Methods, systems and devices for packet watermarking and efficient provisioning of bandwidth

Abstract

Disclosed herein are methods and systems for transmitting streams of data. The present invention also relates to generating packet watermarks and packet watermark keys. The present invention also relates to a computerized system for packaging data for transmission to a user. The system may utilize computer code to generate a bandwidth rights certificate that may include: at least one cryptographic credential; routing information for the transmission; and, optionally, a digital signature of a certificate owner; a unique identification code of a certificate owner; a certificate validity period; and pricing information for use of bandwidth. The present invention also relates to an electronic method and system for purchasing good and services by establishing an account whereby a customer is credited with a predetermined amount of bandwidth usage, and then charges are assessed against the account in an amount of bandwidth usage which corresponds to the agreed upon purchase value for the selected item.

Description

RELATED APPLICATIONS

2.times.

Where

Convenience Premium

This represents some premium,

Time Value

This is a function of the exercise period of a bandwidth right. It is proportional to

$\begin{array}{c}1V=\left(1-P_f\right)\left(V_I+V_T+V_C\right)\\ =\left(1-P_f\right)\left[\left(X\left({\min }_0-{\min }_1\right)\right)+V_T+V_C\right)]\end{array}$

The convenience premium, V.sub.C V_C, should be independent of all other values (except V). The equation behaves as follows: With increased failure probability decreasing bandwidth rights value, independent of other variables, while increased demand relative to supply would drive up V.sub.C V_C. We might try to compute V.sub.C V_C by accounting for known demand and supply values, and in fact, it is of vital importance to know the supply, and to allocate it so that any right issued can be exercised within its exercise period.

Clearinghouse Functions

Additionally, it is observed that a method and system is needed to allocate supply based on demand that accounts for unused rights. This may be separate or complementary to the packet watermarking features previously disclosed or may be considered an additional feature to assure that bandwidth provisioning is properly accounted for. In other words, the system needs to over-allocate supply to some degree, knowing that some rights may go unexercised, so that demand is filled as much as possible. This is similar to airlines' practice of overbooking flights. It is also necessary in providing liquidity to the market and assuring that bandwidth is effectively allocated in a timely and efficient manner. Some mechanism must be in place to prevent attacks on the system, by a party, who, in effect, tries to corner the market in bandwidth, with no intention of using it, so that it goes unused. By extension, Denial of Service attacks are related o this unwanted occurrence. Naively, one would think that since one has to pay for the bandwidth, why would someone want to corner the market? Although bandwidth is not “free”, it should only comprise a small fraction of the value of the information to be transferred, and so this is not an unthinkable situation. Similarly, the accounting of the bandwidth used should not exceed the value of bandwidth provided. An accountant cannot charge more than the value being accounted, the economics cannot justify the cost. By breaking down the path of packets as well as provisioning for pricing based on supply and demand, features of the present invention address accountability in a transparent manner.

As well, ISPs and other providers of information must be able to engage in competitive bidding, or arbitrage, for the cost of the bandwidth they purchase and better map these purchases with demand patterns of their users or demands being made by other vendors who currently engage in sharing bandwidth resources to enable a freer flow of information across public networks. The likeliest preventive measure is the existence of competition in transmission. Additionally the methods and system contemplated herein include provisions for clearinghouse facilities and accountability handled by trusted third parties. Transactions for the rights, options and the actual trading of bandwidth can include secure time stamps, digital signatures, digital certificates, and other cryptographic protocols to enable independent third party verification and accountability. These features can be offered in real time or may be saved in separate, secure storage facilities for assisting in settlements. Where two parties may have competitive interests in any given transaction contemplated herein, secure, cryptographic credentials (such as, digital signature, secure digital watermarks, digital certificates, and the like) have obvious value to enhancing the success of an efficient bandwidth exchange. These issues are disclosed below.

Secondary Markets

Another option is the potential need to necessitate a secondary market for the trading of bandwidth, which could be divided up by a trading syndicate, and traded on a secondary basis to users. In a manner of operations, telecommunications companies perform this role between national telecommunications systems to facilitate international phone usage. But the difference with the system envisioned in the present system is that “any” user could buy bandwidth rights at times of low demand, and hope to sell them at a profit in times of higher demand. This would seem to imply the exchange itself should do some proprietary trading in this manner, both to profit, and to ensure some bandwidth is available for sale to users when they need it. This will have a purpose to serve in making the market efficient in the future. The present invention anticipates such facilities which can be created and handled by parties with an interest in the efficiencies and potential profit opportunities afforded to maximizing the value of bits being handled by any given network, or networks. Time being typically fixed for users, value of the data objects being offered being subjective, features of the present invention offer robust handling of supply and demand of bandwidth.

Bandwidth rights instruments are likely to be highly localized to specific subnets, domains, internet service providers (“ISPs”, portals, wireless networks, etc). Especially since certain types of connections may be available only from certain exchanges, and since failure probabilities are likely to vary with specific hardware, operating systems, and service providers (including ISPs). Additionally, the basic valuation equations above do not address telecommunications costs across various types of lines. This problem at least, can be solved by active maintenance of cost tables, designation codes for types of lines, and the designation of a low cost standard: a minimal intrinsic value to bandwidth is an example of a minimum cost. Secondary markets for the cash or cash equivalent value of bandwidth given the limitations of a particular means for bandwidth exchanges, including POTs, DSL, cable, fiber, wireless, etc., is enabled by features of the present invention given the link between supply and demand, additions of rights and options for time value, and the cost of bandwidth for objects being exchanged or streamed, in satisfying demand.

Bandwidth as “Currency” Between Exchanges

The problem of moving rights between exchanges can be difficult since supply/demand planning for one exchange will not translate to another, unless some means for interconnecting exchanges is developed, and exchange bandwidth planning is global. The race by many parties to link users to the Internet via varying access links (modem) including DSL, POTs, cable, fiber, wireless, satellite may further the need for common bandwidth pricing. In fact, improved handling of bandwidth is a result of the success of TCP/IP and the vendors who have integrated much of the public Internet as well as gateways to virtual private networks (“VPNs”). What is clear is that the basic structure of the present invention would facilitate such planning to the benefit of all market participants: telecommunications providers, ISPs, users and publishers as well as more general aggregators of content and bandwidth such as, phone companies, cable companies, personal digital assistant manufacturers, personal music device manufacturers, and satellite companies intending on providing services across multifarious line types.

Accountability and Cryptographic Credentials

By securitizing bandwidth rights, the creation and supply of bandwidth rights digital certificates, made unique by cryptographic methods to manage them, will also be necessary. Transferring traditional digital certificates between individuals is complicated and unnecessary without tying such cryptographic credentials into the functions of the exchange. The three main categories are: advertisement or publicly available information concerning the bandwidth rights certificates, facilities for handling the identities and financial credentials of the market of buyers and sellers, and a facility for completing or settling transactions. Independent oversight concerning disputes resolution are anticipated and benefit from the level of cryptographic protocol utilized in the present invention. Following the general principles of a securities clearing model is highly applicable. In this case, the exchange needs to create and manage an account for each party that can own or trade bandwidth rights. Additionally, a method for authenticating said party or parties is required. Use of public key infrastructure, including digital credentials such as certificates, as well as adding the additional feature of embedding these credentials into data being traded by means of a steganographic cipher or digital watermark, are clearly absent in the prior art.

Additional facilities for accountability may include digital signatures (including such variants as one time signatures, zero-knowledge proof signatures, etc.). Separating recognition or general search facilities, i.e. market data in which participants decide to enter into transactions, from transactional, audit-type facilities have the likely impact of improving the handling of noncommercial and commercial activities for the network as it balances bandwidth needs. Additionally, as all the data being handled for exchange function and fulfillment can be measured in terms of bandwidth, the present invention serves as a basis for increasing the likelihood of enabling bandwidth to act as currency for information data, as well as optimizing the economic use of telecommunications networks. With these elements, a trading market system can be implemented by the following methods:

The EXCHANGE creates and manages a supply of uniquely distinguished bandwidth rights certificates. These certificates are good for a specific period only. They may traded over the course of time, anywhere from the moment they are created to the expiration time. It is questionable whether a right should be exercisable once it is clear that even if a transfer is initiated, it cannot be completed given that right only. However, consider that the right is usable, but its value decreases rapidly as it approaches expiration (i.e. value is based on time left, not total transfer time). Once a certificate is expired it is deleted. Inclusion of more traditional notions of options, as previously disclosed would greatly assist in measuring and quantifying risk associated with bandwidth rights certificates. Hash values incorporating a time-stamp could be used to serialize certificates. Such a cryptographic method is well noted in the art. U.S. Pat. Nos. 5,136,646 and 5,136,647 (“Digital Document Time-Stamping With Catenate Certificate” and “Method For Secure Time-Stamping Of Digital Documents” respectively) describe methods for cryptographic time stamping. Besides “universal time,” used for secure time stamps, other methods for data uniqueness include digital signatures or one-way hash functions alone. These elements may include information relating to an independent third party, the exchange where the transaction takes place, an agent or principal to a transaction, a certification authority, or some subset of the data may be handled anonymously to assure levels of anonymity which may be required in assuring higher efficiencies in handling and settling trades for bandwidth rights certificates and the associated bandwidth.

One way would be to extend the attributes of a traditional digital certificate by incorporating the present inventions novel features of how bandwidth is to be provisioned, as previously disclosed in connection with packet watermarking or faster routing processes including application of Reed Solomon or other error correction codes to network data handling, and any mechanism which can be adjusted to reflect the real-time or future price of the bandwidth certificate. If the available price is immediately based on some impending expiration of the validity period of the bandwidth right itself, OR the validity of the bandwidth rights cryptographic certificate, if the actual period of time the cryptographic attributes saved in the digital certificate is close to expiration, this value may become infinitesimal as expiration occurs. For instance an X.509 digital certificate contains the following elements:

1) Version of X.509 2) serial number of the certificate 3) the certificate holder's public key 4) the certificate holder's unique ID 5) the certificate validity period 6) The unique name of the certificate issuer 7) the digital signature of the issuer and 8) the identity of the signature algorithm.

Fields for 1) handling the bandwidth to be transacted, as per the previous discussion on how to route bandwidth packets (including the previously discussed Reed Solomon variation on transmitting packets in chunks to speed overall transmission); 2) a field for a pricing scheme; and 3) a field for additional information to assist with the pricing scheme, such as a Black Scholes options field, could be supported to handle particular embodiments of the present invention. In some cases, the certificate may not require all of the elements as they pertain to bandwidth trading and could include, at the very least:

1) The digital signature of the certificate owner (this might include the unique information relating to the exchange or hub for which the certificate is being considered for trade, especially if pricing differs amongst a plurality of similar exchanges) 2) unique ID of the certificate holder (including, for instance, a buyer, seller, or agent, and any unique information or ID for which the certificate holder is committing the certificate to any of a plurality of exchanges) 3) the certificate validity period (for the present invention, this would apply to either the validity of the cryptographics employed in the certificate or the period in which the price or price equivalent value, for instance an buy or sell option or futures price, is valid) 4) the identity of the cryptographic algorithm[s] which is used by the certificate owner. 5) the identity of the pricing mechanism used (including provisions for Black-Scholes or similar options pricing models, futures, or other similar mechanisms)

Additionally, use restrictions or rules associated with the bandwidth being contracted for/to can be added as additional fields. These might include predetermined agreements which assist in defining the application of the bandwidth right to an applicable market or markets. There may also be provisions for including functional data, software or executable computer code, or algorithms, to the bandwidth right cryptographic certificate to reduce computational overhead at the sender or receiver end of a transmission.

The exchange creates a central hub, or plurality of hubs, for planning bandwidth supply, accounting, and disseminating pricing information. This hub may take the form of a syndication or plurality of similarly suited exchanges or there may be exchange rate features to account for differences between telecommunications costs in a given locality or geographic location (such as a country, city or states). Differences may exist between exchanges in the types of cryptographic protocols which are used by the exchange, as well. Alternatively, the differences between how pricing information is disseminated between various exchanges will relate specifically to the cost of the telecommunications (i.e., “intrinsic value”) based on the form of deployment (POTS versus cable) or spectrum being handled (wireless 900 MHz versus 3G). In some cases, spectrum allocation may suffer from other market pressures in pricing including government control or some other similar restriction for how the bandwidth may be allocated or used. Client-side software will value the rights relative to a particular user's needs, and used by any party trading rights. A seller creates a SELL advertisement, which is entered into the “exchange.” The exchange verifies the seller actually holds the right in their account.

The exchange may further maintain records regarding the reputations of the market of SELLERS and BUYERS who have traded on the exchange. Additionally, embodiments of the present invention may separate the trading facility from the facilities for advertising BUY and SELL orders. A buyer then enters a BUY offer against the sell advertisement. The exchange validates the buyers and sellers, and then clears the transaction, transferring money from the buyer's payment method or credentials (credit card, micropayment, payment facility, credit terms, etc.) to the seller's account, and the right to the buyer's account. The unbundled right may be so infinitesimal that the actual cost of the right must be bundled with the underlying content or information being sought. The rights could also be bound to underlying titles (by an associated hash or digital signature or an embedded digital watermark). Essentially the relative cost of the bandwidth right represents some small amount of bandwidth, satisfactory in serving as a cryptographic or trusted piece of information, which is factored into various classes of trades so that higher computational efficiencies can be maintained. As certain bandwidth certificate attributes are used more frequently, perhaps, than others who are buyers or sellers or both, of bandwidth rights, smaller more compact amounts of bandwidth will likely be result as improvements and experience dictate. This may be similar to attaching sales taxes, handling charges, and credit card use charges that are typically bundled with the cost of a given physical goods purchase. The underlying telecommunications cost (i.e., “intrinsic value”), the underlying computational cost of the bandwidth certificate and its attributes, as well as additional information overhead for accounting and clearing trades, would represent the cost floor in computational cost, bandwidth, and time for embodiments contemplated herein.

When bandwidth is actually traded some link between the original trade for the bandwidth being supplied may be hashed or signed and used as a transaction receipt for the data that is later sent using the transacted bandwidth. This data can alternatively serve as a record of trades for dispute resolution or accounting to keep all participants informed. Once the actual transacted bandwidth is used by an end user, embedding bandwidth rights, bandwidth certificates, transaction related unique information (for instance, hashes, signatures, times stamps, etc.) with digital watermarking technology has the further benefit of keeping the file size of the bandwidth once it is used in the form of a data object being exchanged or streamed. It is clearly an option with benefits for embodiments of the present invention. Again, a separate certification authority or government-agency may ultimately serve as the arbiter of trust in enabling economic, transparent and liquid markets for bandwidth use.

Sample Embodiment

User A has a cellular phone and a personal digital assistant (“PDA”). He pays a fixed rate of $100 per month for 1000 minutes of cellular air time (which equates to $0.00167 per second). There are times at which this rate may be higher or lower or locations for which charges may be assessed when the use utilizes either device in some geographic location outside of, for instance, the location where the devices were registered for use. The user alternatively pays $200 per month for 1000 minutes for PDA connectivity (which equates to $0.00333 per second), which may include e-mail functions, image or audio file downloads or streams, and any other functionality commonly attributable to a general computing device such as a PC. The PDA may also place a cost structure on where the device is used in relation to its registration location and may charge for the amount of data which is uploaded, downloaded or exchanged. This may be measured in bandwidth terms (such as a charge per some amount of bytes or bits). The functionality being different for each device, an arbitrage opportunity exists if the user can trade his cellular phone minutes for PDA minutes. The benefits in this example are a 2:1 ratio of expense.

User A may want to use either of the devices in the example to make some purchase of a good or service which can be handled by the device itself. The security for the transaction must have been previously agreed to by the vendor providing the goods and the provider of the device for which embodiments of the present invention can be used to facilitate a commercial transaction. For instance, a vending machine which can handle transmissions from either of the two devices to enable a transaction for a can of soda or a weather forecast, or some other valued consideration, is a device with which the present invention has applicability. The user has bandwidth rights which may be separate from the minutes that have been paid for solely for the functions of the respective device. The user may use a valid or existing bandwidth rights certificate to represent a payment facility for which the cellular or PDA bandwidth provider can monitor and account. If the transaction can be handled with the vending machine, for instance a wireless exchange of credentials between the vending machine and user's device, value has been attributed to the use of bandwidth. The cellular phone, in this example is the cheaper mode of bandwidth based strictly on functionality. The PDA provider may change its pricing to reflect transaction specific pricing to have competitive payment facilities based on bandwidth rights certificates and higher value added services to the customer.

The point of this embodiment is to emphasize the treatment of bandwidth as a commodity which may be valued in a transaction. The value inherent in information content or the facility of information itself to assist in transactional activity is valuable in an information economy. The time it takes for sender and receiver confirmation of a transaction between the user and the vending machine may take, say 5 seconds. The time spent in completing the transaction includes how much information was exchanged, in some quantitative measure such as bits, to satisfy the rules of a successful transaction. If the vending machine item is one dollar, the cost of the transaction is one dollar plus the cost of 5 seconds of air time that was used to consummate the transaction. Hence the total cost is: $1.00+5.times.$0.00167 5×$0.00167 (or $1.00833), if the cell phone is used; or $1.00+5.times.$0.00333 5×$0.00333 (or $1.01667), if the PDA is used. The cost of the goods or services sold leaves a margin of profit. There is a relationship to the efficiencies of increasing the convenience of a means of payment for users, increasing the ability of traditional bandwidth providers to leverage existing subscriptions and arrangements with customers, and the ability to atomize bandwidth as a valued commodity given its inherent nature: it is a measure of information in discrete time.

Sample Embodiment

In this embodiment we use bandwidth to purchase other information resources such as kilowatts of power from a utility power grid. As such, bandwidth acts as a currency which has a defined (though perhaps fluctuating) value. The amount of bandwidth that is used to “purchase” a specified amount of power will be determined based on the market forces at play. The total amount of bandwidth will be the cost of the goods being purchased (in this case, the specified amount of power) plus the cost of the bandwidth used to complete the transaction—which may vary with the communication channel being used (e.g., the use of a PDA vs. the a use of a cell phone). In effect, “bandwidth” is removed from my account in an amount necessary to complete the transaction. To further illustrate this point, it is assumed that the amount of power being purchased is valued at $50, and it is further assumed that the transaction requires 5 seconds of air time to complete. If the purchaser has an account balance of 60,000 seconds of air time (equating to 1,000 minutes), and the fair market value of the air time is $0.00167 per second, then the purchaser's account is debited 29,945 seconds (equating to $50.00835—in other words, the $50 for the power plus the cost of the air time to complete the transaction). In some circumstances, the total cost may be increased if there is a transactional cost in addition to the cost of goods and the cost of air time. For example, if the airtime is tied to a credit card, the credit card company may charge a transactional fee (e.g., 1% or more) for all transactions executed in connection with the credit card, in which case, the credit card may debit the purchaser's account an additional 1% of air time (by way of example) which the credit card company may utilize for internal purposes or may turn around and re-sell to another user.

Other embodiments and uses of the invention will be apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. All references cited herein, including all U.S. and foreign patents and patent applications, are specifically and entirely hereby incorporated by reference herein. It is intended that the specification and examples be considered exemplary only, with the true scope and spirit of the invention indicated by the claims below. As will be easily understood by those of ordinary skill in the art, variations and modifications of each of the disclosed embodiments can be easily made within the scope of this invention as defined by the claims below.

Claims

1. A process for transmitting a stream of data, comprising:

receiving a stream of data;

organizing the stream of data into a plurality of packets;

generating a packet watermark associated with the stream of data wherein the packet watermark indicates the integrity of at least one of the plurality of packets;

combining the packet watermark with each of the plurality of packets to form watermarked packets; and

transmitting at least one of the watermarked packets across a network.

2. The process of claim 1, further comprising:

receiving at least one packet that has been transmitted across a network;

analyzing the integrity of at least one packet using at least a portion of the packet watermark; and

in the event the analysis indicates integrity of the at least one packet, permitting the transmission of the at least one packet, and in the event that the analysis indicates tampering of the at least one packet, indicating a signal of tampering.

3. The process of claim 2, wherein the step of analyzing the integrity of the at least one packet is based on predetermined criteria selected from the group comprising: a quality or quantity of the stream of data, willingness to pay for the stream of data, pricing for the stream of data, access to the stream of data, differential quality of service, reputation or recognition of the stream of data, reputation or recognition of the origin of the stream of data, related packet flows, metadata or XML associated with a related stream of data, intrusion detection techniques, virus detection techniques, Ethernet IDs, port IDs, URLs, DNS addresses, a prior history, a logical context of the origin of the stream of data, or combinations thereof.

4. The process of claim 1, further comprising:

receiving at least one packet that has been transmitted across a network;

determining the integrity of a portion of the stream of data using at least a portion of the packet watermark; and

in the event the analysis indicates integrity of the portion of the stream of data, permitting the transmission of the stream of data, and in the event that the analysis indicates tampering of portion of the stream of data, indicating a signal of tampering.

5. The process of claim 4, wherein the step of determining the integrity of the portion of the stream of data is based on predetermined criteria selected from the group comprising: a quality or quantity of the stream of data, willingness to pay for the stream of data, pricing for the stream of data, access to the stream of data, differential quality of service, reputation or recognition of the stream of data, reputation or recognition of the origin of the stream of data, related packet flows, metadata or XML associated with a related stream of data, intrusion detection techniques, virus detection techniques, Ethernet IDs, port IDs, URLs, DNS addresses, a prior history, a logical context of the origin of the stream of data, or combinations thereof.

6. The process of claim 1, wherein the step of generating a packet watermark comprises:

generating a watermark packet key;

associating a unique identifier with the watermark packet key; and

generating a packet watermark comprising the unique identifier associated with the watermark packet key.

7. The process of claim 1, wherein the step of generating a packet watermark comprises:

generating a watermark packet key;

associating a unique identifier with the watermark packet key;

assigning a quality of service level to the stream of data; and

generating a packet watermark comprising:

the unique identifier associated with the watermark packet key; and

the quality of service level assigned to the stream of data.

8. The process of claim 1, wherein the step of generating a packet watermark comprises:

generating a watermark packet key;

associating a unique identifier with the watermark packet key;

assigning a quality of service level to the stream of data; and

generating a hash output for a portion of the stream of data; and

generating a packet watermark comprising:

the unique identifier associated with the watermark packet key;

the quality of service level assigned to the stream of data; and

the hash output for said portion of the stream of data.

9. The process of claim 1, further comprising:

receiving a plurality of packets that have been transmitted across a network; and

analyzing at least a predetermined minimal number of the plurality of packets for a packet watermark to authenticate each of the at least predetermined minimal number of packets using the packet watermark, wherein the predetermined minimal number is determined based on one of a quality of the stream of data being transmitted or a quantity of the stream of data being transmitted.

10. The process of claim 9, further comprising:

in the event that the analysis does not authenticate at least one of the plurality of packets, modifying the data being transmitted so that the data is either degraded in quality or degraded in quantity.

11. The process of claim 9, further comprising:

in the event that the analysis authenticates at least one of the plurality of packets, prioritizing the data being transmitted.

12. A system for provisioning content, comprising:

a processor to receive content and to organize the content into a plurality of packets;

a generator to generate at least one packet watermark associated with the content;

a packager to combine the generated packet watermark with at least one of the plurality of packets to form watermarked packets; and

a transmitter to transmit at least one of the watermarked packets across a network.

13. The system of claim 12, further comprising a router, which router comprises:

a network receiver to receive a packet that has been transmitted across a network; and

a network processor coupled to the network receiver for analyzing the packet for a packet watermark that can be used to provision the associated content.

14. The system of claim 13, wherein the network processor creates one of differential quality of service or uniquely identifiable packet flow.

15. The system of claim 12, wherein the content comprises a stream of data selected from the group comprising: aesthetic data; functional data; payment data, willingness to pay data; authenticated data; verified data, authorized data, reputation or recognition data; or combinations thereof.

16. The system of claim 12, wherein the module of the generator further generates a hash output for a portion of the content, and the packet watermark that is generated comprises the hash output for said portion of the content, the unique identifier associated with the watermark packet key, and the quality of service level associated with the content.

17. The system of claim 12, wherein the packet watermark is steganographic, cryptographic or both steganographic and cryptographic.

18. The system of claim 12, wherein the generated packet watermark is associated with the content based on a predetermined criteria selected from one of: identification, authentication, authorization, or data integrity of the associated content.

19. A method of packet watermarking data for transmission, comprising:

receiving content data;

organizing the content data into at least two packets;

generating at least a portion of a packet watermark associated with at least one of the packets of data said packet watermark being associated with authentication information; and

combining the at least one portion of a packet watermark, and the at least one packet of data, for transmission across a network.

20. The method of claim 19, further comprising:

generating a bandwidth rights certificate comprising:

at least one cryptographic credential; and routing information selected from the group consisting of authorization data to authorize use of at least one particular router and priority data to prioritize use of at least one particular router; and

combining the bandwidth rights certificate, the at least one portion of a packet watermark, and the at least one packet of data, for transmission across a network.

21. A computerized system for packet watermarking data for transmission to a user, comprising:

a receiver to receive content data;

computer code to organize the data into at least two packets;

computer code to generate a packet watermark associated with at least one of the packets of data said packet watermark being associated with authentication information; and

computer code to combine the bandwidth rights certificate, the packet watermark, and the at least one packet, for transmission across a network.

22. The system of claim 21, further comprising:

computer code to generate a bandwidth rights certificate comprising:

at least one cryptographic credential; and

routing information selected from the group consisting of authorization data to authorize use of at least one particular router and priority data to prioritize use of at least one particular router; and

computer code to combine the bandwidth rights certificate, the packet watermark, and the at least one packet, for transmission across a network.

23. The system of claim 21, wherein the system is configured to operate on a hardware device selected from the group consisting of: a personal computer, a cable box, a telephone, a cellular telephone, a personal digital assistant, a personal music playback device, and a smart card.

24. A system for secure data transmission, comprising:

a receiver to receive data;

a processor to organize the data into a plurality of packets;

a watermark generator to generate at least a portion of a packet watermark associated with at least one packet of data wherein the packet watermark is associated with verification information; and

a transmitter to transmit at least one of the plurality of data packets, and its associated packet watermark, across a network.

25. The system of claim 24, wherein the transmitter transmits, one at a time, across a network each of the plurality of data packets, together with its respective associated watermark, said system further comprising:

a network device to receive the transmitted packets, which network device reassembles the data, at least in part, in a prioritized manner, starting with those data packets that are perceptually significant, functionally significant, or both.

26. The system of claim 24, wherein the verification information verifies one of a source, origin, contents, destination or combinations thereof for the associated packet.