway." These capabilities comprise a rights protection solution that serves all electronic community members. These members include content creators and distributors, financial service providers, end-users, and others. VDE is the first general purpose, configurable, transaction control/rights protection solution for users of computers, other electronic appliances, networks, and the information highway.

A fundamental problem for electronic content providers is extending their ability to control the use of proprietary information. Content providers often need to limit use to authorized activities and amounts. Participants in a business model involving, for example, provision of movies and advertising on optical discs may include actors, directors, script and other writers, musicians, studios, publishers, distributors, retailers, advertisers, credit card services, and content end-users. These participants need the ability to embody their range of agreements and requirements, including use limitations, into an "extended" agreement comprising an overall electronic business model. This extended agreement is represented by electronic content control information that can automatically enforce agreed upon rights and obligations. Under VDE, such an extended agreement may comprise an electronic contract involving all business model participants. Such an agreement may alternatively, or in addition, be made up of electronic agreements between subsets of the business model participants. Through the use of VDE, electronic commerce can function in the same way as traditional commerce--that is commercial relationships regarding products and services can be shaped through the negotiation of one or more agreements between a variety of parties.

Commercial content providers are concerned with ensuring proper compensation for the use of their electronic information. Electronic digital information, for example a CD recording, can today be copied relatively easily and inexpensively. Similarly, unauthorized copying and use of software programs deprives rightful owners of billions of dollars in annual revenue according to the International Intellectual Property Alliance. Content providers and distributors have devised a number of limited function rights protection mechanisms to protect their rights. Authorization passwords and protocols, license servers, "lock/unlock" distribution methods, and non-electronic contractual limitations imposed on users of shrink-wrapped software are a few of the more prevalent content protection schemes. In a commercial context, these efforts are inefficient and limited solutions.

Providers of "electronic currency" have also created protections for their type of content. These systems are not sufficiently adaptable, efficient, nor flexible enough to support the generalized use of electronic currency. Furthermore, they do not provide sophisticated auditing and control configuration capabilities. This means that current electronic currency tools lack the sophistication needed for many real-world financial business models. VDE provides means for anonymous currency and for "conditionally" anonymous currency, wherein currency related activities remain anonymous except under special circumstances.

VDE Control Capabilities

VDE allows the owners and distributors of electronic digital information to reliably bill for, and securely control, audit, and budget the use of, electronic information. It can reliably detect and monitor the use of commercial information products. VDE uses a wide variety of different electronic information delivery means: including, for example, digital networks, digital broadcast, and physical storage media such as optical and magnetic disks. VDE can be used by major network providers, hardware manufacturers, owners of electronic information, providers of such information, and clearinghouses that gather usage information regarding, and bill for the use of, electronic information.

VDE provides comprehensive and configurable transaction management, metering and monitoring technology. It can change how electronic information products are protected, marketed, packaged, and distributed. When used, VDE should result in higher revenues for information providers and greater user satisfaction and value. Use of VDE will normally result in lower usage costs, decreased transaction costs, more efficient access to electronic information, re-usability of rights protection and other transaction management implementations, greatly improved flexibility in the use of secured information, and greater standardization of tools and processes for electronic transaction management. VDE can be used to create an adaptable environment that fulfills the needs of electronic information owners, distributors, and users; financial clearinghouses; and usage information analyzers and resellers.

Rights and Control Information

In general, the present invention can be used to protect the rights of parties who have:

(a) proprietary or confidentiality interests in electronic information. It can, for example, help ensure that information is used only in authorized ways;

(b) financial interests resulting from the use of electronically distributed information. It can help ensure that content providers will be paid for use of distributed information; and

(c) interests in electronic credit and electronic currency storage, communication, and/or use including electronic cash, banking, and purchasing.

Protecting the rights of electronic community members involves a broad range of technologies. VDE combines these technologies in a way that creates a "distributed" electronic rights protection "environment." This environment secures and protects transactions and other processes important for rights protection. VDE, for example, provides the ability to prevent, or impede, interference with and/or observation of, important rights related transactions and processes. VDE, in its preferred embodiment, uses special purpose tamper resistant Secure Processing Units (SPUs) to help provide a high level of security for VDE processes and information storage and communication.

The rights protection problems solved by the present invention are electronic versions of basic societal issues. These issues include protecting property rights, protecting privacy rights, properly compensating people and organizations for their work and risk, protecting money and credit, and generally protecting the security of information. VDE employs a system that uses a common set of processes to manage rights issues in an efficient, trusted, and cost-effective way.

VDE can be used to protect the rights of parties who create electronic content such as, for example: records, games, movies, newspapers, electronic books and reference materials, personal electronic mail, and confidential records and communications. The invention can also be used to protect the rights of parties who provide electronic products, such as publishers and distributors; the rights of parties who provide electronic credit and currency to pay for use of products, for example, credit clearinghouses and banks; the rights to privacy of parties who use electronic content (such as consumers, business people, governments); and the privacy rights of parties described by electronic information, such as privacy rights related to information contained in a medical record, tax record, or personnel record.

In general, the present invention can protect the rights of parties who have:

(a) commercial interests in electronically distributed information--the present invention can help ensure, for example, that parties, will be paid for use of distributed information in a manner consistent with their agreement;

(b) proprietary and/or confidentiality interests in electronic information--the present invention can, for example, help ensure that data is used only in authorized ways;

(c) interests in electronic credit and electronic currency storage, communication, and/or use--this can include electronic cash, banking, and purchasing; and

(d) interests in electronic information derived, at least in part, from use of other electronic information.

VDE Functional Properties

VDE is a cost-effective and efficient rights protection solution that provides a unified, consistent system for securing and managing transaction processing. VDE can:

(a) audit and analyze the use of content,

(b) ensure that content is used only in authorized ways, and

(c) allow information regarding content usage to be used only in ways approved by content users.

In addition, VDE:

(a) is very configurable, modifiable, and re-usable;

(b) supports a wide range of useful capabilities that may be combined in different ways to accommodate most potential applications;

(c) operates on a wide variety of electronic appliances ranging from hand-held inexpensive devices to large mainframe computers;

(d) is able to ensure the various rights of a number of different parties, and a number of different rights protection schemes, simultaneously;

(e) is able to preserve the rights of parties through a series of transactions that may occur at different times and different locations;

(f) is able to flexibly accommodate different ways of securely delivering information and reporting usage; and

(g) provides for electronic analogues to "real" money and credit, including anonymous electronic cash, to pay for products and services and to support personal (including home) banking and other financial activities.

VDE economically and efficiently fulfills the rights protection needs of electronic community members. Users of VDE will not require additional rights protection systems for different information highway products and rights problems--nor will they be required to install and learn a new system for each new information highway application.

VDE provides a unified solution that allows all content creators, providers, and users to employ the same electronic rights protection solution. Under authorized circumstances, the participants can freely exchange content and associated content control sets. This means that a user of VDE may, if allowed, use the same electronic system to work with different kinds of content having different sets of content control information. The content and control information supplied by one group can be used by people who normally use content and control information supplied by a different group. VDE can allow content to be exchanged "universally" and users of an implementation of the present invention can interact electronically without fear of incompatibilities in content control, violation of rights, or the need to get, install, or learn a new content control system.

The VDE securely administers transactions that specify protection of rights. It can protect electronic rights including, for example:

(a) the property rights of authors of electronic content,

(b) the commercial rights of distributors of content,

(c) the rights of any parties who facilitated the distribution of content,

(d) the privacy rights of users of content,

(e) the privacy rights of parties portrayed by stored and/or distributed content, and

(f) any other rights regarding enforcement of electronic agreements.

VDE can enable a very broad variety of electronically enforced commercial and societal agreements. These agreements can include electronically implemented contracts, licenses, laws, regulations, and tax collection.

Contrast With Traditional Solutions

Traditional content control mechanisms often require users to purchase more electronic information than the user needs or desires. For example, infrequent users of shrink-wrapped software are required to purchase a program at the same price as frequent users, even though they may receive much less value from their less frequent use. Traditional systems do not scale cost according to the extent or character of usage and traditional systems can not attract potential customers who find that a fixed price is too high. Systems using traditional mechanisms are also not normally particularly secure. For example, shrink-wrapping does not prevent the constant illegal pirating of software once removed from either its physical or electronic package.

Traditional electronic information rights protection systems are often inflexible and inefficient and may cause a content provider to choose costly distribution channels that increase a product's price. In general these mechanisms restrict product pricing, configuration, and marketing flexibility. These compromises are the result of techniques for controlling information which cannot accommodate both different content models and content models which reflect the many, varied requirements, such as content delivery strategies, of the model participants. This can limit a provider's ability to deliver sufficient overall value to justify a given product's cost in the eyes of many potential users. VDE allows content providers and distributors to create applications and distribution networks that reflect content providers' and users' preferred business models. It offers users a uniquely cost effective and feature rich system that supports the ways providers want to distribute information and the ways users want to use such information. VDE supports content control models that ensure rights and allow content delivery strategies to be shaped for maximum commercial results.

Chain of Handling and Control

VDE can protect a collection of rights belonging to various parties having in rights in, or to, electronic information. This information may be at one location or dispersed across (and/or moving between) multiple locations. The information may pass through a "chain" of distributors and a "chain" of users. Usage information may also be reported through one or more "chains" of parties. In general, VDE enables parties that (a) have rights in electronic information, and/or (b) act as direct or indirect agents for parties who have rights in electronic information, to ensure that the moving, accessing, modifying, or otherwise using of information can be securely controlled by rules regarding how, when, where, and by whom such activities can be performed.

VDE Applications and Software

VDE is a secure system for regulating electronic conduct and commerce. Regulation is ensured by control information put in place by one or more parties. These parties may include content providers, electronic hardware manufacturers, financial service providers, or electronic "infrastructure" companies such as cable or telecommunications companies. The control information implements "Rights Applications." Rights applications "run on" the "base software" of the preferred embodiment. This base software serves as a secure, flexible, general purpose foundation that can accommodate many different rights applications, that is, many different business models and their respective participant requirements.

A rights application under VDE is made up of special purpose pieces, each of which can correspond to one or more basic electronic processes needed for a rights protection environment. These processes can be combined together like building blocks to create electronic agreements that can protect the rights, and may enforce fulfillment of the obligations, of electronic information users and providers. One or more providers of electronic information can easily combine selected building blocks to create a rights application that is unique to a specific content distribution model. A group of these pieces can represent the capabilities needed to fulfill the agreement(s) between users and providers. These pieces accommodate many requirements of electronic commerce including:

the distribution of permissions to use electronic information;

the persistence of the control information and sets of control information managing these permissions;

configurable control set information that can be selected by users for use with such information;

data security and usage auditing of electronic information; and

a secure system for currency, compensation and debit management.

For electronic commerce, a rights application, under the preferred embodiment of the present invention, can provide electronic enforcement of the business agreements between all participants. Since different groups of components can be put together for different applications, the present invention can provide electronic control information for a wide variety of different products and markets. This means the present invention can provide a "unified," efficient, secure, and cost-effective system for electronic commerce and data security. This allows VDE to serve as a single standard for electronic rights protection, data security, and electronic currency and banking.

In a VDE, the separation between a rights application and its foundation permits the efficient selection of sets of control information that are appropriate for each of many different types of applications and uses. These control sets can reflect both rights of electronic community members, as well as obligations (such as providing a history of one's use of a product or paying taxes on one's electronic purchases). VDE flexibility allows its users to electronically implement and enforce common social and commercial ethics and practices. By providing a unified control system, the present invention supports a vast range of possible transaction related interests and concerns of individuals, communities, businesses, and governments. Due to its open design, VDE allows (normally under securely controlled circumstances) applications using technology independently created by users to be "added" to the system and used in conjunction with the foundation of the invention. In sum, VDE provides a system that can fairly reflect and enforce agreements among parties. It is a broad ranging and systematic solution that answers the pressing need for a secure, cost-effective, and fair electronic environment.

VDE Implementation

The preferred embodiment of the present invention includes various tools that enable system designers to directly insert VDE capabilities into their products. These tools include an Application Programmer's Interface ("API") and a Rights Permissioning and Management Language ("RPML"). The RPML provides comprehensive and detailed control over the use of the invention's features. VDE also includes certain user interface subsystems for satisfying the needs of content providers, distributors, and users.

Information distributed using VDE may take many forms. It may, for example, be "distributed" for use on an individual's own computer, that is the present invention can be used to provide security for locally stored data. Alternatively, VDE may be used with information that is dispersed by authors and/or publishers to one or more recipients. This information may take many forms including: movies, audio recordings, games, electronic catalog shopping, multimedia, training materials, E-mail and personal documents, object oriented libraries, software programming resources, and reference/record keeping information resources (such as business, medical, legal, scientific, governmental, and consumer databases).

Electronic rights protection provided by the present invention will also provide an important foundation for trusted and efficient home and commercial banking, electronic credit processes, electronic purchasing, true or conditionally anonymous electronic cash, and EDI (Electronic Data Interchange). VDE provides important enhancements for improving data security in organizations by providing "smart" transaction management features that can be far more effective than key and password based "go/no go" technology.

VDE normally employs an integration of cryptographic and other security technologies (e.g. encryption, digital signatures, etc.), with other technologies including: component, distributed, and event driven operating system technology, and related communications, object container, database, smart agent, smart card, and semiconductor design technologies.

I. Overview

A. VDE Solves Important Problems and Fills Critical Needs

The world is moving towards an integration of electronic information appliances. This interconnection of appliances provides a foundation for much greater electronic interaction and the evolution of electronic commerce. A variety of capabilities are required to implement an electronic commerce environment. VDE is the first system that provides many of these capabilities and therefore solves fundamental problems related to electronic dissemination of information.

Electronic Content

VDE allows electronic arrangements to be created involving two or more parties. These agreements can themselves comprise a collection of agreements between participants in a commercial value chain and/or a data security chain model for handling, auditing, reporting, and payment. It can provide efficient, reusable, modifiable, and consistent means for secure electronic content: distribution, usage control, usage payment, usage auditing, and usage reporting. Content may, for example, include:

financial information such as electronic currency and credit;

commercially distributed electronic information such as reference databases, movies, games, and advertising; and

electronic properties produced by persons and organizations, such as documents, e-mail, and proprietary database information.

VDE enables an electronic commerce marketplace that supports differing, competitive business partnerships, agreements, and evolving overall business models.

The features of VDE allow it to function as the first trusted electronic information control environment that can conform to, and support, the bulk of conventional electronic commerce and data security requirements. In particular, VDE enables the participants in a business value chain model to create an electronic version of traditional business agreement terms and conditions and further enables these participants to shape and evolve their electronic commerce models as they believe appropriate to their business requirements.

VDE offers an architecture that avoids reflecting specific distribution biases, administrative and control perspectives, and content types. Instead, VDE provides a broad-spectrum, fundamentally configurable and portable, electronic transaction control, distributing, usage, auditing, reporting, and payment operating environment. VDE is not limited to being an application or application specific toolset that covers only a limited subset of electronic interaction activities and participants. Rather, VDE supports systems by which such applications can be created, modified, and/or reused. As a result, the present invention answers pressing, unsolved needs by offering a system that supports a standardized control environment which facilitates interoperability of electronic appliances, interoperability of content containers, and efficient creation of electronic commerce applications and models through the use of a programmable, secure electronic transactions management foundation and reusable and extensible executable components. VDE can support a single electronic "world" within which most forms of electronic transaction activities can be managed.

To answer the developing needs of rights owners and content providers and to provide a system that can accommodate the requirements and agreements of all parties that may be involved in electronic business models (creators, distributors, administrators, users, credit providers, etc.), VDE supplies an efficient, largely transparent, low cost and sufficiently secure system (supporting both hardware/software and software only models). VDE provides the widely varying secure control and administration capabilities required for:

1. Different types of electronic content,

2. Differing electronic content delivery schemes,

3. Differing electronic content usage schemes,

4. Different content usage platforms, and

5. Differing content marketing and model strategies.

VDE may be combined with, or integrated into, many separate computers and/or other electronic appliances. These appliances typically include a secure subsystem that can enable control of content use such as displaying, encrypting, decrypting, printing, copying, saving, extracting, embedding, distributing, auditing usage, etc. The secure subsystem in the preferred embodiment comprises one or more "protected processing environments", one or more secure databases, and secure "component assemblies" and other items and processes that need to be kept secured. VDE can, for example, securely control electronic currency, payments, and/or credit management (including electronic credit and/or currency receipt, disbursement, encumbering, and/or allocation) using such a "secure subsystem."

VDE provides a secure, distributed electronic transaction management system for controlling the distribution and/or other usage of electronically provided and/or stored information. VDE controls auditing and reporting of electronic content and/or appliance usage. Users of VDE may include content creators who apply content usage, usage reporting, and/or usage payment related control information to electronic content and/or appliances for users such as end-user organizations, individuals, and content and/or appliance distributors. VDE also securely supports the payment of money owed (including money owed for content and/or appliance usage) by one or more parties to one or more other parties, in the form of electronic credit and/or currency.

Electronic appliances under control of VDE represent VDE `nodes` that securely process and control; distributed electronic information and/or appliance usage, control information formulation, and related transactions. VDE can securely manage the integration of control information provided by two or more parties. As a result, VDE can construct an electronic agreement between VDE participants that represent a "negotiation" between, the control requirements of, two or more parties and enacts terms and conditions of a resulting agreement. VDE ensures the rights of each party to an electronic agreement regarding a wide range of electronic activities related to electronic information and/or appliance usage.

Through use of VDE's control system, traditional content providers and users can create electronic relationships that reflect traditional, non-electronic relationships. They can shape and modify commercial relationships to accommodate the e