Secure electronic commerce using mutating identifiers

Description of equivalent WO 2007120215 A2

SECUElE ELECTRONIC COMMERCE USING MUTATING IDENTIFIERS

RELATED APPLICATIONS

[0001] This application claims priority from U.S. Patent Application Serial No, 11/286,890 filed on November 23, 2005, which is a contimiation-in-part of U.S. Patent Application Serial No. 10/854,604 filed on May 26, 2004, which is a continuation-in-part of U.S. Patent Application Serial No. 10/248,894 filed on February 27, 2003, which claims priority to U.S. Provisional Patent Application Serial No. 60/360,023 filed on February 27, 2002, the entire contents of which are all hereby incorporated by reference.

BACKGROUND OF THE INVENTION

[0002] Embodiments of the invention relate to the distribution of content (such as text, audio, video, multi-media materials, and the like). More particularly, the invention relates to the distribution of such content in a manner that ensures that the copyrights and other similar legal rights of the content owner are respected.

[0003] More and more content is being delivered in digital form, and more and more digital content is being delivered over private and public networks, such as Intranets, the Internet, cable TV networks, and the like. For consumers of such content, digital versions (as opposed to analog, paper copy, and other forms) provide various advantages such as enhanced fidelity, improved and greater playback options, interactivity, and others. Online or network delivery generally offers greater convenience and timeliness. Online delivery is also cheaper than other delivery methods, and this benefits content publishers.

[0004] Most current and potential digitally distributed content is, like most books, distributed in a manner such that the publisher or owner generally gives or sells the content to a consumer, but continues to restrict rights to use the content even after the content is under the sole physical control of the consumer. For instance, a content owner typically retains copyright to the content so that the consumer cannot legally reproduce or publish the content without permission. Digital content, as opposed to older forms of media, allows a content owner to adjust pricing according to whether the consumer is allowed to make a persistent copy, or is just allowed to view the content as it is delivered. [0005] Despite the worthwhile attributes of digital and network distribution, content owners are still generally reluctant to distribute content, particularly high-value content, via networks because unauthorized duplication, piracy, and distribution of digital content (e.g., as was done by users of Napster) is very easy. Unlike analog recorders, photocopiers, and other older devices, current technology permits unlimited, pristine copies of digital content to be made. And, in most instances, copies of the digital content can be made very quickly or nearly instantaneously. Furthermore, even current protective measures such as public key encryption and the content scrambling system ("CSS"), which is used for digital versatile discs, have been defeated.

[0006] Furthermore, once a key is gained or discovered, either legally or illegally, that unlocks the encrypted content, that piece of content is forever compromised. This free access to the content allows the possessor of the key to make and distribute endless copies of the decrypted content. In the event that a key is used to circulate illegal copies of a content item, it is generally impractical to track the illegally distributed content back to the individual who initially owned the key.

[0007] In addition to distributing content, the availability and popularity of the networked systems, such as the Internet, has changed the landscape of commerce. Electronic commerce ("e-commerce") has grown into a large and important part of business. Providing electronic commerce capabilities has become a necessity for businesses to compete nation-wide and worldwide.

[0008] In addition to providing electronic commerce capabilities, businesses are also encouraged to provide secure electronic commerce capabilities. Most buyers will not provide billing or confidential information to complete an electronic commerce transaction unless they are promised that their data will be kept secure. Many current electronic commerce transaction protocols use a variation of a public key exchange protocol. The protocol establishes a secure connection between the buyer and the seller. Once a secure connection is established, the confidential information (e.g., a credit card number, account number, and the like) is communicated from the buyer to the seller. The seller then uses the information to obtain payment from a company (e.g., a credit card company or financial institution).

[0009] However, in the above protocol, once the credit card or confidential information is provided to the seller, the seller has the information indefinitely. There have been instances where the security of that information has been compromised. Such security compromises pose several problems, including consumer wariness of electronic transactions.

SUMMARY OF THE INVENTION

[0010] In light of the above, there is a need to provide a method and system of distributing content that ensures that the rights of content owners are respected. There is also a need to provide a mechanism that would track thieves and deter them from illegally distributing content. Furthermore, there is a need to provide a method and system of performing secure electronic commerce.

[0011] The present invention provides among other things a multiple party system for distributing content. In one embodiment, three parties are involved in the system: a consumer, a content provider, and an authenticator. The distribution of content from the content provider to the consumer is carried out using a predefined protocol, mutating IDs, and licenses. The authenticator controls the distribution of mutating IDs and verifies the identity of both parties.

[0012] In another embodiment, four parties are involved in a multiple party system for distributing content. The system includes a consumer, a service provider, an authenticator, and a content provider. The distribution of content from the content provider to the consumer, through the services of the service provider, is carried out using a predefined protocol, mutating IDs, and licenses. The authenticator controls the distribution of mutating IDs and verifies the identity of one or more parties.

[0013] Embodiments also provide methods for distributing content. One method for distributing content includes having a content provider make a request to send content to a consumer. The request includes an encrypted identifier for the content to be sent. In response to the request, the consumer encrypts the request to create an authentication request and sends the authentication request to an authenticator. The authenticator checks the authentication request and, if valid, informs the content provider to send the encrypted content identified in the initial request to the consumer. The authenticator sends a decryption key to the consumer so that the consumer may decrypt and view or consume the content. [0014] In another embodiment, the method includes having a consumer make a request for content to a service provider and relaying the request to a content provider. In response to the request, the content provider creates a license that includes identifying information concerning the service provider and encrypted information identifying the requested content. The license is sent to the service provider. The service provider encrypts the license from the content provider and sends this message to the consumer. The consumer encrypts the message to create an authentication request and sends the authentication request to an authenticator. The authenticator checks the authentication request and, if valid, informs the content provider to send encrypted content specified in the license to the consumer. The authenticator sends a decryption key to the consumer so that the consumer may decrypt and consume the content.

[0015] Embodiments of the invention further provide a method for distributing content where each copy of the content is uniquely watermarked. The method includes having a consumer make a request for content to a service provider and relaying the request to a content provider. In response to the request, the content provider creates a license that includes identifying information concerning the service provider and encrypted information identifying the requested content and a unique watermark. The license is sent to the service provider. The service provider encrypts the license from the service provider and sends this message to the consumer. The consumer encrypts the message to create an authentication request and sends the authentication request to an authenticator. The authenticator checks the authentication request and, if valid, informs the content provider to send encrypted content, watermarked with the watermark specified in the received license, to the consumer. The authenticator sends a decryption key to the consumer so that the consumer may decrypt and view the watermarked content.

[0016] In another embodiment, the invention provides a content distribution system that includes an authenticator and a content provider and a consumer. The content provider has content and a content identifier, and generates a first mutating identifier associated with the content identifier. The system also includes a consumer device that is operable to send requests to receive content to and to receive content from the content provider. The consumer device receives the first mutating identifier from the content provider in the form of a request, generates a second mutating identifier associated with the first mutating identifier, and distributes the second mutating identifier to the authenticator. The authenticator validates the request and thereafter informs the consumer of the validity of the request. If the request is valid, the content provider thereafter encrypts the content and sends the encrypted content to the consumer while the authenticator sends a decryption code to the consumer.

[0017] In another embodiment, the invention provides a content distribution system that includes an authenticator and a content provider. The content provider has content and a content identifier, and generates a first mutating identifier associated with the content identifier. The system also includes a consumer device that is operable to generate a request for the content. In addition, the system includes a service provider. The service provider receives the request from the consumer device, receives the first mutating identifier from the content provider, generates a second mutating identifier associated with the first mutating identifier, and distributes the second mutating identifier to the consumer device. The consumer device generates a third mutating identifier associated with the second mutating identifier, and distributes the third mutating identifier to the authenticator. The authenticator validates the request and thereafter informs the service provider of the validity of the request. If the request is valid, the content provider thereafter encrypts the content and sends the encrypted content to the consumer while the authenticator sends a decryption code to the consumer.

[0018] Additional embodiments provide methods of performing electronic commerce using mutating identifiers. One method can include encrypting buyer transaction data with a first mutating identifier, transmitting the buyer transaction data to an authenticator device, decrypting the buyer transaction data, generating a payment request, encrypting the payment request with a third mutating identifier, and transmitting the payment request to a payment authenticator device.

[0019] Another embodiment provides methods for establishing communication between a first device and a second device. One method can include generating a request for a transaction key, encrypting the request with a first mutating identifier of the first device, transmitting the encrypted request to an authenticator device, generating a transaction key, generating a first message including the transaction key, and encrypting the first message with the first mutating identifier of the first device.

[0020] Embodiments also provide methods of performing electronic commerce using mutating identifiers. One method can include encrypting buyer transaction data with a first mutating identifier, transmitting the buyer transaction data to an authenticator device, encrypting buyer credentials with a first transaction key, and transmitting the buyer credentials to a payment authenticator device. The method can also include encrypting vendor transaction data with a second mutating identifier, transmitting the vendor transaction data to an authenticator device, encrypting vendor credentials with a second transaction key, and transmitting the vendor credentials to a payment authenticator device. Furthermore, the method can include decrypting the buyer transaction data, decrypting the vendor transaction data, generating a payment request for a payment authenticator device, encrypting the payment request with a third mutating identifier, and transmitting the payment request to the payment authenticator device. In addition, the method can include decrypting the payment request; decrypting the buyer credentials; decrypting the vendor credentials; generating a first response based on the buyer credentials, the vendor credentials, and the payment request; generating a second response based on the buyer credentials, the vendor credentials, and the payment request; transmitting the first response to the buyer device, and transmitting the second response to the buyer device.

[0021] Yet another embodiment provides electronic commerce systems. One system can include a vendor device; a buyer device configured to encrypt buyer transaction data with a first mutating identifier and to transmit the buyer transaction data to an authenticator device; and a payment authenticator device configured to approve or decline a payment request, to generate a first response for the buyer device, to generate a second response for the vendor device, to transmit the first response to the buyer device, and to transmit the second response to the vendor device. The authenticator device can be configured to decrypt the buyer transaction data, to generate a payment request for a payment authenticator device, to encrypt the payment request with a third mutating identifier of the payment authenticator device, and to transmit the payment request to the payment authenticator device.

[0022] One alternative embodiment of the invention involves encryption, but not mutating identifiers. One exemplary method includes encrypting buyer transaction data with a first buyer key, transmitting the buyer transaction data to an authenticator device, encrypting buyer credentials with a first transaction key, and transmitting the buyer credentials to a payment authenticator device. The method can also include encrypting vendor transaction data with a vendor key, transmitting the vendor transaction data to an authenticator device, encrypting vendor credentials with a second transaction key, and transmitting the vendor credentials to a payment authenticator device. Furthermore, the method can include decrypting the buyer transaction data, decrypting the vendor transaction data, generating a payment request for a payment authenticator device, encrypting the payment request with a payment request key, and transmitting the payment request to the payment authenticator device. In addition, the method can include decrypting the payment request; decrypting the buyer credentials; decrypting the vendor credentials; generating a first response based on the buyer credentials, the vendor credentials, and the payment request; generating a second response based on the buyer credentials, the vendor credentials, and the payment request; transmitting the first response to the buyer device, and transmitting the second response to the buyer device.

[0023] Although mutating identifiers are preferred, the alternative described in the previous paragraph can be implemented with, for example, asymmetric encryption schemes. In addition, it might be possible to use symmetric systems where keys are not mutated at all or only episodically mutated. The other electronic commerce protocols, systems, and schemes described herein may also be modified in this way; that is, modified to use asymmetric encryption, non-mutating keys, or episodically mutated keys.

[0024] Embodiments of the invention will become apparent by consideration of the, detailed description and accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In the drawings:

[0026] Fig. l is a schematic illustration of a system of one exemplary embodiment of the invention where four entities are involved in communication.

[0027] Fig. 2 is a schematic illustration of a system of another exemplary embodiment of the invention where three entities are involved in communication.

[0028] Fig. 3A is an illustration of a bit stream (called a "mutating ID") used in one embodiment of the invention.

[0029] Figs. 3B and 3C are illustrations of ways to distribute mutating IDs. [0030] Fig. 4 is a schematic illustration of a license structure for one exemplary embodiment of the invention.

[0031] Fig. 5 is a schematic illustration of a portion of the system shown in Fig. 1.

[0032] Fig. 6 is a schematic illustration of a communication protocol used in the system shown in Fig. 1.

[0033] Fig. 7 is a schematic illustration of a portion of the system shown in Fig. 1 , illustrating license distribution to multiple service providers.

[0034] Fig. 8 is a schematic illustration of a mutating identifier cycle used in one form of the invention.

[0035] Fig. 9a is an exemplary schematic illustration of content key management in one embodiment of the invention.

[0036] Fig. 9b is an exemplary schematic illustration of data flows that occur when content is requested under the situation illustrated in Fig. 9a.

[0037] Fig. 10a is an exemplary schematic illustration of content key management in another embodiment of the invention.

[0038] Fig. 10b is an exemplary schematic illustration of data flows that occur when content is requested under the situation illustrated in Fig. 10a.

[0039] Fig. 11 is an exemplary illustration of a content request.

[0040] Fig. 12 is an exemplary illustration of a content request showing an approval phase.

[0041] Fig. 13 is an exemplary illustration of a content request showing a delivery phase.

[0042] Fig. 14 is a schematic illustration of a license structure for another exemplary embodiment of the invention where watermarking is used.

[0043] Fig. 15 is a schematic illustration of a communication protocol used in the system shown in Fig. 1 with the addition of watermarking the content. [0044] Fig. 16 is a schematic illustration of exemplary embodiments of the devices used to distribute content where three entities are involved in a communication.

[0045] Fig. 17 is a schematic diagram of hardware inside one of the peripherals shown in Fig. 16.

[0046] Fig. 18 is a schematic illustration of a system of one exemplary embodiment of the invention where four entities are involved in a communication to perform electronic commerce.

[0047] Fig. 19 is a schematic illustration of a communication protocol used in the system shown in Fig. 18.

[0048] Fig. 20 is a schematic illustration of a system of another exemplary embodiment of the invention where four entities are involved in a communication to perform electronic commerce.

[0049] Fig. 21 is a schematic illustration of a communication protocol used in the system shown in Fig. 20.

[0050] Fig. 22 illustrates a brute force attack according to one embodiment of the invention.

[0051] Fig. 23 illustrates types of data included in data to be encrypted according to one embodiment of the invention.

[0052] Figs. 24 and 25 illustrate an encryption strategy for protecting the security of undiscoverable data according to one embodiment of the invention.

DETAILED DESCRIPTION

[0053] Before embodiments of the invention are explained in detail, it is to be understood that the invention is not limited in its application to the details of the construction and the arrangements of the components set forth in the following description or illustrated in the drawings. The invention is capable of still other embodiments and of being practiced or being carried out in various ways. Also, it is to be understood that the phraseology and terminology used herein is for the purpose of description and should not be regarded as limiting.

[0054] In particular it should be understood that the invention is implemented using various computer devices, such as personal or home computers, servers, and other devices that have processors or that are capable of executing programs or sets of instructions, including special purpose devices such as set top boxes. In general, the invention may be implemented using existing hardware or hardware that could be readily created by those of ordinary skill in the art. Thus, the architecture of exemplary devices will not be explained in detail, except to note that the devices will generally have a processor, memory (of some kind), and input and output devices. In some cases, the devices may also have operating systems and application programs that are managed by the operating systems. The hardware devices will also generally need some ability, depending on the role of the device in the particular embodiment of the invention implemented, to compress or decompress data and to encode data or decode encrypted data. In many instances, a decompression capability may be provided using available codecs, such as hardware-implemented MPEG codecs. A decryption capability may be provided using a decryption hardware or software module capable of decrypting data that is encrypted using the encryption algorithm chosen. One encryption algorithm that is suitable for use in embodiments of the invention is the Rijndael algorithm, an example of which is available at http ://www. esat.kuleuven.ac.b e/~rij men/ri jndael/rii ndaelref.zip .

[0055] Fig. 1 illustrates an exemplary system 20 configured to distribute content over a network. In reality, one or more networks or communication systems such as the Internet, the telephone system, wireless networks, satellite networks, cable TV networks, and various other private and public networks could be used in various combinations to provide the communication links desired or needed to create embodiments or implementations of the invention, as would be apparent to one of ordinary skill in the art. Thus, the invention is not limited to any specific network or combinations of networks. However, it is preferred that the networks or communication system used have the ability to support secure communications such as communications with data encrypted with a version of Rijndael encryption, secured socket layer ("SSL") communications, or others. Furthermore, data can be transferred from one party to another with wire, digital satellite service ("DSS"), or physical media being physically carried from one party to another. [0056] In the embodiment shown in Fig. 1 , the system 20 includes four participants: a content owner or provider 22, a service provider 24, such as a cable company, Internet service provider, or the like, a consumer 26, and an authenticator 28. Although, only one content provider, service provider, and consumer are shown, in most implementations of the invention numerous content providers, service providers, and consumers will be involved. Further, there could even be multiple authenticators, although only one is required. In practice, it is likely that the following relationship will exist: number of authenticators < number of content providers < number of service providers < number of consumers, but again there is no limit on the number of participants or any requirement of a particular relationship between the numbers of the various types of participants.

[0057] In another embodiment shown in Fig. 2, the system 20 includes three participants: the content owner or provider 22, the consumer 26, and the authenticator 28. Although, only one content provider and consumer are shown, in most implementations of the invention numerous content providers and consumers will be involved. Further, as mentioned before, there could be more than one authenticator, although only one is required. Again there is no limit on the number of participants or any requirement of a particular relationship between the numbers of the various types of participants.

[0058] The participants 22, 24, 26, and 28 are connected to each other via two-way links 30, 32, 34, 36, and 38. These links may be a constructed from all or part of the networks mentioned above. The system 20 uses a key-based encryption algorithm and currently available algorithms such as the Rijndael algorithm may be used. The ultimate choice for the algorithms used will depend on a variety of factors including a trade off between the strength of the algorithm (in terms of being broken) and speed (in terms of a processor's capability to perform the mathematical operations required by the chosen algorithm).

[0059] In one embodiment of the invention, it is assumed that the consumer has a decoding processor or similar device, which may, for example, take the form of a "set top box," home computer, or other device. In this same embodiment, it is assumed that the decoding processor is in a "hostile environment," in the sense that consumer may possibly want to tamper or otherwise circumvent rights management features of the decoding processor. Thus, it is preferred that the decoding processor be housed in a container that has the ability to detect intrusions to its interior. It is also preferable, that the decoding processor have "persistent" memory such as non-volatile RAM, EPROM, or other storage where data remains intact after the removal of power. The persistent memory is used to store identification information, which may be a "mutating DD," that, preferably, changes over time.

[0060] In preferred embodiments, the system 20 uses a random number generator to generate certain numbers used by a protocol implemented or followed by the system. It is preferred that the random number generator produce numbers that are as truly random as is possible with the particular technology used to implement the invention. In one embodiment, communication traffic, such as requests from customers to obtain content, is used to create random numbers. Such requests occur, in general, in an unpredictable manner. Thus, the random numbers generated based on such traffic are also truly or nearly truly random, as opposed to pseudo random numbers generated with algorithmic methods.

[0061] In the exemplary embodiment shown, each of the parties 22-28 in the system 20 has different responsibilities and it is assumed that each party trusts the authenticator 28. Further, it is preferable that content provider 22, service provider 24, and consumer 26 be assigned a changing or mutating identifier ("ED"), which is explained further below.

Content Provider ("Alice")

[0062] The content provider 22 is an entity such as a movie studio, recording company, or any other entity that wishes to distribute content electronically. In 'general, it is assumed that the content provider 22 owns the copyright or other intellectual property rights in the content or is authorized by the owner of such rights to distribute the content. It is assumed that the content provider 22 wants to be reimbursed fairly for each copy of its content distributed using the system 20. It is also assumed that the content provider 22 wants to track each provided copy of its content to both the service provider 24 and consumer 26 to which it is allocated. Thus, in one embodiment of the invention, the system 20 is configured such that the content provider 22 can produce a virtual inventory of licenses for content using a list of mutating IDs (generally created as needed), where each license gives authorization to view or in some cases maintain a copy of the content provided. The virtual inventory (or set of licenses) may be assigned to various distribution entities, such as one or more service providers. As the virtual inventory is consumed, the consumption is tracked in order to record, log, or note which service provider 24 provided copies of content to one of its consumers. For instance, tracking of the virtual memory allows a content provider such as a movie studio, which has sold distribution rights to a cable company and a satellite broadcasting company, to determine which of the entities, the cable company or the satellite broadcasting company, distributed the content to the subject consumer. In preferred embodiments, the content provider 22 is the sole encrypter of its content and controls the decoding of the content by, for example, denying a request, as explained further below.

[0063] In another embodiment of the invention, the system 20 is configured such that the content provider 22 can produce a list of watermarks, apply a unique watermark to each copy of its content, and produce a virtual inventory of licenses for watermarked content using a list of mutating IDs (generally created as needed), where each license gives authorization to view or in some cases maintain a copy of the watermarked content provided. The virtual inventory (or set of licenses) may be assigned to various distribution entities, such as one or more service providers. As the virtual inventory is consumed, the consumption is tracked in order to record, log, or note which service provider 24 provided content copy to one of its consumers and, furthermore, which consumer received a particular watermarked piece of content. For instance, tracking of the virtual memory allows a content provider such as a movie studio, which has sold distribution rights to a cable company and a satellite broadcasting company, to determine which of the entities, the cable company or the satellite broadcasting company, distributed the content to the subject consumer. The tracking system also allows the consumption activity of individual consumers to be recorded or logged since a watermarked content can be mapped to a specific consumer.

Service Provider ("Bob")

[0064] In the embodiment shown, the service provider 24 distributes content of the content providers. However, service providers may also have several additional responsibilities, including identification of themselves and the subject content with mutating IDs. In the embodiments described, a user such as the consumer 26 without the appropriate mutating IDs cannot decode content. In many scenarios, the service provider 24 provides the requested content off of or from a storage device that is local to the service provider 24. However, the invention is not limited to any particular location of the content and content may be retrieved from storage of the content provider 22 and then transferred to the consumer 26. In preferred embodiments of the invention, every service provider 24 sees each request from consumers in the system 20 and receives authentication from the authenticator 28. In some embodiments, any one of the service providers in a particular embodiment may be responsible for shipping or transferring the content to the consumer. This allows content providers to avoid having to deliver their content to service providers, if they so desire. In other words, the service provider 24 need not possess (such as by maintaining encrypted copies in local storage) the content that is ordered by consumers.

Consumer ("Carol")

[0065] It is assumed that at least some consumers may wish or attempt to view or consume content without paying for it. Therefore, measures are provided to prevent unauthorized consumption of content. The mutating IDs mentioned above provide one mechanism by which content decoding and, therefore, consumption is controlled. By encapsulating multiple mutating IDs, the set top box is able to prove to the authenticator 28 that 1) the set top box is a licensed decoder of the content, 2) the service provider 24 is a licensed distributor of the content, and 3) the content itself was licensed for use by the content provider 22 for the consumer, as will be explained in greater detail.

Authenticator ("Trent")

[0066] The authenticator 28 is the repository that holds the data necessary to decode a particular piece of content, or watermarked content if applicable. In the embodiments discussed, the authenticator 28 verifies the consumer 26, the service provider 24, and the content by their mutating IDs before sending any decoding information to the subject consumer 26. The authenticator 28 is also the source of mutating IDs and keeps track of such IDs using a database or similar mechanism.

Mutating ID

[0067] An exemplary mutating ID 38 is shown in Fig. 3a. The mutating ID 38 is an identifier having two portions: a first portion 40 and a second portion 42. The first portion 40 is an identifying number, which is a random number. The second portion 42 is an encoding/decoding key, also a random number and preferably a symmetric cipher key. As implemented in the embodiments discussed herein, a mutating ID can be used only once and then can not be used again. Mutating IDs are generated and tracked by the authenticator 28. Because the mutating IDs are one-time-use mechanisms, once a service provider or consumer or other entity has used its supply of mutating IDs, additional mutating IDs must be obtained from the authenticator 28. The data in a mutating ID is chosen at random with an equal probability of all possible mutating IDs, Once a request or decode for specific content has been made, the three mutating IDs (consumer, service provider, content) are discarded and new mutating IDs are generated for additional transactions, in a manner described in more detail below. Information regarding how mutating IDs are distributed to parties in the system 20 is also provided in Figs. 3b and 3 c. Specifically, entities of the system can receive either numerous mutating IDs or a single mutating ID depending on the desired use. In one embodiment of the invention, a provider 43, who may perform functions of both the content provider and the service provider, may request multiple number/key pairs from the authenticator. Each provider 43 requires numerous number/key pairs since each copy of a content item must have a unique license made from a unique number/key pair. The authenticator creates as many mutating IDs as the provider 43 requires and sends a list of pairs 26 back to the provider 43. The provider 43, knowing the quantity of number/key pairs requested and the size of each pair, breaks the list into individual number/key pairs. In other embodiments of the invention, each entity of the content distribution system needs a mutating ID to identify itself to the authenticator, and after using a mutating ID an entity requires a new mutating ID from the authenticator. A single, new mutating ID is sent to the entity, which replaces the entity's previous mutating ID.

[0068] As should be apparent, embodiments of the invention are symmetric key systems. Symmetric key systems commonly encounter key management issues as the number of entities of the system grows. For example, a network of n entities requires n(n-l)/2 keys to enable all entities to communicate with one another. Thus, for a system of 1000 entities, where every entity wishes to send identical content to every other entity, almost a half million keys are required.

[0069] Disclosed embodiments, however, do not require a separate key for every pair of entities of the system. As will be illustrated, each entity and content distributed receives one key, which is mutated after each use. For a system of 1000 entities, only 2000 keys are required compared to the almost half of a million keys with previous symmetric key systems. Also, the authenticator is not required to store the entire bit string of the mutating ID. The authenticator may use a hash function or simply a positional index to map each key partition of the mutating 3D into a memory storage location based on the corresponding number.

[0070] Other differences between embodiments of the invention and prior security systems relate to speed and reduced vulnerability to certain attacks. The use of symmetric keys also allows fast computation (as compared to public key systems) and reduces the effectiveness of chosen plaintext attacks. Embodiments of the invention are relatively fast because of they use symmetric keys rather than public keys. The fundamental concept behind public key systems is the use one-way functions. One-way functions are easy to compute but hard to reverse. Public key systems use trapdoor one-way functions that provide a key to compute the one-way function in the opposite direction. Public key systems provide public keys for each participant that are freely accessed and used as a one-way function to apply to a message. Public key systems also provide private keys (which are underiveable, at least as originally thought, from the public key) to each individual participant to compute the message given the calculation of the one-way function. The security of public key systems relies on the fact that the private key cannot be derived from the public key. In order to maintain this requirement, the one-way functions used in public key systems are complex. The added complexity, however, comes at the cost of added computation time. Public key systems are often 1000 times slower than symmetric key systems.

[0071] Regarding reduced vulnerability to attacks, a chosen-plaintext attack occurs when an intruder has access to an encryption key or process, chooses specific plaintext to encrypt, and attempts to gain knowledge from the encrypted text. In public-key systems an individual's public key is known to all participants in a communication system. Any intruder can encrypt an endless number of messages using an individual's public key. If an attacker encrypts possible messages with an individual's public key and then intercepts an encrypted message sent to the individual, the intruder can compare the intercepted message with messages he or she has created. If an interception message matches an encrypted message created by the intruder, the message has been compromised and the intruder can now read a message that was not intended for him or her. This attack is easy and effective if a small number of possible messages exist, but even if the number of possible messages is more than the intruder is able to encrypt or compare with intercepted encrypted messages, just knowing that an intercepted encrypted message does not correspond to a particular message can provide useful information to the intruder. In either situation, the intruder will not be able to deduce the private key of the individual but he or she may be able to deduce the message, or information regarding the message, sent to the individual. Since the embodiments of the invention utilize a symmetric key system, chosen-plaintext attacks are not applicable because encryption keys are not public knowledge.

[0072] There is another problem with prior symmetric key systems and public key systems. Once an unauthorized entity gains access to an authorized key, the unauthorized entity can decode all messages encrypted with the compromised key, and, perhaps more dangerous, can encrypt false messages to deceive other entities of the system. The mutating ID protocol reduces this weakness by mutating each symmetric key after it has been used. Even if a key is compromised, the compromised key cannot be used to generate future messages nor be used to decrypt future message since it is marked by the authenticator as used and is never used again to encrypt messages.

Protocol

[0073] The system 20 uses a protocol to govern communications between entities. Each entity is randomly assigned a one-time use number/key pair, or mutating ID, (such as the identifier or ID 38 shown in Fig. 3A) that is to be tagged onto a previously mutated H) by the authenticator 28. As noted, each mutating ID includes a random number 40 and a random corresponding coding key 42. The one-time-use number/key pair may take the form of a modified hash. In addition to being random, the one-time-use number/key pair or the hash is immediately discarded after each decryption. In other words, the protocol generates a new random number that has never been used when a hash or a one-time-use number/key is needed. In addition to identifying the entity participating in the content distribution system, the one-time-use number/key is also a completely unrelated hash from the entity using it. That is, the hash does not contain any information concerning the identity of the entity. In this way, the identities of the entities are blind to all participants except for the authenticator 28.

[0074] The authenticator 28 also generates encryption keys for the content distributed over the system 20. Any entity wishing to distribute content requests a key. The entity sending the content supplies the authenticator with a function, or any identifying string, of the content to distribute and the authenticator responds with an associated key. The key, like the mutating IDs, is unrelated to the content that it encrypts. The authenticator also has no knowledge of the true content since only a function of the content or a random identifier is provided. The authenticator records the key and the associated function, or identifying string, of the content. The authenticator supplies the key to any authorized entity of the system 20 that makes a legitimate request. A request for the associated key to a content item includes a reference to the function, or identifying string, of the content item. The authenticator 28 looks up the matching key to the function, or identifying string, indicated in the request and returns the found key.

[0075] Certain embodiments of the system 20 are implemented with an encryption algorithm and a random number generator. Preferably, the encryption algorithm is a symmetric key-based encryption algorithm. The keys are permutation identifications, offsets, and skips. All three could be bundled into one object called a "key." Therefore, any key based encryption algorithm can be used in embodiments of the invention. Since introducing a new encryption algorithm can be a very time consuming process, the system 20 was created to allow already existing and tested key-based encryption algorithms to be used.

[0076] With respect to generating a random number, in the embodiment shown, three different procedures are used. Of course, other combinations of random number procedures can also be used to generate a random number. The first random number generation procedure is a standard congruential random number. The second random number generation procedure generates a random number that is used to determine a sampling rate of a random stream.

[0077] Acquiring a random stream can be difficult. By conventional definition, a random stream or a set of numbers is considered random if and only if the set is the most compact way to represent the numbers. For instance, given the set 2, 4, 6, 8, 10, θ, a more compact representation would be {2i|i <= Z+} or any even number in the positive integer number set. Another way to state this is a set of numbers for which there is no discernable "pattern." The goal of encrypted communication is to remove all patterns from the encrypted data being transmitted so that intelligent guessing cannot be used to decrypt the encrypted transmitted data. In embodiments of the system 20, the authenticator 28 provides all the random numbers used in the distribution and transmission of content. As discussed in more detail, the sequence of generated numbers is a sequence of random numbers or a random stream, or at least a close approximation to a random stream. [0078] The third process of the random number generator is to ensure that there is no deterministic way to retrieve the next number. The random streams coming into and leaving the authenticator 2_.8 are encrypted and thereby contain encrypted data. This non- deterministic mechanism used to generate the random stream helps ensure that the random number sequence cannot be represented by a more compact expression, hence defining a random stream.

[0079] For example, the authenticator 28 is designed to receive requests to decode content. These requests reach the authenticator 28 in a random order. For instance, suppose consumer X requests the key to movie Y, and consumer W requests the key to song Z, etc. These requests are formalized by the protocol as sequences of numbers that have been arbitrarily chosen either to be intentionally arbitrary or encrypted by an arbitrary key. Since the requests are arbitrary in nature and are processed in an arbitrary fashion, a stream of random numbers is naturally generated. By sampling this stream in a semi-arbitrary way (i.e., congruential random number), a good sequence of random numbers is generated.

[0080] In one embodiment, the protocol used in the system 20 combines a packet assembly disassembly generator or PAD, key pairing, and a RC4 random stream cipher. More specifically, to encrypt the information in a window of data, a PAD series is generated once a PAD generator is chosen. A second random stream P is generated based on the PAD series in the following manner:

P_k = pad_Wmaάn ®pad_(hM)modn ®"-®pad^_j)moάn

where pk is the k-th element of the P series, and padfø) _mod_n is the y'-th element of the PAD series. That is, every element of the P series is a combination of exclusive-ORing of the elements in the series generated by the PAD generator. The key pair generally includes a public key and private key. These keys do not have any mathematical relation. They are generated randomly and independently of each other. The keys themselves are simply twenty or more digit numbers. Each entity has a unique key pair.

[0081] An exemplary embodiment of the protocol will now be discussed in greater detail. In the embodiment shown in Fig. 1, the content provider 22 performs encryption (and is sometimes referred to as the "encrypter"). The content provider 22 encrypts content with a particular key or set of keys K. The content provider 22 may store or keep the set of keys K or, alternatively, the authenticator 28 may maintain the set of keys. If so maintained, the authenticator 28 maintains the set of keys K in secret. The content of the content provider is assigned a secret identifying label (e.g., a number that, in general, never changes). The label is given to the authenticator 28 and the authenticator associates the label with the keys needed to decode the encrypted content. The association is indirect, as the association process does not provide any entity access to the actual keys. The encrypted content can now be given to the service provider 24 or another entity without fear of unauthorized decoding, because only the content provider and the authenticator have the actual keys needed to decrypt the content. At this point, the content provider 22 creates the virtual inventory for the content. This involves asking the authenticator 28 for as many mutating IDs as the content provider 22 needs or wants to have. Each mutating ID represents a license allowing exactly one use or consumption of the content. As mentioned earlier, the mutating ID is a number and a key. The content provider 22 encrypts the identifying label with the mutating ID key and groups the mutating ID number and encrypted identifying label into a single piece of data called the "encrypted identifier," which is represented here as "E_oontent-"

[0082] As each piece of content is consumed, the authenticator 28 tracks which service provider 24 the particular content came from and notifies the content provider 22 of each such decoding. Once it receives content, the service provider 24 combines each encrypted piece of content with other identifying data before distribution to the consumer 26. Each service provider 24 keeps a collection of mutating IDs on hand that are used to identify that particular service provider. As with all others, these mutating IDs are created and tracked by the authenticator 28. The service provider 24 also has a list of E_content identifiers for each piece of content. Once requested, the service provider 24 picks an unused E_content identifier and one of its unused mutating IDs. The service provider encrypts the E_COnten_t identifier with the key of the chosen mutating ID and attaches the associated number creating a piece of data referred to herein as the "distributable content" or "E_di_stπ_b-" The service provider 24 sends the Edistrib content to the consumer 26 and awaits a confirmation signal from the authenticator 28 that allows decoding.

[0083] The confirmation signal is received as an encrypted parcel of data that can be decrypted with the mutating ID key used to create the E_di_stri_b content. The confirmation signal is an agreed on, secret set of bytes set by the service provider 24 and authenticator 28. Once the confirmation has been received and verified, the service provider 24 can send the encrypted content or E_con{ent identifier to the consumer 26.

[0084] As noted above, it is assumed that the consumer 26 wants to cheat the system 20. For that reason, all communications between the consumer 26 and the authenticator 28 are encrypted by some encrypted communication method. The consumer 26 is given only one mutating ID at a time. When the consumer 26 wants to view or receive some content, the consumer 26 makes a selection of the desired content using the set top box or hardware in place at the site of the consumer 26. The hardware device then requests the content from the service provider 24 who sends the E_di_stπb content for a particular decode. Once this has been received by the consumer 26, the Edistπb content is encrypted with the consumer's mutating ID key and coupled with the mutating ID number into a consumer identifier referred to as an E_consumcr identifier. The E_consumcr identifier is then sent to the authenticator 28 for verification. Upon verification, the authenticator 28 informs the service provider 24 by a secure channel that the consumer's set top box is licensed to consume the subject content. The authenticator 28 also discards the current set top box mutating ID and sends the set top box a new, unused mutating ID.

[0085] The consumer 26 simultaneously receives, from separate sources, the encrypted data and keys necessary to decrypt the data. With this, the decoding device can decode the requested content.

[0086] Generation of mutating IDs and keeping track of them is the primary task of the authenticator 28. Distribution of mutating IDs to content providers and service providers can be handled via any acceptable means to both, as long as they stay secret to the respective receiver. To ensure that consumers do not ever have more than one mutating ID, once an E_oonsumer identifier is verified as accurate, a new mutating ID is encrypted using the consumer's current mutating ID key and sent to the consumer 26. The consumer can then use that ID for the next transaction. Since the authenticator 28 keeps track of all mutating IDs, it can verify that an E_consumer identifier is or contains a valid request. To do so, it finds the key associated with the number in the E_consUmer identifier and decrypt it, revealing the E_consumer identifier. If no key can be found, then the authenticator 28 returns a failure. Using the exact same process, the authenticator 28 recovers the E_COnt_ent identifier. If no key can be found, then the authenticator 28 returns a failure. Once again, the authenticator 28 decrypts the E_content identifier, if possible. If it is possible, the authenticator 28 look ups the confirmation code for the service provider 24, encrypts it with the mutating ID key used by the service provider 24, and returns it to the service provider. A new mutating ID is then sent, followed by the decoding data. The authenticator 28 then notes or otherwise records all the participating parties, time, and content involved in the transaction for billing purposes.

[0087] As was noted above, one aspect of the invention is to ensure that copies of content are not obtained by unauthorized or unlicensed entities. In the embodiments discussed, obtaining an unauthorized copy of the content would require a person or entity to intercept a message and then break the encrypted content. It is assumed that this is impossible, at least in practical terms, because even if the content was intercepted (which would not be a trivial task) decoding it would be very difficult. This is so, in part, because it is possible, using the random numbers and encryption algorithm discussed to create encrypted data that would require a very long time (on the order of years and in the inventors' opinion, thousands of years) to decrypt. Types of attack would generally require correctly guessing or otherwise obtaining an E_coπsumer identifier. However, since each mutating ID is used only once by the controller of that ID, there is no way to divine one E_consumer identifier by inspecting another. Further, since the mutating IDs are calculated to be random (to the limit of the random number generator), it is infeasible to calculate one mutating ID from another.

[0088] In addition to providing a high degree of security, the protocol allows for interchangeable parties at each position. In other words, multiple content providers can use multiple service providers to reach multiple consumers using the authenticator 28 agreed upon by all parties. Further, positions can easily be merged or modified to fit many different distribution models. However, it is generally required that the virtual inventory be maintained by the content provider 22 and/or service provider. As noted, the virtual inventory is preferably a list including secret mutating IDs. The virtual inventory may be traded like any other commodity. Thus, rather than a discrete piece of data being the actual digital content of the desired piece of content, it becomes the E_consUmer identifier constructed by a particular set of events leading to one particular viewing of that content. Since the E_consumer identifier cannot be constructed without cooperation from all parties involved, all parties have the ability to negotiate and reach a mutually beneficial arrangement for the consumption of digital content at the demand of the consumer 26. Should one party decide to not participate, communication with the authenticator 28 can prevent decoding by withdrawing the consent of one or more parties.

[0089] As was noted above, the system 20 is not limited to just four parties. More distribution layers can be introduced and verified through the unraveling process in the same manner. For instance, one service provider 24 can distribute to another service provider. The authenticator 28 can continue to unravel an E_consum_er identifier until it has found a content provider 22. This can be accomplished by the simple recursive algorithm used to create Ec_onsume_r identifiers. The important distinction is that the implementation of the authenticator 28 controls the ultimate decoding of content based upon the E_COnsumer identifier. Should a content provider 22 or service provider 24 want to control the distribution downstream, it is easy to control by informing the authenticator 28 to deny decoding of content under particular circumstances.

[0090] Exemplary embodiments of the invention will now be described using several examples.

[0091] As with many descriptions of communication protocols, names are assigned to the various entities (or computer systems associated with those entities) used in the protocol. In one embodiment, Alice (A), Bob (B), and Carol (C) represent various participants in a protocol and Trent (Z) represents a trusted arbiter of communication. The following table, Table 1, is a list of other symbols used in this document to explain multiple embodiments of the protocol.

Table 1

<img file="WO2007120215A2_D0001.tif" />

[0092] An exemplary embodiment of the protocol involves three of the entities discussed above. The entity Alice or A performs the role of the content provider 22, entity Carol or C performs the role of the consumer 26, and entity Trent or T performs the role of the authenticator 28. Since the proposed protocol relies on a trusted authority, Alice and Carol trust Trent. Also, Alice has two secrets: a number (NA) and a key for some symmetric cipher (K_A). Similarly, Carol has a secret number (Nc) and key (Kc). Further, all assigned number and keys are assigned and known by Trent.

[0093] For the purposes of this example only, assume Alice wishes to send an electronic mail message Pi securely to Carol. Of course, Alice could represent any entity needing to distribute a variety of content items. Besides text messages, Alice could distribute music, images, video, data, etc. using the same protocol described herein.

[0094] To start, if Alice wishes to send the message Pi to Carol, she requests a key for the message Pi that she will use to encrypt Pi and Carol will use to decrypt Pi. To do this Alice creates a label for the message Pi by using a function to create a hash of the message and encrypts the label with her KA, and prepends N_A.

<img file="WO2007120215A2_D0002.tif" /> [0095] When Trent receives the request from Alice and since he knows Alice's secrets, he looks up the key associated with N_A and decodes the request for a key to be used with the message Pj. Trent, however, does not receive the message P but only receives a hash of the message Pj. He can then generate a key Kp j and associate it with the supplied hash for future reference. Using this protocol, messages are kept secure even from Trent and keys generated by Trent offer no useful information regarding the data the key will encrypt. Trent does not receive information that would allow him to directly learn the message generated by Alice or allow him to corrupt the system by sending messages generated by Alice to unwanted parties. Alice also requires a new mutating ID since each number/key pair is valid for one use. Trent supplies Alice with the key Kp j for the message Pi, a new secret number (N'_A), and a new secret key (K'_A). Trent encrypts the three elements with Alice's previous secret key and sends the message back to Alice.

T → A: E(KA₁N¹AK¹AKP₁)

[0096] Alice notes her new secret number and key received from Trent and encrypts the hash of the message Pj with her new secret key K'_A, prepends N^ and sends the message to Carol.

A → C: N¹_AE(K^H(P₁))

[0097] Upon receiving the message from Alice, Carol encrypts the message with her secret key UTc, prepends her secret number Nc , and sends the message to Trent.

[0098] C → T: N_CE(K_C,N'_AE(K'_A,H(P_J)))

[0099] Trent realizes that Nc belongs to Carol and can decrypt the outer encryption performed by Carol. Trent can also decrypt the inner encryption performed by Alice since he recognizes NΑ as being Alice's secret key. Once decrypted, Trent determines that H(Pi) is the hash of the message Alice previously sent and that he previously created a key Kp j for. Trent then generates a receipt for Alice indicating that she may send Carol the message Pj and sends Carol the key previously generated for the message Pj and the hash of the message Pj. The receipt Trent generates for Alice includes the hash of the message Carol is requesting a decryption key for, in the current example, H(Pj) and the identity of Carol Cut. By identifying both the message and the entity receiving the message Alice can be guaranteed that the correct receiver receives the correct message. Alice may choose not to send the message P₁ based on the information contained in the receipt generated by Trent if Carol was not the intended receiver or if the hash of the message is not the intended message for Carol. If Alice chooses not to send the message P₁ to Carol, the message P_\ is not compromised, even though Carol has received the decryption key Kpj from Trent for the message. The key Carol receives, which Trent generated, contains no information concerning the message which it would encrypt. Therefor, if Alice does not send the message Pi, Carol will not be able to deduce the contents of the message Pj simply by having the key Kpj. Trent also generates new number/key pairs for both Alice and Carol since both Alice and Carol have used their current secret key and number. Trent concatenates the receipt (Alice's new secret number N'Α and secret key K" _A) encrypts the concatenated elements with Alice's current secret key K% and sends the message to Alice. Trent concatenates the decryption key Kp j for the message P (Carol's new secret number N'c and secret key K'c) encrypts the concatenated elements with Carol's current secret key Kc, and sends the message to Carol.

T →A: E(K'_A,N"A K"_A H(P₁)C₁₀)

T → C: E(Kc,N'c K' c Kp₁H(P₁))

[00100] Upon receiving the message from Trent, Alice can decode the message and determine if the hash H(P₁) returned to her by Trent in the receipt is the same that she sent to Carol. This provides Alice with an opportunity to double-check the message and the intended receiver once more before sending the message. As described above, if any part of the receipt appears fraudulent, for example, if the hash of the message is not the message Alice wished to send Carol or if a receiver other than Carol is requesting decryption keys for the message, Alice can simply not send the message P₁ encrypted with the key Trent generated. If everything appears correct, Alice can encrypt the message P₁ with the key Kpj generated by Trent and send the encrypted message to Carol.

A → C: E(KPJ₁P₁)

[00101] Once Carol has received the encrypted message P₁ from Alice and the decryption key from Trent, Carol can recover the message P₁ by applying the received decryption key to the received encrypted message. Precovered = D(Kp₁, E(Kp 1, P₁))

[00102] Carol can also verify the message received from Alice, if Carol knows the function that Alice initially used to create the label for the message. Specifically, Carol can compare the hash of P 'recovered with the hash of the message Pi received from Alice. If the two hashes are identical then Carol can conclude that the encrypted message received from Alice is associated with the initial message hash H(Pi) sent to both Carol and Trent. If the two hashes are not identical, Carol would have reason to believe that fraudulent behavior is at work in the content distribution system.

[00103] The email example presented above can be extended to more general problems. The protocol could be used, for example, to authenticate a computer to use the resources provided by a server across a network. Many users connected on a network use applications that depend on virtual private networks ("VPNs") for secure communication. The security of VPNs is built into the network layer of the communication model as defined by the Open Systems Interconnection ("OSI") Model. By using mutating IDs at the application layer, one could create virtual private applications ("VPAs") instead of VPNs. With the use of VPAs, email, file systems, and other business level end-user applications could authenticate without the need for complex networking. By securing communication at the application layer, more security is provided at the local area network ("LAN") layer. This also simplifies wide area networks ("WANs") and LAN security to end-users.

[00104] Another use of mutating IDs is in authenticating participants to a transaction. Let Alice be a server with resources that Carol, a client computer can utilize. Let Bob represent a user of the client computer Carol who instructs Carol to utilize particular resources. Trent remains the authenticator for the protocol. Assume that Alice, Carol, and Bob all have a secret number N and a secret key K as described previously. Further, assume that Trent knows all secrets and Alice, Carol, and Bob do not know each other's secrets.

[00105] Since Alice needs to service many clients at once she needs a large list of number/key pairs. Assuming that Alice already has one number/key pair, she can negotiate with the authenticator, Trent, to get many number/key pairs. Alice first needs to prove to Trent that she is the appropriate server. To do this, she encrypts some identifier that Trent will recognize as belonging to Alice with a request for x number/key pairs. A -→ T: N_AE(K_A1AM Send x number/key pairs)

[00106] Once Trent validates the request, he generates the number/key pairs and encrypts them with K_A to send the list of pairs back to Alice as shown in Fig. 3B.

T → A: E(K_A, N¹_AK¹_AN²_AK²_A...)

[00107] Alice can now destroy the number/key pair NJK_A and Trent marks them as used. This protocol can be run at any time to ensure that a server has enough number/key pairs to service requests.

[00108] A user, Bob, supplies his identifying credentials (e.g., a password, a user identifier) to client software on the client computer, Carol, who encrypts Bob's credentials and her own identity with her current secret key and prepends her current number. This is then sent to the requested server, Alice.

C → A: NcEiKc. BcM)

[00109] Alice then encrypts the received message with one of her keys and prepends the associated number. This is then sent to the authenticator, Trent.

A → T: N_AE(K_A, N₀E(K₁₁, B_credC_id))

[00110] Trent can unwrap the encryption of the message to determine that Bob would like to use services resident on the server, Alice. At this point Trent can verify the identity of Bob and Carol and validate that both Bob and Carol are authorized to use the server, Alice. After identity and authorization credentials are checked and approved, Trent can then generate two messages. The first message is destined for Carol, the client computer, and contains, encrypted with K_c, a new number/key pair, the identity of the server, Alice, and a session key Ks- The second message is destined for Alice, the server, and contains the identity of the user, Bob, the identity of the client computer, Carol, and K_p. All the components are then encrypted with K_A.

T→ C: E(K_c,Ai_dN'_cK_cKs)

T → A: E(K_A, B_idC_idKs) [00111] At this point, the client computer, Carol, knows that the key Ks is safe to use to encrypt all communication with the server, Alice. Furthermore, Alice knows that the identity of the client computer, Carol, and the user, Bob, have been validated by Trent.

[00112] As should be apparent, secure validation between entities within an insecure system using the above embodiment of the invention requires a minimum number of steps. In order for Carol to initiate communication with Alice securely, she sends a single message to Alice who then forwards the request to Trent for validation. After the request has been confirmed, Trent sends both Carol and Alice a mutating ID to use to communicate. By allowing Alice to acquire her number/key pairs needed to issue to a requesting entity at any time through the protocol the number of steps required is also reduced. Alice does not need to wait for an entity to request service to ask for a number/key pair from the authenticator nor does an entity need to wait for Alice to acquire a number/key pair one at a time on a need basis.

[00113] Ih comparison, current systems used to establish validated communication between two entities require a larger number of steps that when applied to systems with many services and entities requesting service grow at a high rate. Some current systems require an entity to validate its request with multiple entities before it is allowed to directly communicate with a service. Even the number of steps required for simple tasks, such as logging on, can grow quadratically in respect to the number of components, such as entities and services, associated with the system. Many current systems also rely on timestamps and synchronization of clocks between all participating parties. If any internal clocks differ among the entities, entities may be required to re-authenticate themselves and gain new session keys, which further increases the communication needed to validate the use of a service. When a large number of entities require validation with a large number of services the overhead presented with current systems is believed to be greater than that required by the above described mutating ID system under similar conditions.

[00114] Another exemplary embodiment of the protocol involves all of the four entities discussed previously. In this embodiment, Alice or A performs the role of the content provider 22, entity Bob or B performs the role of the service provider 24, entity Carol or C performs the role of the consumer 26, and entity Trent or T performs the role of the authenticator 28. Since the proposed protocol relies on a trusted authority, Alice, Bob, and Carol trust Trent. Also, Alice has two secrets: a number (N_A) and a key for some symmetric cipher (KJ). Bob also has two secrets: a number (N_B) and a key for some symmetric cipher (K_B). Similarly, Carol has a secret number (Nc) and key (Kc). Further, all assigned number and keys are assigned and known by Trent.

[00115] For the purposes of this example only, assume Alice is a movie producer with a movie M. Alice would like to use Bob's cable company (e.g., video-on-demand) to distribute the movie M, and Carol, one of Bob's customers, wishes to receive and watch the movie M. Of course, Alice could represent any entity needing to distribute a variety of content items. Alice could distribute email messages, music, images, data, etc. using the same protocol described herein.

[00116] To start, if Alice wishes to distribute her content, she requests numerous number/key pairs from Trent. To do this Alice creates a message P₂ indicating the request, encrypts the request with her K_A, and prepends N_A- By encrypting the request with her secret key, Trent can verify that only authorized persons are granted number/key pairs. Alice then sends the message to Trent.

A → T: N_AE(KA, P₂)

[00117] Upon receiving the message from Alice, Trent decodes the request for numerous number/key pairs since he knows Alice's secrets. Referring to Fig. 3B, Trent generates a list of licenses and sends the entire list back to Alice encrypted with Alice's key K_A, which is known to both Trent and Alice.

[00118] T → A: E(KA, (N¹A^₄)))

[00119] Alice now coordinates with Trent to receive a key to encrypt each copy of her movie M. Alice generates a label for M, in the current embodiment a hash of M is used, which is used as an identifier for the movie M. Alice picks some arbitrary number/key pair y and encrypts the hash of M with K? _A, prepends N_A, and sends the message to Trent.

A → T: N¹_A E(K¹_A1H(M)) [00120] Alice could also include a unique identifier Mid for the movie M that is known by the other entities of the protocol in the message sent to Trent. The addition of the identifier provides Trent with a mechanism to match and authorize requests for encrypted content.

A → T: N¹_AE(^H(M)M₁₄)

[00121] Upon receiving the message from Alice, Trent generates a key K_M associated with the hash of the movie M and sends it back to Alice encrypted with KA. Trent records that the sent key K_M is associated with the hash of the movie M (and the unique identifier Mm if provided). Even though Trent is generating the key for encrypted content, he never receives the content. All Trent receives is the hash of the movie M and possibly a unique identifier that is known by all entities of the system. He has no other useful information regarding the content provided by the content provider. Trent has no information that would allow him to directly distribute content without the intervention and authorization of the content provider.

[00122] T → A: E(HS_AX_M)

[00123] Alice can now encrypt M with K_M with the confidence that only she and Trent know K_M- She encrypts M with K_M and sends it to Bob.

[00124] A → B: E(K_MM)

[00125] Alice also sends Bob corresponding primary licenses for the encrypted copy. We call the license sent by the content provider a primary license since it may be further authenticated by a service provider before it is distributed. Alice creates each primary license by encrypting the hash of the movie M with a key J^_A and prepending a number TV^ of an arbitrarily chosen number/key pair k from the list generated by Trent. Alice sends each primary license to Bob.

[00126] A → B: rf_A E(K¹^H(M))

[00127] Although Bob has received both the encrypted content and the corresponding primary license, he still is unaware of the decryption key and so cannot distribute copies of M that Alice would be unaware of. He could distribute either the encrypted content or the primary license to as many consumers as he wished without interaction from Alice or Trent, but the consumers would be unable to view encrypted content or use the primary license. Bob also has no information regarding the content Alice is providing from either the encrypted copies or the primary license. By providing Bob with licenses, Alice can restrict the number of copies of content Bob can deliver since each license will be marked as used by Trent after it has been issued to a consumer. With a valid license from Alice, a service provider and consumer cannot gain content. Alice should have at least one number/key pair remaining that is known to Trent. If Alice needs more number/key pairs, she could use the one remaining number/key pair to request more from Trent.

[00128] Once Bob has received the encrypted copies of M and the corresponding primary licenses signed by Alice, he further authenticates each primary license sent by Alice to place his ownership on the content before the license is distributed to consumers. Having Bob further authenticate each primary license is not required, but protection is increased for Alice's movie M since Alice can ensure that requests for content items have been properly initiated through authorized distributors. In order to add greater authorization to each primary license, Bob first requests numerous number/key pairs from Trent in a manner similar to how Alice acquired numerous number/key pairs defined above. Bob creates a message Pj indicating the request, encrypts the request with his K_B, and prepends N_B. Bob then sends the message to Trent.

B → T: NBE(K₈, P₃)

[00129] When Trent receives the message from Bob, he looks up the key associated with N_B, since he knows Bob's secrets, and decodes the request. He then generates the numerous number/key pairs requested and sends them back to Bob encrypted with K_B.

<img file="WO2007120215A2_D0003.tif" />

[00130] Clearly, Bob could request the number/key pairs before or after receiving the encrypted copies from Alice. He does not need to send anything that he receives from Alice in order to request number/key pairs from Trent. He simply needs to be identifiable to Trent as an entity that can request and receive number/key pairs.

[00131] After Bob has received the number/key pairs from Trent he can create a distributable license, a license that can be distributed to requesting consumers, by choosing an arbitrary number/key pair m from the list Bob received from Trent and encrypting an encrypted identifier received from Alice with the key K"¹_A and prepending the number N™_A from the chosen number/key pair m.

<img file="WO2007120215A2_D0004.tif" />

[00132] Bob repeats this procedure for however many distributable licenses he wishes to distribute or is authorized to distribute by Alice.

[00133] Now that Bob has the content, we can address the next step of the process. Carol wishes to view content M and sends a request for M to Bob that includes the unique identifier for the movie M.

<img file="WO2007120215A2_D0005.tif" />

[00134] Carol's request for content may be encoded to protect it from corruption. Without encoding the request, Carol's request could be intercepted and changed, and Carol may receive content that she did not intend to purchase. Carol can protect her request by encoding it with a secret key shared between Bob and her. Carol could also send her request to Bob using one of the previously disclosed embodiments of the invention. Overall, Carol could use any security mechanism to secure her request.

[00135] Bob receives the request from Carol and replies by choosing one of the distributable licenses he previously generated for the movie M identified by the unique identifier Mi_d included in Carol's request. Bob sends the distributable license to Carol and notes that the license has been used and sent to Carol.

<img file="WO2007120215A2_D0006.tif" />

[00136] After receiving the distributable license from Bob, Carol encrypts it with her key Kc and prepends her number Nc- Carol sends the encrypted distributable license to Trent.

<img file="WO2007120215A2_D0007.tif" />

[00137] Upon receiving the encrypted distributable license from Carol, Trent can unwrap all of the encryption, since he knows Carol's, Bob's, and Alice's secrets, and can determine that Carol received a valid license and needs the decryption key for the content M. Recovering this information allows Trent to generate a receipt for Bob by concatenating Bob's primary license with the identity of Carol and encrypting it with the key it was originally signed with K"B and prepending the number originally prepended when Bob signed the license iW Trent sends the receipt to Bob.

T → B: ITB E(B^B ,JV*, E(J^ _A,H(M))C_id)

[00138] The receipt Bob receives from Trent not only informs Bob that Carol has been authorized as a consumer, but it also directs Bob to send the matching encrypted copy of the content specified by the hash H(M) to Carol. Bob is also able to verify that the distributable license Carol forwarded to Trent is the same distributable license that he initially sent Carol. Carol cannot substitute a different distributable license nor can another consumer use a distributable license that Carol received from Bob. After Bob has inspected the receipt from Trent, he sends the requested encrypted copy to Carol.

<img file="WO2007120215A2_D0008.tif" />

[00139] Carol also requires both the decryption key necessary to decipher the received encrypted copy of M and a new number/key pair so she is able to make a second request for content, since she consumed her old mutating ID with her request for the movie M. Trent, knowing the content requested M and the key used to encrypt a copy of M, since he created it, sends the key to Carol along with a new number/key pair to be used for future requests. Trent concatenates the new number/key pair with the needed key for the encrypted copy of M and encrypts the elements with Carol's current key Kc- Trent does not need to prepend Carol's assigned number Nc since Carol only has one number/key pair and does need to look up a matching key given a number from a list of number/key pairs as does Alice and Bob. Thus, Trent sends the following to Carol.

T→ C: ECK_CN'_CK'_CK_M)

[00140] Alternatively, if Alice has provided a unique identifier to Trent for the encrypted content, which is known by Carol, Trent can ask Carol for a final commitment for the content before sending the decryption key. Trent can send Carol a new number/key pair and the unique identifier Mi_d corresponding to the content specified in the distributable license Trent received from Carol.

<img file="WO2007120215A2_D0009.tif" /> Since the unique identifier is known by all participating entities, Carol can verify that the decryption key she is about to receive from Trent is for the content that she requested. If the identifier does not correspond to the content she requested, Carol knows that her initial request either contained faults or was compromised, and she can stop Trent from, providing a decryption key for the content. By requesting final authorization before sending a decryption key, Carol may avoid charges for content that she did not want. Otherwise, if the identifier does match the content requested, Carol can authorize Trent to send the decryption key.

C → T: E(Kc , Authorize)

T → C: E(K_CKM)

[00141] Carol now has everything she needs to watch the movie M.

[00142] Trent could also generate a receipt for Alice at this point, allowing her to track a consumer to particular content. Trent can concatenate the label of M and Carol's identity C and encrypt all the elements with Alice's key K^_A and prepend the number N^ used in the license sent to Carol.

T →A: N¹¹_A EQd A, H(M)C_id)

[00143] Trent also can mark all the number/key pairs encountered during the transaction ((K¹¹A, <img file="WO2007120215A2_D0010.tif" /> Kr B}, (KC, NC)) as used so that should he encounter one of them in the future, he will know that something is amiss. That is, Trent can ensure that each number/key pair is used once and only once. Accordingly, any reuse indicates that an entity or person is attempting to defraud the system.

[00144] At this point Alice knows that Bob distributed a copy of the movie M to Carol. However, Alice cannot track a specific copy of the movie M to Bob or Carol. If an illegally distributed copy of the movie M appears in the market it cannot be traced to a specific service provider or consumer. Alice can only generate a list of entities that licensed the content. This freedom from tracking encourages consumers who legally purchase a copy of the movie Mto illegally distribute the acquired copy.

[00145] In another embodiment, Alice can trace a particular copy of a content item to a service provider and a consumer by uniquely watermarking each copy created and distributed. By providing Alice a means to track specific copies to specific consumers, consumers who purchase content legally may be deterred from dishonestly replicating the acquired copy.

[00146] In one watermarking embodiment, the entity Alice or A again performs the role of the content provider 22, entity Bob or B performs the role of the service provider, entity Carol or C performs the role of the consumer 26, and entity Trent or T performs the role of the authenticator 28.

[00147] Similar to the non- watermarking embodiment with four entities, Alice requests numerous number/key pairs from Trent with an encrypted message P 4.

A → T: N_AE(K_A, P₄)

[00148] When Trent receives the message from Alice he generates a list of number/key pairs and sends the entire list back to Alice.

T → A: E(K_A1 (M_A1IC_A)))

[00149] Once Alice receives the numerous number/key pairs she can choose to further protect her content by applying a unique watermark to each copy of M. Alice generates a list of watermarks Di, D₂, ..., D_n and a watermarking scheme W for her movie M. Alice can then generate many different hashes for M, one for each watermark. Consider:

M₁ = W(DuM)

M₂ = W(D₂M)

M₃ = W(D₃M) ...

[00150] In contrast with the non-watermarking embodiment, Alice can now coordinate with Trent to receive a key to encrypt each watermarked copy of her movie M instead of receiving a single key to encrypt her movie M. Alice generates a label for M and a hash of each watermark D_/, D₂, ..., D_n, and picks some arbitrary number/key pair/ Alice encrypts both the hash of M and hash of an individual watermark Di with K ^fΑ, prepends N*_A, and sends the message to Trent. A → T: N _AE(&amp; _A1H(M)H(Di))

[00151] As noted in the previous embodiment, Alice could also provide a known identifier for the movie Mi_d in the message to Trent so that Trent can use the identifier later to request final authorization from a consumer.

A → T: N&gt;^'_AE(gA,H(M)H(D,)M_id)

[00152] Upon receiving the message from Alice, Trent generates a key K_MI associated with the hash of the movie M and sends it back to Alice encrypted with K^J_A. Trent records that the sent key K_MI is associated with the hash of the movie M and the hash of the watermark Z⁾_/ (and the known identifier Mi_d if provided). Even though Trent is generating the key for encrypted, watermarked content, he never receives the decrypted, watermarked content. Again, Trent has no useful information regarding the content provided by Alice.

T →A: E(K&gt;_A,K_MI)

[00153] Alice can now encrypt Mi, the watermarked content and send it to Bob.

A → B: E(KMI,MI)

[00154] Alice also sends Bob the corresponding primary license for the encrypted, watermarked copy. Alice creates the primary license in the same format as she did in the non-watermarking embodiment but concatenates the hash of the watermark to the hash of the movie M.

A →B: N*_A E(^₁H(M)H(D,))

[00155] Once Bob has received the encrypted, watermarked copies of M and the corresponding primary licenses signed by Alice, he authenticates each primary license as he did in the non- watermarking embodiment. As noted before, Bob's authentication of each primary license is not necessary, but it does offer added protection and security with the communication system. Bob first acquires numerous number/key pairs from Trent by sending Trent a message Pj.

B → T: N_BE(K_B, P₅) [00156] As before, Trent receives the message from Bob, generates the numerous number/key pairs requested, and sends them back to Bob encrypted with K_B-

<img file="WO2007120215A2_D0011.tif" />

[00157] Again, Bob could request the number/key pairs before or after receiving the encrypted, watermarked copies from Alice.

[00158] Similar to the non-watermarking embodiment, after Bob has received the number/key pairs from Trent he can create a distributable license.

N"¹_A E(KT_A ,N* _A E(K^_A1H(M)H(D_I)))

[00159] Bob repeats this procedure for however many distributable licenses he wishes to distribute or is authorized to distribute by Alice.

[00160] When Carol wishes to view content M, she sends a request for M to Bob.

[00161] C → B: Send M_id

[00162] As noted before, further encryption could be applied to Carol's request to ensure that her message is not compromised.

[00163] As before, Bob receives the request from Carol and replies by choosing one of the distributable licenses he previously generated. Bob sends the distributable license to Carol!

<img file="WO2007120215A2_D0012.tif" />

[00164] After receiving the distributable license from Bob, Carol encrypts it with her key Kc and prepends her number Nc exactly as she did in the non- watermarking embodiment and sends the encrypted distributable license to Trent.

C → T: NcE(Kc. N∞B E(K™_B JV*Λ E(K*A.H(M)H(D0))

[00165] Upon receiving the encrypted distributable license from Carol, Trent can unwrap all of the encryption, since he knows Carol's, Bob's, and Alice's secrets, and can determine that Carol received a valid license and needs the decryption key for the content M watermarked with watermark Dj. Similar to the non-watermarking embodiment, Trent generates a receipt for Bob.

T → B: N" _B E(IC_B ,JV*, E(K^{1 l}_A,H(M)H(D ,))C_id)

[00166] The receipt Bob receives from Trent not only informs Bob that Carol has been authorized as a consumer, but it also directs Bob to send the matching encrypted copy of the content specified by the hash H(M) and the hash H(Dj) to Carol.

B → C: E(K_M1,M,)

[00167] As in the non-watermarking embodiment, Trent sends the decryption key for the encrypted, watermarked copy of the movie Carol receives from Bob along with a new number/key pair Carol can use for future requests.

T → C: E(Kc .N'CK'CKM,)

[00168] As mentioned before, Trent could additionally request final authorization at this point if he knows an identifier, which is known to all entities, for the content requested. Trent can provide the identifier to Carol who can verify that the decryption key she is about to receive is for the content she requested. Once Trent receives Carol's verification he can send the needed decryption key.

[00169] Carol now has everything she needs to watch the movie M.

[00170] As before, Trent could also generate a receipt for Alice at this point, allowing her to track a consumer to a particular watermarked copy. Trent can concatenate the label of M, and the hash of the watermark H(D₁), and Carol's identity C and encrypt all the elements with Alice's key K^_A and prepend the number iV^ used in the license sent to Carol.

T →A: rf_A E(K^A. H(M)H(DJ)C₁₄)

[00171] Trent also can mark all the number/key pairs encountered during the transaction ({K?A, ^A), (K^¹B, If¹B), (Kc, Nc}) and the watermark D₁ as used so any future use of them can be recognized as fraudulent behavior. [00172] Alternatively in another watermarking embodiment, Bob, rather than Alice, applies the watermark to the content copies. Alice sends Bob a single encrypted version of the movie M and may also provide a list of watermarks to apply. Bob then coordinates with Trent to receive the decryption key for the content. After receiving the decryption key Bob decodes the encrypted content, applies watermarks to the decrypted content, and encrypts the watermarked content with another encryption key different from the first used by Alice. By allowing Bob to watermark the distributable content, less communication is needed and less data is transmitted between the content provider and the service provider. The service provider may also perform the decryption and watermarking on the fly when the request for content is made. By watermarking the content when needed, the amount of storage required by the service provider is reduced since he does not need to retain multiple encrypted, watermarked versions of content. Since Alice provides her content encrypted but unwatermarked, another entity of the protocol must be trusted to decrypt Alice's content, apply a watermark, and encrypt the watermarked content again before it is sent to consumers. Bob could be trusted to perform the decryption and watermarking, but Alice may also insist that Bob use a special piece of hardware that protects the security of her content. By requiring the decryption and watermarking to occur in hardware (which is inaccessible by the service provider) in real-time, the security of Alice's content is preserved. The content is sent to special hardware of the service provider that decodes the content, applies a watermark, and encodes the content again. The hardware prevents the service provider from accessing the decrypted content since the content enters the hardware encrypted and exits the hardware watermarked and encrypted. For the protocol to work, the content provider must trust the security of the special hardware. The authorized special hardware, or decoding entity, that will decode and watermark content provided by Alice is denoted as B ' or Brenda in the following detailed example.

[00173] As before Alice wishes to distribute her movie M and wants to track consumers to a specific copy of her movie. However, Bob does not want to receive and store multiple encrypted and watermarked copies of Alice's content. In order to reduce communication and data traffic between Alice and Bob, Bob will watermark and encrypt the content provided by Alice.

[00174] Alice begins by requesting numerous number/key pairs from Trent that she will use, in contrast to the previous two embodiments, to create a list of encrypted watermarks. After Alice receives the number/key pairs from Trent, she then requests an encryption key for the movie M. In addition, Alice may specify who should be allowed to decode the movie in order to apply a watermark in her request to Trent. In the current example Brenda will be authorized to apply watermarks. Alice may also include a known identifier for the movie M,a that can be used by Trent to validate requests before sending decryption information.

A → T: N _A E(K_Λ, H(M)M_ldB ')

[00175] Trent responds with an encryption key for the movie K_M-

T → A: E(K_A, K_M)

[00176] Once Alice receives the encryption key K_M she can encrypt the movie M and a hash of the movie H(M) and send the encrypted content to Bob.

A →B: E(KM, H(M)M)

[00177] Alice also generates a list of watermarks Dj, D₂, .... D_n to be applied to the copies of the encrypted content. Each watermark will be concatenated with a hash of the movie H(M) and possibly a known identifier for the movie Mid . Each concatenated list is encrypted with one of the number key pairs Alice received from Trent. Alice sends the list of encrypted watermarks to Bob. Alternatively, Alice could allow Bob to generate the watermarks to be applied to her content. By having Bob create the watermarks even less communication and data is transmitted between Alice and Bob.

A → B: N¹_AE(K¹_A1H(M)DiM₁₀), N²_AE(K²_A,H(M)D₂M_ld), ..., N³_AE(K³A₁H(M)D₃M₁₁,)

[00178] Bob now has a list of encrypted watermarks and the encrypted movie M that can only be decrypted by Brenda since that is what was specified by Alice in her request to Trent. In order to prepare to distribute content, Bob and Brenda request numerous number/key pairs from Trent.

[00179] Once Bob receives a request from Carol for the movie M, Bob provides Brenda with an encrypted watermark that he received from Alice encrypted with an arbitrarily chosen number/key pair from the list provided by Trent.

B →B ': N⁰_BE(K⁰_B1N¹AE(K¹AM(M)DMd)) [00180] Brenda chooses an arbitrary number/key pair from the list generated by Trent and further encrypts the doubly-encrypted watermark received from Bob. Brenda then sends the thrice-encrypted watermark to Trent.

B ' → T: N" B-E(K⁰ B-^_BE(K" ,!,N¹AE(K¹A₁HOM)DiMi₁O))

[00181] Trent decodes all of the encryption, since he knows everyone's secrets, and returns the hash of the movie H(M), the watermark Di, the key to decode the movie K_M, a new key to encode the movie K_M; and Bob's identity Bid to Brenda.

<img file="WO2007120215A2_D0013.tif" />

[00182] Brenda also encrypts the same doubly-encrypted watermark received from Bob with another arbitrarily chosen number/key pair. Brenda sends the second thrice-encrypted watermark to Carol.

B' → C: N^bB-E(K^bB;N^a_BE(K^a_B,NΑE(K^I_A,H(M)D_iM_id)))

[00183] Carol encrypts the received message with her single number/key pair and, as before, forwards the encrypted message to Trent.

C → T: Nc E(KcTf³_B-E(Id¹_B^_BE(K⁰_B1N¹_AE(K¹_A1H(M)DM_d))))

[00184] Trent unwraps all of the encryption and verifies with Carol that she did intend to get the movie identified in the message.

<img file="WO2007120215A2_D0014.tif" />

[00185] Carol responds with authorization if the content identifier Mi_d corresponds to the content she requested.

C → T: E(Kc, Authorize)

[00186] Trent then sends the decryption key K_M to Carol and generates a receipt for Bob. Bob's receipt contains the encrypted watermark Bob initially sent to Carol along with Carol's identity.

T → B: N⁰_BE(N¹_AE(K} _A1H(M)D iM_id)C_id) [00187] Trent also generates a receipt for Alice so that she can associate a watermarked copy of the movie M with Carol. Alice's receipt includes the hash of the movie H(M), the watermark applied Di, and the identity of the consumer C,y. Alice's receipt is encrypted with the number/key pair Alice used to encrypt the watermark that will be associated with the content licensed to Carol.

T →A: N¹_AE(K¹_A1HQVL)DiCi₁₁)

[00188] Upon receiving the receipt from Trent, Bob sends Brenda the encrypted movie that he received from Alice.

B →B': E(K_M1H(M)M)

[00189] Brenda decrypts the encrypted movie since she received the decryption key K_M from Trent. Brenda decodes the movie to recover the movie M, applies the watermark Di, and encrypts the watermarked movie W(Di₁M) with the new encryption key K_M •■ The hash of the movie H(M) Alice encrypted with the movie allows Brenda to check that the movie has not been switched for another and that the decryption key received from Trent is the matching key for the encrypted content. Once the movie M has been decrypted, watermarked, and encrypted, Brenda sends the encrypted, watermarked content to Carol.

B ' → C: E(K_M-, W(Di,M))

[00190] Carol has already received the decryption key from Trent, so she can decrypt the encrypted, watermarked content and view the movie M.

[00191] If Carol decides to make and distribute illegal copies of the content she received, any illegal copy found in the market that Carol distributed can be traced back to Carol by the watermark applied to the content (regardless of the particular embodiment of the invention used to apply the watermark). Both Bob and Alice receive receipts that link a particular watermark to a particular consumer. Knowing this, Carol may be deterred from distributing illegal copies of content, since the copies can be traced back to her. Carol may also keep a closer guard of her copy so that no one else takes her content and distributes it illegally. The rights of the content provider and service provider are enhanced through the use of the watermarking. [00192] Another feature that could reduce the amount of illegal copying is requiring a realtime decode of the movie or content. Depending on the hardware implementation chosen, a real-time decode may be possible that would require any recording of content downloaded via the proposed system to take the same amount of time required to watch or consume the content at its intended playback speed. The decode output could also be implemented as an analog signal that would reduce the fidelity of subsequent recordings.

[00193] Additional aspects of embodiments of the invention will now be described with respect Figs. 4-16.

[00194] Fig. 5 illustrates the overall process of the consumer 26 requesting content in one embodiment of the invention. First, the consumer 26 makes a request for a particular piece of content (step 50). The request may include an identifier or label associated with the particular piece of content that the consumer found using a search engine or catalog of available content. The label may also be a title of the content such as a movie title or song title. The service provider 24 then requests an encrypted license 52 from the content provider 22 that is associated with the desired content. The service provider sends the license 52 to the customer 26 (step 54). The customer's hardware (e.g., a set top box), encrypts the license 52 with a mutating BD (previously received from the authenticator 28) and sends the now doubly encrypted license 52 to the authenticator 28 (step 56). The authenticator 28 checks the license 52 for validity. If the license is valid, the authenticator 28 so informs the service provider (step 58). The service provider then sends the content to the consumer 26 (step 60). At the same or nearly the same time, the authenticator 28 sends decoding information to the consumer 26 (step 62).

[00195] As should be apparent from the discussion above, the license 52 undergoes multiple transformations, in the sense that the license is encrypted multiple times. Fig. 4 illustrates this process. The content provider creates the license 52 upon receiving a request for particular content. The license is an encrypted version of the randomly determined, secret identifier that the content provider created for the subject content. The now once encrypted version of the license (license 63 in Fig. 4) is sent to the service provider 24. The service provider 24 encrypts the license again (license 64 in Fig. 4) and the now doubly encrypted version is sent to the consumer 26. The doubly encrypted license is encrypted with the mutating HD of the consumer to create a thrice-encrypted version (license 65 in Fig. 4). Authentication or verification of the license and ultimately delivery and decoding of information is then performed as noted in the discussion above with respect to Fig. 5. Fig. 6 provides another illustration of the process, including the multiple encryption steps.

[00196] Fig. 7 illustrates that embodiments of the invention may include multiple service providers. Furthermore, it is envisioned that service providers may have their own content or licenses to particular content that other service providers may desire. Thus, various requests for and transfers of licenses (as shown) may occur between service providers in order to make a large variety of content available to the ultimate consumers of the various service providers participating in the system 20.

[00197] Fig. 8 illustrates how mutating IDs are implemented in one embodiment of the invention. As shown, the consumer 26 is assigned a first mutating ID 100. The consumer uses that mutating ID to confirm its identity (as shown in box 102, which corresponds to step 56 in Fig. 5). However, once the license 100 is used, the authenticator modifies the license 100 or, in other words, sends a new key pair to the consumer, as shown in box 104. The new key pair, in effect, creates a new mutating ID 106.

[00198) Figs. 9a and 9b illustrate one way of managing content keys. If desired, the system 20 may be set up or configured such that the content provider 22 provides a list of content keys to the authenticator 28. If the system 20 is implemented in this fashion, a request made by the consumer 26 for content is transferred (through one or more intermediary service providers and/or other content providers) to the content provider 22 (step 110 in Fig. 9b). The content provider then sends a license to the consumer 26 (again, through one or more intermediary service providers) (step 112). The consumer 26 then sends its content license to the authenticator for verification or authentication (step 114). If verified, verification information is sent to the content provider 22 (step 116). The authenticator 28 then sends the content key to the consumer 26, so that the content can be decoded and viewed (step 118).

[00199] Figs. 10a and 10b illustrate another way of managing keys. The overall process is similar to what was described above with respect to Figs. 9a and 9b, except that no keys are sent to the authenticator 28, but maintained with the content provider 22. [00200] Figs. 11-13 illustrate ways in which service and content providers can share content, if desired. One way of sharing content is for each content provider to hold the rights to certain content to create a license upon receiving a request for the desired content (Fig. 11). Alternatively, content providers may distribute a predetermined number of licenses to downstream providers so that they do not have to respond to each request on an individual basis and so that downstream providers can be assured of having the ability to distribute a certain number of "copies" of certain content, without having to obtain approval, which could possibly be denied, by the act of refusing to supply a license, for each individual request that the downstream provider receives from end consumers (Figs. 12 and 13).

[00201] Fig. 14 illustrates the process of generating and utilizing a license for content, where the content is watermarked. As noted above, a license for content undergoes multiple transformations, in the sense that the license is encrypted multiple times. The content provider 22 creates the license upon receiving a request for particular content or in preparation of future requests by the consumer 26. The license is an encrypted version of the randomly determined, secret identifier 130 that the content provider created for the subject content and a function of the watermark 132 applied to the copy of the content. The now once encrypted version of the license (license 134 in Fig. 14) is sent to the service provider 24. The service provider 24 encrypts the license again (license 136 in Fig. 14) and the now doubly encrypted version is sent to the consumer 26. The doubly encrypted license is encrypted with the mutating ID of the consumer to create a thrice-encrypted version (license 138 in Fig. 14). Authentication or verification of the license and ultimately delivery and decoding of information is then performed as noted in the discussion above with respect to Fig. 5 except the encrypted content and decoding information is specific to the watermarked content identified in the license. Fig. 15 provides another illustration of the process, including the multiple encryption steps.

[00202] Fig. 16 illustrates exemplary embodiments of the devices used to distribute content. The consumer 26 is illustrated as a set top device 150. The set top device 150 is coupled to a display capable of displaying content 151, and provides an interface to the set top device through a remote control 152. A user 153 uses the remote control 152 to interact with the set top device 150. The user 153 uses the remote control 152 to view a list of available content and select content to view on the display 151. The interface accessed through the use of the remote control 152 also indicates when the user 153 makes a selection of content by highlighting or flashing the name of the selected content on the display 151.

[00203] Once the user 153 has selected content, the set top device 150 generates a request for the selected content. The request is then sent to the content provider 22. The content provider 22 device is illustrated as a server that contains a processor 156, a memory module 158, and input/output module 160. The memory module 158 contains the content items of the content provider 22 and at least one mutating identifier. The memory module 158 may contain other mutating identifiers if the content provider 22 has requested numerous mutating identifiers from the authenticator 28. The memory module 158 may contain non-volatile memory such as one or more forms of ROM, one or more disk drives, RAM, other memory, or combinations of the foregoing.

[00204] The content provider 22 receives the request through the input/output module 160 and transfers the request to the processor 156. The processor 156 accesses the memory module 158 to obtain a mutating identifier that it will use to encrypt a license for the content item also stored in the memory module 158. The processor 156 encrypts the license and transfers the license to the consumer 26 through the input/output module 160.

[00205] The consumer 26 receives the encrypted license, processes the encrypted licenses (as will be explained below), and forwards the encrypted license to the authenticator 28. The authenticator is also illustrated as a server containing a processor 162, a memory module 164, and an input/output module 166. Unlike the memory module 158 of the content provider 22, the memory module 164 of the authenticator 28 does not contain content to be distributed. Again, the memory module 162 may contain non-volatile memory such as one or more forms of ROM, one or more disk drives, RAM, other memory, or combinations of the foregoing.

[00206] The processor 162 of the authenticator 28 decrypts the encrypted license received by the input/output module 166 to uncover the content requested and the entities involved in the distribution. Once the identities of the participating entities are known, the processor 162 verifies the identities and generates a receipt for the content provider 22. The processor also accesses the decryption key associated with the content specified in the license and accesses one or more new mutating identifiers from the memory module 164. The processor then directs the receipt, the one or more new mutating identifiers, and the decryption key to be sent to the respective parties by the input/output module 166. The processor 162 of the authenticator also indicates in the memory module 164 that the mutating identifiers used in the current transaction have been used and should be accepted if encountered in the future.

[00207] The consumer 26 receives the decryption key and a new mutating identifier, and the content provider 22 receives the receipt for the requested content item and a new mutating identifier if required. The content provider 22 then sends the encrypted content to the consumer 26 and can record that the consumer 26 received the content.

[00208] Once the consumer 26 receives the encrypted content from the content provider, it now has everything it needs to watch the movie. The set top device 150 can now display the movie on the connected display 151.

[00209] Fig. 17 illustrates hardware that may be used in the set top device 150. In the exemplary configuration shown, the set top device 150 includes a processor 170, a memory module 172, an input/output module 174, and a remote control module 175. The hardware may contain other modules as well.

[00210] The memory module 172 is used to hold the mutating identifier of the consumer 26 and may also be used to hold content, messages, or keys sent by the content provider 22 and/or authenticator 28. The memory module 172 may contain non- volatile memory such as one or more forms of ROM, one or more disk drives, RAM, other memory, or combinations of the foregoing.

[00211] The processor 170 is configured to generate requests, encrypt received messages, access and store data to the memory module 172, and decrypt received content. The input/output module 174 is configured to interface with the other entities of the system (i.e., the content provider 22 and authenticator 28), and the display device 151. The remote control module 175 is configured to interface with the remote control 152 used by the user 153 to initiate requests for content.

[00212] Although a processor is paired with a memory and an input/output module is illustrated for all three devices used in the distribution system, it should be apparent to one skilled in the art that hardware, software, or any combination thereof could be used to communicate and distribute content between participating entities. The processor could be an integrated circuit, a microprocessor, or any combination of hardware and software that can perform the necessary operations for distributing content.

[00213] As should be apparent, the system 20 and the protocol used to implement it can be used in a variety of applications beyond the secure distribution of content. Many different types of communications ranging from e-mail, video and multi-media conferencing, data and telemetry collection, and others may benefit from using all or part of the system 20 to enhance security and trust. Some of these additional applications are now discussed.

Confirmation of Geographic Location

[00214] As is known, innumerous human activities depend on the human participants trusting the other participants. Furthermore, participants must feel comfortable that the other participants are authentic (i.e., not imposters or frauds) and will not renege on promises or commitments made. In times when most activities took place face-to-face many concerns about authenticity were reduced. For example, before the existence of the telephone and Internet, imposters would have to physically meet and fool any person that the imposter intended to dupe. With modern communications, it is often impossible for parties to know who they are actually communicating with or where the parties are located.

[00215] Various biometric and other devices exist that can be used to address concerns of authenticity and trust and many of these can be used with or added into embodiments of the system 20 described. However, the system 20 also has inherent features that lessen concerns of authenticity. One of these is the ability to trace, at least to a relatively specific point, the location of customers ordering content.

[00216] As noted, mutating IDs are implemented in embodiments of the invention and the consumer 26 is assigned the first mutating ID 100. Subsequent mutating IDs are assigned each time the consumer desires to obtain content. Further, each customer 26 has a decoding processor or similar device (e.g., a set top box, home computer, etc.) and the customer's address and name are associated with that hardware. Each service provider and content provider also has an actual physical location and address. Because embodiments of the system 20 rely on unraveling multi-encrypted and encapsulated identifiers, the location of a consumer can, at a minimum, be traced to the service area of the service provider of the consumer. [00217] For example, if the customer or a thief moved the customer's hardware to a location outside of the service area of the service provider 24 and requested content, the unraveling of the multi-encrypted and encapsulated identifiers would fail, as the new service provider would be unable to send appropriate keys needed for decoding based on the mutating ID stored in the hardware.

Real Time Authentication of User and Real Time Play Back of Content

[00218] As noted, one difficulty with modern communications systems is ensuring the authenticity of the communicating parties. In one embodiment of the invention, the system 20 may be used to encode information such as email messages sent from one party to another. The sending party acts like the content provider/service provider and the receiving party like the customer.

[00219] One way to provide extra insurance of authenticity is to send a receiving party certain random information and require that the recipient process that information and relay it back to the sender before communication of valuable information begins. For example, randomly selected sections of text from the U.S. Constitution, the Gettysburg Address, or for that matter any text from the thousands of manuscripts from the Library of Congress may be sent to the receiving party. Before any valuable content or information is sent to the receiving party, the randomly selected text must be properly decrypted and then a duplicate of the information sent back to the recipient. If the receiving party is unable to do this, then an improper communication connection has been made or the receiving party is an imposter, who may, for example, have intercepted or hacked into the communication link of the true recipient. However, without possessing the proper mutating ID, no decryption of the random text is possible.

[00220] An additional security feature that may be added to the system 20 is real-time play back of content. As noted earlier, one of the problems for copyright and other legal rights holders, is that digital content can be copied (at least theoretically) an infinite number of times and the time needed to make each copy is very short. For example, a CD containing seventy minutes of music can be completely copied in a few minutes. Compressed files may be copied even faster. This makes large-scale illicit copying of content very attractive to a potential criminal. Once a single copy of valuable content is obtained, hundreds and possibly thousands of pristine copies can be made quickly and then sold. [00221] In embodiments of the system 20, decoding of the content at the consumer 26 or receiver is done in a real-time fashion, meaning that play back in the system 20 occurs no faster than playback of the content as intended for the final viewer or consumer. Thus, if a movie has a running time of 2 hours and twenty minutes, recording of the content sent to the consumer takes the same amount of time, thereby discouraging large scale copying of the same. It should also be noted that the system is configured to restrict the number of decryptions that occur. Generally, only one decryption can be made by the customer. This helps reduce unauthorized copying. It should also be noted that the content may include known copy protection devices or code before it is encrypted. These devices may be used to prevent or reduce unauthorized copying as well.

Data and Telemetry Collection

[00222] As noted, embodiments of the invention may be implemented where just three parties participate. The parties include an authenticator, a sending party (by analogy encompassing the roles and functions of the content provider and service provider), and receiving party (by analogy encompassing the roles and functions of the consumer). As noted, the system 20 may be configured to implement a secure email system. As should be apparent, the system 20 could also be implemented in a variety of other applications where secure communication could be useful, such as collecting data from electric and gas meters, equipment and human monitoring systems, and other data and telemetry collection applications. In general, many existing systems could be readily modified with existing processing and communications hardware to allow communications using the multi- encrypted and encapsulated identifier architecture described herein.

Electronic commerce

[00223] Mutating identifiers can also be used in electronic commerce protocols. In some embodiments, the roles of the four participants (i.e., the content provider, the service provider, the consumer, and the authenticator) can be renamed to include a vender, a buyer, a payment authenticator, and an authenticator. Mutating identifiers can be issued and managed by the authenticator to allow the vendor, the buyer, and the payment authenticator to complete a transaction. [00224] Fig. 18 illustrates an exemplary system 200 configured to perform electronic commerce. In reality, one or more networks or communication systems such as the Internet, the telephone system, wireless networks, satellite networks, cable TV networks, and various other private and public networks could be used in various combinations to provide the communication links desired or needed to create embodiments or implementations of the invention, as would be apparent to one of ordinary skill in the art. Thus, the invention is not limited to any specific network or combinations of networks. However, it is preferred that the networks or communication system used have the ability to support secure communications such as communications with data encrypted with a version of Rijndael encryption, secured socket layer ("SSL") communications, or others. Furthermore, data can be transferred from one party to another with wire, digital satellite service ("DSS"), or physical media being physically carried from one party to another.

[00225] In the embodiment shown in Fig. 18, the system 200 includes four participants: a vendor 220; a payment authenticator 240, such as a credit card company, a financial institution, or the like; a buyer 260; and an authenticator 280. Although, only one vendor 220, payment authenticator 240, and buyer 260 are shown, in most implementations numerous vendors, payment authenticators, and buyers will be involved. Further, there could be multiple authenticators 280, although only one is required. In practice, it is likely that the following relationship will exist: number of authenticators &lt; number of payment authenticators &lt; number of vendors &lt; number of buyers, but again there is no limit on the number of participants or any requirement of a particular relationship between the numbers of the various types of participants.

[00226] In some embodiments, the vendor 220, the payment authenticator 240, and the buyer 260 are connected to the authenticator 280 via two-way links 300, 320, and 340. The vendor 220 and the buyer 260 are also connected via a two-way link 360. These links may be constructed from all or part of the networks mentioned above. In some embodiments, the link 360 includes a non-secure hypertext transport protocol ("HTTP") link.

[00227] The vendor 220 is an entity, such as a retail company, that wishes to sell its goods and/or services electronically. It is assumed that the vendor 220 wants to be reimbursed fairly for goods and/or services, both referred to as goods hereafter, exchanged using the system 20. Thus, in one embodiment of the invention, the system 200 is configured such that the vendor 220 can produce a bill of sale for goods sold. The bill of sale can include a transaction identifier. In some embodiments, the transaction identifier includes a vendor identifier.

[00228] Buyers and vendors agree on a bill of sale and a price. The buyer 260 can authorize the financing of a transaction for items listed in the bill of sale at the agreed upon price from an account. Buyers, vendors, and payment authenticators can receive an unforgeable receipt of the transaction as described above. It is assumed that at least some buyers may wish or attempt to purchase goods electronically without paying for them or with funds from an account that the buyer is not authorized to manage. It is also assumed that the buyer requires a secure transaction where payment information cannot be compromised. Therefore, measures are provided to prevent unauthorized purchasing of goods and to provide a secure transaction. Mutating EDs provide a mechanism by which purchasing is controlled.

[00229] The payment authenticator 240 is an entity, such as a credit card company or financial institution, which holds accounts that can be used to finance transactions (in terms of money or other payment forms or mechanisms). It is assumed that the payment authenticator 240 can agree to finance an electronic transaction from an account and, therefore, account identifiers are kept confidential. Thus, in some embodiments of the invention, the system 200 is configured such that the buyer 260 and the payment authenticator 240 agree on a secret account identifier for an account of the buyer 260. Further, authorizations for payment of a transaction from an account are encrypted with a mutating ID.

[00230] The authenticator 280 is the repository that holds the data necessary to perform secure electronic transactions. In the embodiments discussed, the authenticator 280 verifies the vendor 220, the payment authenticator 240, and the buyer 260 by their mutating IDs before allowing an e-commerce transaction to take place. The authenticator 280 can verify the receipts of the buyer, the vendor, and the payment authenticator. The authenticator 280 can also perform the above actions without knowing the buyer's account information or the details of the transactions. The authenticator 280 is also the source of mutating IDs and keeps track of such IDs using a database or similar mechanism.

[00231] Exemplary embodiments of the invention will now be described using several examples. [00232] As with many descriptions of communication protocols, names are assigned to the various entities (or computer systems associated with those entities) used in the protocol. In one embodiment, Bob (B), Vera (V), and Carol (C) represent various participants in a protocol, and Trent (T) represents a trusted arbiter of communication. The following table, Table 2, is a list of other symbols used in this document to explain multiple embodiments of the protocol.

Table 2

<img file="WO2007120215A2_D0015.tif" />

[00233] An exemplary embodiment of the protocol involves the four participants discussed above. The entity Bob ("B") performs the role of the buyer 260, the entity Vera ("V") performs the role of the vendor 220, the entity Carol ("C") performs the role of the payment authenticator 240, and the entity Trent ("J¹¹') performs the role of the authenticator 280. The protocol involves Bob purchasing goods from Vera. Bob purchases or pays for the goods using an account held by Carol. Trent arbitrates communication between Bob, Vera, and Carol. Since the proposed protocol relies on a trusted authority, Bob, Vera, and Carol trust Trent. Further, all assigned number and keys are assigned and known by Trent. It is assumed that Bob, Vera, and Carol already hold secret number/key pairs (NBJCB), (NyJCy), and (NcJCc), respectively, issued from Trent.

[00234] For the purposes of this example only, assume Bob wishes to purchase goods from Vera. Bob and Vera agree on a bill of sale (S). Bob wishes to pay with funds drawn from an account held with Carol. The account is identified by credentials (B_cred)- Th^e credentials (B_cred) are a secret known or recognizable only to Bob, Carol, and Trent. In some embodiments, the credentials (B_cred) represent Bob's account number. In other embodiments, the credentials (B_Cre_d) are assigned by Trent. Trent does not have to "know" credentials a priori or before hand for the protocol to work. In some embodiments, Trent only forwards credentials to Carol. Furthermore, in some embodiments, Trent cannot obtain the data (such as an account number) included in credentials. This helps increase security of the protocol.

[00235] Since the credentials (B_crei) are known only to Bob, Trent, and Carol, Trent and Carol can use the credentials (B_cred) to verify that Bob created a particular message. Carol may also use the credentials (B_cred) to verify Bob's account number. In some embodiments, the credentials (B_cred) are constructed from a secret known only to Bob and Carol (such as Bob's account number). The credentials (B_creJ) can also be constructed from details regarding the current transaction. In some embodiments, the credentials (B_cred) are determined as follows:

B_cred = E(H(X), H(S)P)

[00236] In the above equation, x is a secret known only to Bob and Carol (such as Bob's account number), S is the bill of sale, and P is the agreed upon price for the goods included in the bill of sale. In some embodiments, Bob constructs his credentials (B_cred) from plaintext versions of the bill of sale and/or the price rather than as a hash. Using a hash, however, provides an abstraction of the details of the transaction. It should be understood that additional formulas or mechanisms can be used to determine credentials.

[00237] Since Bob and Carol know x (and the hash function if applicable), Bob and Carol can decrypt the credentials (B_cred) and obtain the secure information regarding Bob's account. In some embodiments, Trent and Vera cannot obtain the secure information regarding Bob's account or the details of the transaction, such as the price. [00238] Bob can generate credentials (B_crea) for each transaction, and Carol (who knows Bob's account number and can generate H(x)) can decrypt the credentials (B_cred) to obtain the bill of sale and the corresponding price. In some embodiments, if Carol holds multiple accounts for Bob each having account numbers xj, X₂,..., x_n, Carol generates a hash for each account number. If one of the hashes can decrypt the credentials (B_cre(j), Carol knows which account to draw funds from. Bob can also prepend an account identifier to the credentials (βcred) to identify a particular account.

[00239] In some embodiments, creating a hash of an account can create hash collisions where H(xι) = H(x_j) and JC,- does not equal xj. Hash collisions can be detected at account creation and a colliding account number can be regenerated in order to prevent a hash collision.

[00240] As shown in Fig. 19, to begin the purchase process, Vera sends Bob signed vendor transaction data, hi some embodiments, the vendor transaction data includes a bill of sale (S) and/or a corresponding total price (P) for the bill of sale (S). In addition to or in place of the plaintext bill of sale (S) and corresponding price (P), the vendor transaction data can include a hash of the bill of sale (S) and/or the price (P). In some embodiments, the vendor transaction data also includes credentials of Vera (V_cred)- Vera's credentials (V_cred) are a secret known or recognizable only to Vera, Carol, and Trent. In some embodiments, as described above, Vera's credentials (V_cred) can be constructed from a secret known only to Vera and Carol, such as an account number of Vera. In other embodiments, Trent can assign credentials (V_cred) to Vera. Carol and Trent can use Vera's credentials (V_cred) to verify that the vendor transaction data was generated by Vera. The vendor transaction data can also include an identifier of a buyer (e.g., Bob) and/or a payment authenticator (e.g., Carol) associated with the transaction. Vera "signs" the vendor transaction data by encrypting the data with her secret key (Kv) and prepending her secret number (Nv). Vera sends the signed vendor transaction data to Bob.

V → T: SN_vE(Kv,H(S)P)

[00241] Upon receiving the signed data from Vera, Bob provides signed buyer transaction data as Vera did. The buyer transaction data includes a bill of sale, which, when Bob acts correctly and honestly, is identical or equal to the bill of sale signed by Vera. Bob can also include his credentials (B_cred) and identities of the participants of the transaction beside himself (i.e., Vera and Carol) in the buyer transaction data. Bob signs the buyer transaction data by encrypting the data with his secret key (K_B) and prepending his secret number (N_B). Bob concatenates the signed buyer transaction data to Vera's signed vendor transaction data and sends the concatenated message to Trent.

B → T: N_BE(K_B,H(S)P) B_credV_idC_idN_vE(K_v,H(S)P)

[00242] It should be understood that Bob can also initiate the purchase process. In some embodiments, Bob sends Vera signed buyer transaction data including the identities of Vera and Carol. Vera adds signed vendor transaction data to the signed data provided from Bob and forwards the concatenated message to Trent.

[00243] Trent can unroll the concatenated message (since he knows the secret keys of Bob and Vera). In some embodiments, Trent verifies that the buyer transaction data, or a portion thereof, (e.g., the bill of sale, the price, and/or the hashes of the bill of sale and/or price) transmitted from Bob matches the vendor transaction data, or a portion thereof, transmitted from Vera. If the data does not match, it is possible that Vera and Bob have not agreed on a common bill of sale and/or a related price, and Trent can inform Bob and Vera of the discrepancy.

[00244] If the data matches, Trent generates a payment request. In some embodiments, the payment request is transmitted to Carol in order to request payment of a transaction between Bob and Vera. The payment request can include receipts for Vera, Bob, and Carol. Each receipt can include keys of two of the three participants (i.e., the keys of the participants to whom the receipt is not for), the bill of sale, and the price. In some embodiments, each receipt also includes credentials of the recipient and/or the other participants. The recipient can use the credentials to verify that the receipt was generated by Trent. It should be understood that a hash of the keys, the bill of sale, the price, and/or the credentials can be included in place of plaintext data in order to further increase the security and secrecy of the transaction. When hashes are provided, Trent can obtain the hashes but cannot decipher the details of the transaction. Exemplary receipts for Vera, Bob, and Carol may be configured as follows:

Rv = E(K_V1H(K_BK_CP)H(S)P)

51 R_B = E(K_B,H(K_VK_CP)H(S)P)

Rc = E(K_CH(KBK_VP)H(S)P)

[00245] The payment request can also include new number/key pairs for Vera, Bob, and Carol.

<img file="WO2007120215A2_D0016.tif" />

M_B = E(K_B,N'_BK'_B)

Mc = E(K₀N' cK'c)

[00246] The payment request can further include messages for Carol to send to Bob and Vera. In some embodiments, Trent generates one "accepted" message and one "declined" message. Carol sends the "approved" message, or a portion thereof, to Bob and Vera if she honors the request for payment of the transaction, and Carol sends the "declined" message, or a portion thereof, to Bob and Vera if she does not honor the request for payment.

Mapprove_d = E(Kv, "Approved ")E(Kβ, "Approved")

M_dectined = E(K_K "Declined ")E(K_V. "Declined")

[00247] It should be understood that the payment request Trent generates can include more or fewer messages. For example, Trent can generate a message that includes both the receipt and the new number/key pair for each participant. Trent can also generate separate "approved" and "declined" messages from Bob and Vera.

[00248] Trent also decodes Bob's credentials (B_creci) and the price of bill of sale (P). In some embodiments, Trent cannot decode Bob's credentials (βcre_d) and, therefore, cannot obtain confidential information regarding Bob's account held with Carol. For that reason, although Trent obtains Bob's credentials (B_cred), Trent cannot obtain Bob's account information.

[00249] The payment request can also include a credential message that includes Bob's credentials (B_creJ) and the price (P). Trent can re-encrypt the credential message with Carol's secret key (Kc) in order to prevent anyone but Carol from obtaining the data contained in the credential message. Trent can also prepend Carol's secret number (JVc) to the credential message.

M_cred = E(K_c,B_credP)

[00250] The payment request can also include the identities of the transaction participants (other than Carol).

[00251] Trent sends the payment request to Carol. In some embodiments, Trent can also send Carol the messages and receipts included in the payment request individually. Li some embodiments, Trent encrypts the payment request (or the individual messages and/or receipts) with Carol's secret key (Kc)- Trent can also prepend Carol's secret number (Nc) in order to instruct Carol on how to decode the payment request.

T → C: NcE(Kc, B_idV_id (RCRBRV) WcM_BM_v)(M_acceptM_{declin e}) (M_creι0)

[00252] Carol receives the payment request and determines whether to approve payment for the bill of sale. In some embodiments, Carol determines whether or not to approve payment by determining if Bob's account (identified by B_cred) contains enough funds to cover the price (P) of the bill of sale. If Bob's account contains enough funds to cover the price, Carol transfers funds from Bob's account to an account of Vera, hi some embodiments, Carol can act as an escrow and can hold funds from Bob's account until Vera notifies Carol that goods included in the bill of sale have been shipped and/or provided to Bob. Once the goods have been provided to Bob, Carol can transfer the funds from Bob's account to an account of Vera. Upon approving payment, Carol can send responses to both Bob and Vera including a receipt, a new number/key pair, and an approval message.

C → B: E(K_B, "Approved") M_BR_B

C → V: E(K_V, "Approved") M_VR_V

[00253] Bob, Vera, add Carol can present Trent with the number they used in this transaction (NB, Ny, or Nc), the price, and their receipt for transaction verification. For example, Trent can verify that the receipts are identical. [00254] If Bob's account does not contain enough funds to cover the price, Carol does not transfer funds from Bob's account to Vera's account. Carol does, however, send responses to both Bob and Vera that includes a new number/key pair and a declined message. Carol can also send Bob and Vera a receipt indicating the declined transaction.

C →B: E(K_B, "Declined") M₈ RB

C → V: E(Kv, "Declined") M_VR_V

[00255] Fig. 19 schematically illustrates another exemplary communication protocol. The exemplary protocol involves Bob purchasing goods listed on a bill of sale (S) from Vera using an account held by Carol. Again, Trent arbitrates communication between Bob, Vera, and Carol. And, since the proposed protocol relies on a trusted authority, Bob, Vera, and Carol trust Trent. Further, all assigned number and keys are assigned and known by Trent.

[00256] For the purposes of this example only, assume Bob wishes to purchase goods from Vera. In contrast to the previous example, in order for Vera and Bob to exchange goods, Trent first establishes secure communication between Bob and Vera.

[00257] Bob sends Trent a request for a transaction key. The request can include the identity of a vendor that Bob wishes to communicate with. In some embodiments, Bob encrypts his request with his secret key (K_B) and prepends his secret number (N_B)-

[00258] To further ensure security, Bob can include additional request-identifying data X in the request. In some embodiments, the data X includes random or psuedorandom data. For example, the data X can include secret credentials of Bob known only to Bob and Trent. The data X can be used to authenticate Trent. Since the request is encrypted with Bob's secret key, only Bob and Trent can decode the message. Trent can prove he is the authenticator by decoding Bob's request and including the data X in his response to Bob. Therefore, Trent proves that he has decoded Bob's request.

[00259] The data X can also be used to associate a response from Trent with a specific request. Trent can also pass the dataXto the vendor Bob identifies in his request.

<img file="WO2007120215A2_D0017.tif" /> [00260] In some embodiments, Bob can send the request for a transaction key to the vendor that Trent wishes to communicate with (e.g., Vera), and the vendor can concatenate its own request for a transaction key. The request generated by the vendor can include the identity of the buyer that sent the original request for a transaction key to the vendor. The request generated by the vendor can also include request-identifying data Y, which can include random or psuedorandom data. For example, the data Y can include secret credentials of the vendor known only to the vendor and Trent. The vendor can encrypt its request for a transaction key with its secret key (Ky) and can prepend its secret number (Ny). The vendor can then send the concatenated requests for a transaction key to Trent. Trent can use the concatenated request to verify that each party agrees to establishing a transaction key.

[00261] Trent decrypts the request for a transaction key from Bob and generates a secret transaction key Key that Bob and Vera can use to communicate and negotiate a transaction. Trent can also generate new number/key pairs for Bob and Vera. Trent encrypts the key and the new number/key pairs with Bob's key and Vera's key, respectively, to create two messages. The messages can include the secret data (e.g., credentials) provided by the recipient of the message in the recipient's request for a transaction key. As described above, a recipient can use the secret data to verify that Trent generated the message. Trent sends one message to Bob and one message to Vera. Trent can also send the concatenation of the messages to either Vera or Bob. In some embodiments, a first part of the concatenated message (NyE(Ky,BidKByXN'yK'y)) can includes Vera's information, and a second part of the concatenated message (E(K_B, K_BVN'_BK'_B)) includes Bob's information. Whoever receives the concatenated messages (i.e., either Vera or Bob) can take their encrypted message from the concatenated message and can pass the remaining concatenated message to the other participant.

T → V: N_vE(Ky,B_idK_ByXN'yK'y)E(K_B, K_BVN'_BK'B)

[00262] For example, Vera can receive the message and can decrypt the first part of the message. Vera, however, cannot decrypt the second part of the message since it is encrypted with Bob's secret key K_B. Upon decrypting the first part of the message, Vera can recover the secret transaction key KBV generated by Trent for Vera and Bob to communicate. Vera forwards the second part of the message to Bob. As noted above, in some embodiments, if Trent includes the data X in the first part of the message, Vera can also forward Bob the data X encrypted with the secret key K_BV-

V →B: E(KB, K_BVN'BK'B)E(KBV,X)

[00263] After Bob and Vera receive their respective messages from Trent and/or each other, Bob and Vera share a secret key (KB_V) that they can use to negotiate a transaction. As shown in Fig. 19, Bob and Vera can use the secret key (K_BV) to negotiate a transaction and exchange buyer information and vendor information. The buyer information can include shipping information provided by the buyer. Once Bob and Vera agree upon the transaction, Bob and Vera are ready to negotiate payment.

[00264] It is assumed that all transactions associated with an account require the buyer to identify him or herself to the exclusion of others. In traditional commerce, this involves using a card with a particular account number and a signature. In e-commerce, the account number and other data (like a billing address zip code) are used to identify the buyer.

[00265] In some embodiments, the buyer (Bob) is identified with the transaction simultaneously. Instead of using a static account number to identify the buyer, elements of the buyer and the transaction are combined to generate buyer credentials. In some embodiments, elements of the buyer known only to the buyer and a payment authenticator holding the account of the buyer (e.g., X_B andys), elements of the vendor (V_ici), the bill of sale (5), and the agreed upon price (P) are combined to generate credentials of the buyer (B_cred). The buyer can compute the credentials at the time of the purchase.

[00266] Let X_B and ys be parts of an account number of Bob. At the point of sale, Bob can generate his credentials as follows:

B_cred = E(x_B,y_BV_idH(SP)P)

[00267] Only individuals with the knowledge of X_B can decode this message. In some embodiments, since only Bob and Carol know X_B (and&gt;&gt;a), this message can be safely passed to Trent since he cannot decode the message and, therefore, he cannot obtain the account information. [00268] In some embodiments, to ensure that Bob does not cheat on the price, Vera generates similar credentials. Carol can use Vera's credentials to verify that Bob and Vera agree on the bill of sale (S) and the price (P).

Vcred = E(x_v,yvB_tdH(SP)P)

[00269] It should be understood that Bob and Vera can construct their credentials using other mechanisms, such as the mechanism described in the previous embodiment of the e- commerce protocol.

[00270] To begin the purchase protocol, Vera sends Bob signed vendor transaction data. The vendor transaction data can include a hash of the bill of sale and the price (H(SP)) and Vera's credentials (V_cred). By including the price in the hash rather than as plaintext, Trent is unaware of the bill or sale and the corresponding price. Vera encrypts the data with her secret key (UTV) and prepends the encrypted data with her secret number (N' ».

V→B: N'_vE(K'v, H(SP)V_cred)

[00271] Bob concatenates this message with signed buyer transaction data. The buyer transaction data can include Bob's credentials (B_cred) and another hash of the bill of sale and the price (H(SP)). The buyer transaction data can also include Carol's identity (Qd). To provide his signature, Bob's encrypts the buyer transaction data with his secret key (K'_B) and prepends his secret number (N '_#). Bob sends the concatenated vendor and buyer transaction data to Trent.

B → T: N'_BE(K^&gt;_B, C_idH(SP)B_credN'vE(K^&gt;_v,H(SP)V_cred))

[00272] It should be understood that Bob can also initiate the purchase process. In some embodiments, Bob's sends signed buyer transaction data to Vera. Vera can concatenate signed vendor transaction data to the received data and can forward the concatenated data to Trent.

[00273] In some embodiments, as part of restrictions on Trent to ensure security, Trent cannot know the details of the transaction. However, he can identify the transaction data in order to verify receipts. Trent can use the transaction data to determine if Bob and Vera have agreed on a price and a bill of sale for a transaction. By creating a hash of the bill of sale and price, Trent receives the transaction data but cannot determine the details of the bill of sale and/or the related price.

[00274] Upon receipt of the message including the vendor and buyer transaction data, Trent decodes the data and recovers the buyer transaction data and the vendor transaction data. In some embodiments, Trent verifies that Bob and Vera have agreed on a bill of sale and price. If the bill of sale and/or price were provided as a hash, Trent determines whether the hash provided by Vera matches the hash provided by Bob.

[00275] In some embodiments, Trent cannot decode Bob's credentials (B_cre_d) because Trent does not know Bob's account number (X_B and ys). Similarly, Trent cannot derive Vera' s credentials (V_cred).

[00276] After decoding the transaction data, Trent generates a payment request. Trent can transmit the payment request to Carol in order to request payment for the transaction between Bob and Vera. The payment request can include receipts for Bob, Vera, and Carol. Each receipt can provide a signed version of transaction data. In some embodiments, the receipt includes a hash of the bill of sale and the price. Each participant receipt is encrypted by the two number/key pairs of the other two participants. For example, Carol's receipt for the transaction can be as follows:

Rc = N'_BE(K-_B,N'_VE(K'_V, BaVuH(SP)))

[00277] Since the receipt requires the secret keys of both Bob and Vera, only Trent can construct this value. In this sense, the receipt is perceivably uήforgeable.

[00278] Similarly, Trent can create receipts for Bob and Vera.

RB = N_CE(K_C.N'_VE(K:'_V. C_idV_idH(SP)))

Rv = N¹BE(K-_B1NcE(Kc, B_idC_idH(SP)))

[00279] . The payment request can also include the identities and credentials of Bob and Vera, transaction data, Carol's receipt, a new number/key pair for Carol, and/or a hash of the bill of sale and/or the price. Trent can encrypt the payment request with Carol's current secret key (Kc) in order to prevent anyone but Carol from obtaining the data contained in the request. Trent can also prepend Carol's secret number (Nc) to the request. In some embodiments, Carol has secret number/key pairs issued by multiple authenticators, and Trent can prepend Carol's secret number in order to identify the secret key Carol should use to decode the request.

Mc = NcE(Kc,B_idB_credV_idV_credH(SP)R_cN'cK'c)

[00280] In some embodiments, the payment request further includes messages for Carol to send to Bob and Vera. In some embodiments, Trent generates two messages for Bob and two messages for Vera. Each pair of messages includes an "accepted" message and a "declined" message. Carol sends the "accepted" messages to Bob and Vera if she honors the request for payment of the transaction. Carol sends the "declined" messages to Bob and Vera if she does not honor the request for payment. The "accepted" messages include the receipts for Bob and Vera so that if the request for payment is honored, Bob and Vera receive receipts of the transaction. Both the "accepted" and the "declined" messages can also include new number/key pairs for both Bob and Vera. Separate messages can also be generated and sent, including the new number/key pairs and/or the receipts, such as those below.

M_B = E(K'B, "Approved"RBN"BK"_B)

M'B = E(K¹B, "Declined"RBN"BK"_B)

My = E(K'v, "Ap_Proved"R_yN"_vK"_v)

M'v = E(K'_V, "Declined"R_vN"_rK"_v)

[00281] Trent sends the payment request to Carol.

T → C: M_CM_BM'_BM_VM'V

[00282] Once Carol receives the request, she can retrieve Bob's and Vera's credentials (JScred and FOred)- Carol can decrypt both of the credentials since she knows the account numbers of Bob and Vera. Carol can also verify that both Bob and Vera agree on the bill of sale and the price. Further, Carol can determine whether to honor the request for payment. If Carol honors the request for payment, she sends responses to Bob and Vera that each include an "approved" message.

C →B: M_B C → V: My

[00283] Conversely, if Carol does not honor the request for payment, Carol sends responses to Bob and Vera that each include a "declined" message.

C → B: M'_B

C → V: M' v

[00284] In Carol honors the request for payment, Carol also transfers funds between Bob's account and an account of Vera as indicated by the price P. In some embodiments, Carol can act as an escrow and can hold funds from Bob's account until Vera notifies Carol that goods included in the bill of sale have been shipped and/or provided to Bob.

[00285] The above protocol describes a secure e-commerce protocol involving a small number of communications and connections. However, in some situations application of the protocol is inappropriate or inefficient. For example, in the above protocol, Vera sends her account information through both Bob and Trent before it reaches Carol. While this is perfectly safe, it may be preferred to avoid distributing account information even in a secure, encrypted form.

[00286] The above protocol can be modified so that both Bob and Vera communicate sensitive account information directly to Carol. Fig. 20 illustrates another embodiment of the system 200 that includes the buyer 260, the vendor 220, the payment authenticator 240, and the authenticator 280. In comparison to Fig. 18, the system 200 shown in Fig. 20 connects each participant to every other participant of the system 200. The vendor 220, the payment authenticator 240, and the buyer 260 are each connected to the authenticator 280 via the two- way links 300, 380, and 360. The buyer 260 is also connected to the vender 220 and the payment authenticator 240 via two-way links 360 and 380. Furthermore, the vendor 220 is connected to the payment authenticator 240 via a two-way link 400. These links may be a constructed from all or part of the networks mentioned above.

[00287] Fig. 21 illustrates a communication protocol used in the system shown in Fig. 20. After Bob and Vera agree on a bill of sale and a method of payment, they each communicate directly with Carol rather than indirectly through Trent. In some embodiments, this can be accomplished by establishing secret transaction keys between Carol and Bob and between Carol and Vera. For example, Bob. sends Trent a request for a transaction key (K_BC) that allows him to directly communicate with Carol. Vera can also request a transaction key (Key) from Trent so that she can also directly communicate with Carol. After the transaction keys (K_BC and Key) are established, the credentials of Vera and Bob can be directly sent to Carol.

[00288] Since the credentials can be provided directly to Carol, the above protocols can be modified so that account data is not sent indirectly through Trent. Once Vera and Bob agree on the bill of sale (S) and the price (P), Vera signs the vendor transaction data and sends the signed data to Bob. In some embodiments, the vendor transaction data includes the hash of the bill of sale and the price (H(SP)).

V →B: W_VE(K' v,H(SP))

[00289] In contrast to the above protocol, rather than including her credentials in the vendor transaction data, Vera sends her credentials directly to Carol encrypted with the secret key (Key) issued by Trent.

V → C: E(K_Cv, V_cred)

[00290] Upon receiving the signed vendor transaction data from Vera, Bob concatenates the signed vendor data received from Vera with buyer transaction data signed with his secret key/number pair. In some embodiments, the buyer transaction data includes a hash of the bill of sale and the price. The buyer transaction data can also include Carol's identity. Bob sends the concatenated buyer and vendor transaction data to Trent.

B → T: N¹_BE(K¹_B1QdH(SP)NWE(K¹_V1H(SP)))

[00291] Also, since Bob can securely and directly communicate with Carol, Bob sends Carol his credentials (which can include the details of the transaction). Bob encrypts his credentials with the secret key he shares with Carol (K_BC)-

B → C: E(K_BC,B_cred)

61 [00292] Trent receives the concatenated transaction data and creates a payment request for Carol. The payment request can include the same information as described in the above protocol except for the credentials of Bob and the credentials of Vera.

[00293] After receiving the payment request from Trent and the credentials from Bob and Vera, Carol has the same information as she received in the previous protocol, but has received the information through different channels or connections. Even if someone illegally obtains and resends one of the messages provided to Carol, Carol must receive and verify messages from each participant before she approves payment. Furthermore, the payment request from Trent includes a mutating identifier so that Carol will be unable to decode an illegally re-sent message from Trent since the mutating identifier has mutated or changed since its previous use.

[00294] Carol now decides whether to honor the request for payment for the transaction. If Carol honors the request for payment, Carol sends responses to Bob and Vera that include an "approved" message. If Carol does not honor the request for payment, Carol sends responses to Bob and Vera that include a "declined" message. In some embodiments, Carol encrypts the responses to Bob and Vera with the secret keys issued by Trent to further secure the transaction. For example, if Carol honors the request for payment, she sends the following responses:

C → B: E(K_BCMB)

C → V: E(KcvMv)

[00295] If Carols honors the request, Carol also transfers funds from Bob's account to an account of Vera. In some embodiments, however, Carol acts as an escrow and waits until she receives notification from Vera and/or Bob that the goods included in the transaction are shipped and/or provided to Bob before transferring funds from Bob's account to Vera's account.

[00296] On the other hand, if Carol does not honor the request for payment, she sends the following encrypted responses:

C → B: E(K_BC,M'B) C → V: E(Kcv,M'v)

[00297] As should be understood, the above protocols can be used to perform secure commerce, both electronic commerce and non-electronic commerce. Furthermore, it should be understood that the roles of authenticator and payment authenticator can also be combined. For example, each payment authenticator can provide their own mutating identifiers to their clients (individuals for whom they hold accounts for).

[00298] It should also be understood that the above protocols (or portions thereof) can be combined. For example, electronic commerce transactions can be included in digital content purchases from a content provider or a service provider. Additionally, electronic commerce transactions can be watermarked to guarantee uniqueness in transaction data and corresponding receipts. Additional combinations and configurations are also possible.

[00299] To ensure the best possible security of transmitted data, the secret keys of mutating IDs (e.g., K_B, K_C, and Ky) need to remain secret. For example, if Trent provides Bob with a new mutating ID encrypted with Bob's current secret key (e.g., K_B), an eavesdropper who has determined Bob's current secret key can obtain Bob's new mutating ID provided by Trent. The eavesdropper can then use new mutating ID to send false data and/or obtain the plaintext of future data exchanged between Bob and Trent.

[00300] Theoretically, it is possible (although as noted in earlier parts of this document, highly improbable) that one or more eavesdroppers could determine (or attempt to determine) a key used to encrypt particular data by performing a brute force attack. As shown in Fig. 22, a brute force attack includes decrypting ciphertext with every possible key until a key is found that produces coherent or recognizable data (e.g., human readable data). As shown in Fig. 22, an eavesdropper determines an initial or zero candidate key (step 400). The eavesdropper then uses the candidate key to decrypt ciphertext (step 402). After decrypting the ciphertext, the eavesdropper can inspect the result (i.e., the candidate plaintext) to determine if the ciphertext decrypted with the candidate key produces coherent plaintext or a coherent pattern (step 404). If the eavesdropper obtains or knows the plaintext (or a portion or pattern thereof) corresponding to obtained ciphertext, the eavesdropper can more easily determine whether a correct candidate key has been found. For example, if the eavesdropper obtains ciphertext and knows that the ciphertext includes an individual's name followed by a 4-digit personal identification number ("PIN"), the eavesdropper can apply candidate keys until a candidate key produces the plaintext including the individual's name. The eavesdropper can then assume, with some certainty, that remaining information included in the generated plaintext corresponds to the PIN.

[00301] As shown in Fig. 22, if the eavesdropper finds a coherent pattern in candidate plaintext generated by decrypting ciphertext with a particular candidate key (step 406), the eavesdropper knows, with some certainty, that the current candidate key equals or is the key used to generate the ciphertext (step 407).

[00302] If the eavesdropper does not find a coherent pattern in the candidate plaintext generated by decrypting ciphertext with a particular candidate key (step 406), the eavesdropper can modify the candidate key (e.g., increment the candidate key) (step 408), and can use the modified candidate key to decrypt the ciphertext (step 402) and inspect the generated candidate plaintext for coherent plaintext or a coherent pattern (step 404). Given enough processing power and time, the eavesdropper can continue this process until a particular candidate key generates candidate plaintext with coherent plaintext or a coherent pattern and, therefore, determine the key used to generate the ciphertext.

[00303] However, if the eavesdropper has no knowledge of the plaintext or a pattern of the plaintext (i.e., has no content hint), the eavesdropper's ability to determine whether a correct candidate key has been found is greatly reduced and, perhaps, eliminated. For example, if plaintext includes a random number encrypted with a particular key, no matter how many keys the eavesdropper attempts in a brute force attack, the eavesdropper will have no way to determine whether candidate plaintext is the true plaintext corresponding to the ciphertext. Decrypting an encrypted random number with any candidate key will produce a random number that is equally likely to be the original random number as every other random number produced by every other candidate key.

[00304] Referring to the transaction key exchange example described above involving Bob, Vera, and Trent, if any portion of an encrypted message are recognizable, known, become known, or include any content hints, an eavesdropper could possibly perform a plaintext or partial-plaintext attack on the encrypted message and uncover a secret key of Bob or Vera used to encrypt the message. For example, assume that Bob sends the following message to Trent that is intercepted by an eavesdropper. B → T: NB E(KB, V_idX)

[00305] The eavesdropper can perform a brute force attack on the intercepted message because Vera's identifier Va and the format of the above message are known or public. Thus, the eavesdropper can obtain Bob's secret key K_B and the data X. Furthermore, once the eavesdropper obtains Bob's current secret key K_B, the eavesdropper can use Bob's current secret key K_B to obtain all data encrypted with Bob's current secret key KB, such as his next mutating ID (e.g., N_B ' and K_B 0-

[00306] An eavesdropper can use other knowledge about an encrypted message or the communication protocol used to generate an encrypted message to perform brute force attacks. For example, an eavesdropper can use the mutating ED number (e.g., N_B), which is passed in the clear, to perform a brute force attack. An eavesdropper could also use knowledge of the algorithm used to generate the mutating ID numbers to perform a brute force attack.

[00307] As pointed out above, keys used to encrypt undiscoverable data (i.e., data that is random or has no content hints) cannot be determined or discovered using a brute force attack, since an eavesdropper will be unable to determine when a correct candidate key is found. Keys used to encrypt discoverable data (i.e., data that is known, may be later disclosed, is recognizable, or has a known or easily guessed format), however, can (theoretically) be determined using a brute force attack. When the discoverable data and the undiscoverable data are encrypted together or with the same encryption key, the key determined through a brute force attack using the discoverable data is also the key used to encrypt the undiscoverable data and, therefore, the undiscoverable data can be discovered.

[00308] To increase the security of encrypted data and to prevent eavesdroppers from obtaining encryption keys using brute force attacks, embodiments of the invention provide an encryption strategy that protects the security of undiscoverable data, such as the secret keys included in mutating IDs.

[00309] Fig. 23 illustrates types of data that can be included in data that is to be encrypted. Data 420 that is to be encrypted and transmitted to a particular receiver is separated into types or classes of data. A first class of data includes an undiscoverable or secret data class 430. The secret data class 430 can include data that is kept secret and only known by authorized entities. For example, the secret data class 430 can include the secret keys of the mutating IDs and/or the credentials of the entities, which may be both random and known only by an authenticator and/or a payment authenticator and the holder of the credentials and the secret keys.

[00310] A second class of data includes a discoverable data class 440. The discoverable data class 440 can include data that is known, may later be known, is recognizable (e.g., human-readable), or has a known or easily guessed format. In some embodiments, the discoverable data class 440 is further divided into a number of subclasses. For example, the discoverable data class 440 can include a first discoverable data subclass 442 that includes discoverable data of a first type. Discoverable data of a first type can include data that has easily distinguished characteristics, such as standardized headers, known patterns, or other publicly available formats. In some embodiments, the first discoverable data subclass 442 includes content transmitted between entities and the numbers (e.g., N_B, Ny, and Nc) of the mutating IDs provided by an authenticator.

[00311] The discoverable data class 440 can also include a second discoverable data subclass 444 that includes discoverable data of a second type. Discoverable data of a second type can include keys used to encrypt messages that include discoverable data of the first type. In some embodiments, the second discoverable data subclass 444 includes the secret keys (e.g., K_B, Ky, and Kc) of the mutating IDs. For example, as described above with respect to the transaction key exchange protocol, Bob sends Trent a message that includes Vera' s publicly-known identifier Va encrypted with his secret key K_B.

B → T: N₈E(K_B, V_ldX)

[00312] Since Vera's identifier V_icι is publicly known and, therefore, is discoverable data of the first type, Bob's secret key KB can be considered discoverable data of the second type because it encrypts discoverable data of the first type.

[00313] The discoverable data class 440 can further include a third discoverable data subclass 446 that includes otherwise undiscoverable data that becomes discoverable because it is encrypted with keys that are considered discoverable data of the second type. For example, as shown in the above message sent from Bob to Trent, the data X can be randomly assigned to Bob and known only to Bob and Trent. Therefore, the data X is undiscoverable. However, since the data X is encrypted with Bob's secret key K_B (which is discoverable data of the second type because it is used to encrypt discoverable data (e.g., ViJ)), the data X can be considered discoverable data of the third type.

[00314] Figs. 24 and 25 illustrate an encryption strategy for protecting the security of undiscoverable data. To protect the security of the undiscoverable or secret data, separate keys are used to encrypt the different types of data (hereinafter referred to as "separate encryption protocols"). For example, one or more keys (e.g., one or more mutating IDs) can be used to encrypt the undiscoverable data and one or more keys (e.g., one or more mutating IDs) can be used to encrypt the discoverable data. As described below, since the same keys are never used to encrypt undiscoverable data and discoverable data, discoverable data of the third type is eliminated.

[00315] As shown in Fig. 24, data included in the secret data class 430 can be encrypted with one or more keys 450 that are only used to encrypt data included in the secret data class 430 (hereinafter referred to in this example as "undiscoverable data keys 450"). Optionally, data included in the discoverable data class 440 can be encrypted with one or more keys 460 that are only used to encrypt data included in the discoverable data class 440 (hereinafter referred to in this example as "discoverable data keys 460"). It should be understood that the undiscoverable data keys 450 used to encrypt data included in the secret data class 430 cannot be determined from (or are unrelated to) the discoverable data keys 460 used to encrypt data included in the discoverable data class 440. It should also be understood that the data 420 does not need to be separated and placed in contiguous blocks of data according to the data class the portions of the data 420 belong to. As shown in Fig. 25, data included in the secret data class 430 and the discoverable data class 440 can be divided into a number of portions that are mixed together.

[00316] As noted above, by separating the discoverable data from the undiscoverable data and encrypting the undiscoverable data with undiscoverable data keys 450 that are different from the discoverable data keys 460 used to encrypt the discoverable data, discoverable data of the third type is eliminated since the discoverable data keys 460 are never used to encrypt undiscoverable data. Therefore, even if a discoverable data key 460 used to encrypt discoverable data is determined using a brute force attack, the determined discoverable data key 460 cannot be used to obtain undiscoverable or secret data. [00317] For example, assume that Bob wants to request a transaction key from Trent to be used to communicate with Vera, and, therefore, Bob sends Trent the data X and Vera's identifier Vφ- Also assume that Bob has a mutating ID that includes a number N_BI and a corresponding key KB₁ to be used only with undiscoverable data (for this example hereinafter respectively referred to as the "undiscoverable data number N_B " and the "undiscoverable data key K_BI") and a mutating ID that includes a number Nβ₂ and a key Kβ2 to be used only with discoverable data of the first type and the second type (for this example hereinafter respectively referred to as the "discoverable data number N_BΣ" and the "discoverable data key KB2")- Bob can encrypt Vera's identifier V^ with his discoverable data key Kβ2 because Vera's identifier V^ is discoverable data of the first type (i.e., it is publicly known). Similarly, Bob can encrypt the data X with his undiscoverable data key K_BI. Since Vera's identifier Vm is encrypted separately from the data X, the data X is no longer considered discoverable data of the third type as described above because the data X is not encrypted with a key that encrypts discoverable data. The data X, therefore, becomes undiscoverable data. In some embodiments, Bob also appends the undiscoverable data number N_BI and the discoverable data number N_B2 to the separately encrypted portions in order to identify himself and the separate portions of the message to Trent. Bob can send the resulting message to Trent.

B → T: N_B1E(K_B1, X) N_B2E(K_B2, V_id)

[00318] If an eavesdropper obtains the above transmission sent from Bob to Trent, the eavesdropper (theoretically) could obtain the discoverable data key K_B2, which encrypted Vera's identifier Vid, using a brute-force attack. Knowing the second secret key K_B2, however, does not give the eavesdropper access to the undiscoverable data key K_B1 or, consequently, the data X or any other data also encrypted with the undiscoverable data key K_BI. AS noted above, Bob could choose not to encrypt Vera's identifier Vi_d and send it as plaintext.

[00319] To complete the key exchange, assume Vera has a mutating ID that includes a number Nγi and a corresponding key Kyi to be used only with undiscoverable data (hereinafter respectively referred to in this example as the "undiscoverable data number Ny₁" and the "undiscoverable data key Ky "), a mutating ID that includes a number Ny₂ and a key Kv2 to be used only with discoverable data (hereinafter respectively referred to in this example as the "discoverable data number Ny_∑" and the "discoverable data key U-V.₂"), and data 7 known only to Vera and Trent.

[00320] Trent, who knows the mutating IDs assigned to Bob and Vera, can decrypt the message from Bob and can generate a transaction key K_BV for Bob and Vera. Since the transaction key K_BV could potentially be used by Bob and/or Vera to encrypt discoverable data of the first type, the transaction key K_BV can be considered discoverable data of the second type and can be encrypted with Bob's and Vera's discoverable data keys (e.g, K_BZ and Byi). Trent provides the transaction key K_BV to Bob and Vera in separate responses.

[00321] In some embodiments, Trent's response to Bob includes the transaction key K_BV, the data X, a mutating ID that includes a new number N_BI ' and a new key K_BI ' for Bob to be used only with undiscoverable data (hereinafter respectively referred to in this example as the "new undiscoverable data number N_BI "' and the "new undiscoverable data key K_BI "')_&gt;^an&amp; ^a mutating ID that includes a new number N_BZ ' and a new key K_B2 ' for Bob to be used only with discoverable data of the first type and the second type (hereinafter respectively referred to in this example as the "new discoverable data number Nβ₂ "' and the "new discoverable data key K_BI "')• Since the transaction key K_BV can be used to encrypt discoverable data of the first type, Trent encrypts the transaction key K_BV with Bob's current undiscoverable key K_BI. Since the data X is also undiscoverable data, Trent also encrypts the data X with Bob's current undiscoverable data key KB_I. Furthermore, since the new undiscoverable data key K_BI ' for Bob is considered undiscoverable data (e.g., because it is a random, secret key that will only be used to encrypt undiscoverable data), Trent encrypts the new undiscoverable data key K_BI ' with Bob's current undiscoverable data keys K_BI. The new undiscoverable data number N_BI ' and the new discoverable data number Nβ₂ ', however, are discoverable data of the first type since they are passed in the clear. Trent, therefore, encrypts the new undiscoverable data number N_BI ' and the new discoverable data number N_B2 ' with Bob's current discoverable data key KB2- Trent also uses Bob's current discoverable data key K_B2 to encrypt Bob's new discoverable data key K_B2 ' since it is used to encrypt discoverable data of the first and second type. Optionally, Trent's response can include Vera's identifier V_/D, and Trent can use Bob's current discoverable data key Kβ₂ to encrypt Vera's identifier V_M since it is discoverable data of the first type. In some embodiments, Trent appends Bob's current undiscoverable data number NBI to the portion of the response encrypted with Bob's current undiscoverable data key K_BI and appends Bob's current discoverable data number NB2 to the portion of the response encrypted with Bob's current discoverable data key K_B2 in order to identify the separate portions of the response. Trent can then send the response to Bob.

T → B: NBIE(KBI, KBI 'X) N_B2E(K_B2, N_BI ' N_B2 ' K_B2 ' V_id K_BV)

[00322] Trent can generate and send a similar response to Vera.

T → V: N ViE(KvI, K_v, ' Y) N_V2E(K_V2, N_v, ' N_V2 ' Ky₂ ' B_id K_BV)

[00323] The protocol described above can be generalized for any protocol on a message- by-message basis. For example, let N_xE(K_x1DiD₂...) be a message to be transmitted wherein N_x is an optional parameter. To transmit the message using the separation encryption protocols described above, divide the data Dj, D₂,... into undiscoverable data and the three types of discoverable data based on the original format of the message. For example, let Dj*, D₂*,... be undiscoverable data, let Dj⁺, D₂⁺, ...be discoverable data of the first type and the second type, and let £&gt;/, D/,...be discoverable data of the third type. The message can then be constructed by encrypting the undiscoverable data (i.e., Di*, D₂*,...) and the discoverable data of the third type (i.e., D/, D₂*,...) with a first key Kl and encrypting the discoverable data of the first type and the second type (i.e., Di⁺, D₂⁺, ...) with a second key K2, wherein the first key Kl and the second key K2 are different and computationally underivable from each other.

[00324] In some embodiments, an entity may want to further protect discoverable data of the second type. For example, as described above, when Trent provides the transaction key KBV to Bob, Trent encrypts the transaction key KBV with Bob's current discoverable data key K_B2- The discoverable data key K_B2, however, is also used to encrypt Vera's identifier V_id, which is publicly known. An eavesdropper, therefore, can perform a brute force attack on the portion of Trent's response encrypted with Bob's current discoverable data key K_B2 and obtain, not only K_B2, but also the transaction key K_By. Using this technique, an eavesdropper can obtain the transaction key K_BV before it is used by either Bob or Vera or without Bob and/or Vera using the transaction key K_By to encrypt discoverable data.

[00325] To attempt to overcome the above issue, discoverable data of the second type can be encrypted with a key separate from the key used to encrypt discoverable data of the first type. In some embodiments, an entity is assigned a separate mutating ID that includes a number and secret key that are only used to encrypt discoverable data of the second type. For example, assuming that Bob has an alternate mutating ID with an alternate number NB₃ and an alternate key K_B3 to be used only to encrypt discoverable data of the second type, the above response sent from Trent to Bob can be modified to include the transaction key K_BV encrypted with the alternate key K_B3.

T → B: N BIE(KBI, K_B1 'X) N₈₂E(KB₂, NBI ' N_B2 ' K_B2 ' V_id) NB₃E(K₃₃, K_B3 'KBV)

[00326] By separately encrypting the transaction key K_By and the discoverable data of the first type (e.g., N_BI ', N_B2 ', and Vi_d), an eavesdropper cannot obtain the transaction key K_Bγ by performing a brute force attack on Trent's response to Bob. It should be understood that the discoverable data key K_B2 ' and/or other discoverable data of the second type can also be encrypted with the alternate key K_B3 rather than being encrypted with the discoverable data key KB₂ in order to prevent a brute force attack on the response from revealing the discoverable data of the second type.

[00327] In some embodiments, rather than receiving the alternate mutating H) for encrypting discoverable data of the second type, an entity receives a single alternate key that may or may not mutate after each use or on another schedule (e.g., after a number of uses, after a specific time span, etc.). The alternate key is a secret key known only to an authenticator and the entity assigned the alternate key. In some embodiments, an entity uses its alternate key to directly encrypt discoverable data of the second type. In other embodiments, an entity uses its alternate key and undiscoverable data key to generate a new key to be used to encrypt discoverable data of the second type. For example, assume that Bob wants to initiate a transaction key exchange with Vera and, therefore, Bob sends Trent Vera' s identifier V^ and the data X. Also assume that Bob has a mutating ID that includes a number N_Bi and a corresponding data key K_BI to be used only with undiscoverable data (for this example hereinafter respectively referred to as the "undiscoverable data number N_BI" and the "undiscoverable data key K_BI"), a mutating ID that includes a number N_B2 and a key K_B2 to be used only with discoverable data of the first type (for this example hereinafter respectively referred to as the "discoverable data number N_B2" and the "discoverable data key K_B2"), and an alternate key L_B used only to encrypt discoverable data of the second type, such as the transaction key K_BV- In some embodiments, Bob uses his discoverable data key K_B2 as his alternate key L_B. In other embodiments, Bob can use the data X as his alternate key LB- Bob's undiscoverable data key K_BI, discoverable data key Kβ₂, and alternate key L_B are all known by Trent and can mutate (i.e., be reassigned by Trent) after each use or on another schedule.

[00328] As described above, to initiate the transaction key exchange, Bob generates a request that includes the data X and Vera's identifier F^. Bob can separate and encrypt the request as described above. Bob sends the request to Trent.

[00329] When Trent receives the request, Trent can generate the requested transaction key KBV- TO send Bob the transaction key K_BV, Trent can generate an XOR of Bob's undiscoverable data key K_BI and Bob's alternate key K_B3 (or L_B) in order to generate a new encryption key.

XORiKβi. KB₃)

[00330] The XOR operation performs a bitwise exclusive "or" of Bob's undiscoverable data key KBI and Bob's alternate key Kβ3. Therefore, the XOR operation generates a bit string equal in length to the length of the longer key between Bob's undiscoverable data key K_BI and Bob's alternate key K_B3- Each bit position of the generated bit string is equal to "0" if the corresponding positions of the Bob's undiscoverable data key K_BI and Bob's alternate key KB₃ are the same (i.e., both "0" or both "1") or set equal to "1" if the corresponding positions of the Bob's undiscoverable data key K_BI and Bob's alternate key K_B3 are the not the same. The XOR operation is generally irreversible unless one of the inputs (e.g., Bob's undiscoverable data key KBI or Bob's alternate key K_B3) is known.

[00331] Trent uses the generated bit string (i.e., the result of the XOR operation) to encrypt the transaction key K_BV- Trent sends the encrypted transaction key KBV in a response to Bob. Trent can separate and encrypt the response as described above.

T -&gt; B: N BIE(KBI, K_Bj 'X) NB₂E(K₈₂. N₃ J ' N_B2 ' K_B2 ' V_id) E(XOR(K₈ j, K_B3), K_BV)

[00332] Bob can perform the same XOR operation as Trent performed in order to generate the decryption key and obtain the transaction key KB_V- Even if an eavesdropper were to obtain the transaction key K_BV and, through a brute force attack, obtain the encryption key (i.e., the bit string resulting from the XOR operation), the eavesdropper cannot use the stolen key to obtain Bob's undiscoverable data key KBI, Bob's alternate key K_B3, or the data X. Also, if at least one of Bob's undiscoverable data key K_B j and Bob's alternate key Ksβ mutate after each use or on another schedule, the stolen key is not used to encrypt data included in any future messages. Therefore, the stolen key cannot be used to obtain data included in such messages.

[00333] In some embodiments, the different keys used to encrypt discoverable and undiscoverable data are nested in order to provide further security (hereinafter referred to as "nested separate encryption protocols"). For example, assume that Bob sends the following message to Trent as described above.

B → T: N_BIE(K_B1, X) N₃₂E(K_B2, V_id)

[00334] The message includes two distinct portions. For example, the message includes a first portion that includes the encrypted undiscoverable data N_BIE(K_BI, X) and a second portion that includes the encrypted discoverable data N_B2E(KB₂, V_lfj). Since the portions are encrypted separately and concatenated together, an eavesdropper can attack the portions separately.

[00335] For example, an eavesdropper can perform a brute force attack on the second portion (i.e., since Vera's identifier Fy is publicly known) and can obtain Bob's discoverable data key K_B2. Once the eavesdropper has Bob's discoverable data key K_B2, the eavesdropper can obtain the details of the request Bob sent to Trent. Perhaps more damaging, the eavesdropper can also perform a man-in-the-middle attack. A man-in-the-middle attack occurs when an eavesdropper intercepts a transmitted data and attempts to read and/or to alter the data and often does so without the data sender and the intended data receiver knowing. For example, using Bob's stolen discoverable data key KB₂, an eavesdropper can alter or reconstruct the second portion of Bob's message by replacing the second portion of Bob's message with their identifier encrypted with Bob's discoverable data key Kβ₂- The eavesdropper can then send the altered message to Trent.

[00336] When Trent obtains the altered message, he decrypts each portion and performs the requested processing. Since the first portion and the second portion of the message are essentially unrelated, Trent has no way of determining whether the credentials included in the second portion are legitimate.

19 [00337] To overcome the above situation, Bob can use the undiscoverable data key K_BI and the discoverable data key K_B2 to perform nested encryption. For example, assume that Bob generates a request for Trent that includes the data X and Vera's identifier F^. Bob can encrypt the data X (i.e., the undiscoverable data) with the undiscoverable data key K_Bi. In some embodiments, Bob appends his undiscoverable data number N_Bi to the encryption result. Bob can then append Vera's identifier Vi_d to the encrypted data X and encrypt the result with the discoverable data key K_B2- Bob can then append his discoverable data number N_B2 to the result.

B → T: N_B2E(K_B2, V_id E(K_BU X))

[00338] The above request is dependent on both the undiscoverable data and the discoverable data since both forms of data are included in the final encryption step. It should be understood that the nesting can be performed in either direction. For example, Bob can encrypt Vera's identifier V_M with the discoverable data key K_B2, append the data X to the result, and encrypt the combination with the undiscoverable data key KB_I.

B → T: N₈₁E(K_BI, XE(K_B2, V₁₄))

[00339] As shown in the above messages, in some embodiments, an entity may only need one mutating ID number (e.g., NBI) to identify itself as the message originator when the mutating ID keys (e.g., K_BI and K_B2) are nested. For example, Bob can be assigned one mutating ID that includes one number N_B and one secret key K_B, which Bob can use to encrypt solely undiscoverable data or solely discoverable data and a single, separate key, such as an alternate key L_B, which Bob can use to encrypt the type of data not encrypted by the secret key K_B of the mutating ID. Bob can use the alternate key L_B to encrypt data nested within the data encrypted with the secret key K_B- Bob can then append his number NB to the result.

B → T: N₈E(KB, XE(L_n, V_id))

[00340] It should be understood that the protocols (e.g., mutating IDs protocols, separation encryption protocols, and nested separate encryption protocols) described above can include features that make brute force attacks difficult or reduce the usefulness of such attacks. For example, the above protocols can use strong encryption techniques that may require days, months, or years before a brute force is successful and a key is discovered. Thus, what might appear as avenues of attack in a theoretical sense may be difficult or impossible in a practical sense.

[00341] Also, since a number of messages may be transmitted between an entity and the authenticator during the time required for an eavesdropper to perform a brute force attack, the mutating ID associated with the message intercepted by the eavesdropper can be different from a current mutating HD assigned to the entity. Therefore, an eavesdropper attempting to uncover a current mutating DD assigned to an entity must track and store every message transmitted between that entity and the authenticator in order to trace through messages and obtain a current mutating ID key. For example, if an eavesdropper attempts to determine a mutating ID of an entity using a brute force attack, the authenticator may reassign or mutate the mutating ID multiple times while the eavesdropper is performing the brute force attack. If the eavesdropper desires the key of the most recent mutating ID, once the eavesdropper obtains a past and now invalid mutating ID, he or she must use the uncovered mutating ID to decrypt each message transmitted by the authenticator to the entity and obtain each mutated or reassigned mutating ID in order to determine the currently assigned mutating ID. The tracking and storing requirements to perform such a trace are likely to be very challenging to any eavesdropper attempting to perform a brute force attack.

[00342] In addition, an eavesdropper may have to perform multiple brute force attacks in order to discover "useful" information. For example, in the separation encryption protocol examples described above, an eavesdropper may be able to perform a brute force attack on a message encrypted with a transaction key (e.g., K_BV) and, therefore, may be able to obtain the transaction key (e.g., K_BV)- TO obtain a secret key of an entity using the transaction key, however, the eavesdropper is required to perform a second brute force attack on the message sent from the authenticator that included the now known transaction key, which was encrypted with the entity's secret key. As described above, a single brute force attack may require days, months, or year to compute and, therefore, a second brute force attack may double the time needed to obtain "useful" information (e.g., a secret key of a mutating ED). Furthermore, an eavesdropper may have to perform nested brute force attacks in order to obtain "useful" information, where an eavesdropper is required to try each of a first candidate key and, for each first candidate key, try each of a second candidate key. For example, in the above nested separate encryption protocol examples, to obtain the data X from the following message, an eavesdropper would be required to try every candidate key for the outer encryption result E(KB, XE(L_B, Vi_d) and, for each candidate key of the outer encryption result, try every candidate key for the nested encryption result E(L_B, Vm)-

B → T: NB E(K_B, XE(L_B, VU))

[00343] It should be understood that if a single brute force attack requires TV processing time units, a single nested brute force attack (i.e., a single brute force attack nested inside another brute force attack) can require approximately N² processing time units, which may make a brute force attack impractical or impossible for an eavesdropper in terms of processing requirements.

[00344] As can be seen from the above, various embodiments provide a system and method of distributing content and information with features to protect security and the legal rights of content owners. Embodiments also provide a system and method of performing electronic commerce with features to protect security and the confidential, financial information of transaction participants. Additional features and aspects of embodiments of the invention are set forth in the attached claims.