Method and apparatus for security in a data processing system

• US 20030039361A1
• Filed: 08/28/2002
• Published: 02/27/2003
• Est. Priority Date: 08/20/2001
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Rezaiifar, Ramin, Agashe, Parag A., Wang, Jun, Bender, Paul E., Quick, Roy Franklin Jr., Mahendran, Arungundram C., Rose, Gregory G., Hawkes, Philip Michael, Hsu, Raymond T.
• Granted Patent: US 7,185,362 B2
• Time in Patent Office: Days
• US Class Current: 380/278
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: H04L 12/189 in combination with wireless systems selective distribution or broadcast in wireless communication networks H04W4/06
• CPC Class Codes: H04L 2209/601 Broadcast encryption
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/26606 for generating or managing entitlement messages, e.g. Entitlement Control Message [ECM] or Entitlement Management Message [EMM] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/4623 Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/835 : Generation of protective data, e.g. certificates protecting software against unauthorised usage in a vending or licensing environment G06F21/10
• CPC Class Codes: H04N 7/1675 : Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58
• CPC Class Codes: H04W 12/02 : Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 : of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/0431 : Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/069 : using certificates or pre-shared keys
• CPC Class Codes: H04W 4/06 : Selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS]; Services to user groups; One-way selective calling services

Abstract

Method and apparatus for secure transmissions. Each user is provided a registration key. A long-time updated broadcast key is encrypted using the registration key and provided periodically to a user. A short-time updated key is encrypted using the broadcast key and provided periodically to a user. Broadcasts are then encrypted using the short-time key, wherein the user decrypts the broadcast message using the short-time key. One embodiment provides link layer content encryption. Another embodiment provides end-to-end encryption.

Claims

1. A method for encryption key management in a communication system supporting broadcast services, comprising:

requesting a root key for a remote station from a home network content provider;

applying an authentication procedure to distribute the root key to the remote station; and

storing the root key in a User Identification Module (UIM) of the remote station.

2. A method for encryption key management in a communication system supporting broadcast services, comprising:

storing a root key in a User Identification Module (UIM) of a remote station;

receiving an Encrypted Broadcast Access Key (EBAK) for a broadcast service;

decrypting the EBAK based on the root key.

3. The method as in claim 2, wherein the EBAK is encrypted using a Temporary Key (TK), the method further comprising:

receiving a random number associated with the Temporary Key (TK);

generating the TK from the random number using the root key;

decrypting the EBAK using the TK.

4. The method as in claim 3, wherein the EBAK is updated periodically and each EBAK has an associated BAK identifier,

wherein each EBAK has an associated TK and random number.

5. The method as in claim 2, wherein the EBAK is encrypted at a visited content server.

6. The method as in claim 5, wherein the TK and random number are generated by the home content server.

7. A method for encryption key management in a communication system supporting broadcast services, comprising:

receiving an encrypted Short term Key (SK), wherein the SK is encrypted using the a Broadcast Access Key (BAK);

decrypting the SK using the BAK.

8. A method for secure transmissions, the method comprising:

receiving a request for a secure transmission;

requesting a broadcast access key;

receiving an encrypted broadcast access key;

generating a short term key as a function of the broadcast access key; and

encrypting content for the secure transmission.