Reduced size key allocation descriptors

• US 10,616,190 B2
• Filed: 05/18/2016
• Issued: 04/07/2020
• Est. Priority Date: 05/18/2016
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Geagan, John B.
• Primary Examiner(s): Abyaneh, Ali S
• Application Number:
  US15/158,288
• Publication Number:
  US 20170338955A1
• Time in Patent Office: 1,420 Days
• CPC Class Codes: H04L 2209/601 Broadcast encryption
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 9/0836 using tree structure or hierarchical structure
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

Space-efficient methods of defining a key allocation scheme within a broadcast encryption system are provided. In some embodiments, a descriptor is received. The descriptor includes a plurality of subset definitions and a plurality of pointers. A data segment is resolved from each of the plurality of pointers. The resulting data segments are assembled into a plurality of variant definitions. A media key block is generated from the plurality of subset definitions and the plurality of variant definitions.

Claims

1. A method for key allocation in a broadcast encryption scheme, the method comprising:

receiving a descriptor selected from a plurality of descriptors, the descriptor comprising a plurality of subset definitions and a plurality of pointers, wherein each subset definition defines a subset difference tree of a broadcast encryption scheme, and wherein each of the plurality of pointers identifies a location in a predetermined table,

the predetermined table being shared among the plurality of descriptors,

wherein a total size of the plurality of descriptors is reduced by substituting the plurality of pointers for variant data in the descriptors;

from each of the plurality of pointers, resolving a data segment in the predetermined table;

assembling the resolved data segments into a plurality of variant definitions; and

generating a media key block from the plurality of subset definitions and the plurality of variant definitions.

2. The method of claim 1, wherein said resolving the data segment comprises:

looking up the data segment within a data source.

3. The method of claim 2, wherein the data source comprises a stream.

4. The method of claim 2, wherein the data source comprises a file.

5. The method of claim 2, wherein the data source comprises an array.

6. The method of claim 2, wherein the data source'"'"'s contents are pseudorandom.

7. The method of claim 1, wherein the variant definitions are all different from each other.

8. The method of claim 1, further comprising:

encrypting content such that an authorized device key in combination with the media key block is sufficient to decrypt the content.

9. A computer program product for key allocation in a broadcast encryption scheme, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to perform a method comprising:

receiving a descriptor selected from a plurality of descriptors, the descriptor comprising a plurality of subset definitions, and a plurality of pointers, wherein each subset definition defines a subset difference tree of a broadcast encryption scheme, and wherein each of the plurality of pointers identifies a location in a predetermined table

the predetermined table being shared among the plurality of descriptors,

wherein a total size of the plurality of descriptors is reduced by substituting the plurality of pointers for variant data in the descriptors;

from each of the plurality of pointers, resolving a data segment in the predetermined table;

assembling the resolved data segments into a plurality of variant definitions; and

generating a media key block from the plurality of subset definitions and the plurality of variant definitions.

10. The computer program product of claim 9, wherein said resolving the data segment comprises:

looking up the data segment within a data source.

11. The computer program product of claim 10, wherein the data source comprises a stream.

12. The computer program product of claim 10, wherein the data source comprises a file.

13. The computer program product of claim 10, wherein the data source comprises an array.

14. The computer program product of claim 10, wherein the data source'"'"'s contents are pseudorandom.

15. The computer program product of claim 9, wherein the variant definitions are all different from each other.

16. The computer program product of claim 9, wherein the method further comprises:

encrypting content such that an authorized device key in combination with the media key block is sufficient to decrypt the content.

17. A method comprising:

receiving a descriptor selected from a plurality of descriptors, the descriptor comprising;

(i) a plurality of row and column definitions and (ii) a plurality of pointers, wherein each pair of row and column definitions comprises data sufficient to define a sequence key block, and wherein each of the plurality of pointers identifies a location in a predetermined table,

the predetermined table being shared among the plurality of descriptors,

wherein a total size of the plurality of descriptors is reduced by substituting the plurality of pointers for variant data in the descriptors;

from each of the plurality of pointers, resolving a data segment in the predetermine table;

assembling the resolved data segments into a plurality of variant definitions;

generating a sequence key block from the plurality of row and column definitions and the plurality of variant definitions.

18. The method of claim 17, wherein said resolving the data segment comprises:

looking up the data segment within a data source.

19. The method of claim 18, wherein the data source'"'"'s contents are pseudorandom.

20. The method of claim 17, wherein the variant definitions are all different from each other.