Method and system to securely distribute content via a network

• US 20030161473A1
• Filed: 12/16/2002
• Published: 08/28/2003
• Est. Priority Date: 06/16/2000
• Status: Active Grant

• Current Assignee: MIH Technology Holdings BV
• Original Assignee: Entriq Incorporated
• Inventors: Fransdonk, Robert W.
• Granted Patent: US 6,993,137 B2
• Time in Patent Office: Days
• US Class Current: 380/277
• CPC Class Codes: G06F 21/1013 to locations
• CPC Class Codes: G06F 21/107 License processing; Key processing
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/612 for unicast
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04N 1/32144 embedded in the image data, i.e. enclosed or integrated in the image, e.g. watermark, super-imposed logo or stamp
• CPC Class Codes: H04N 2201/3233 of authentication information, e.g. digital signature, watermark

Abstract

A method and system to distribute encrypted content via a network commences when a content provider generates a set of session keys and encrypts content with the set of session keys. The content provider communicates the set of session keys to a content distributor, which generates a set of encrypted session keys by encrypting the set of session keys with a user key. The content distributor transmits the encrypted content and the encrypted session keys to a content destination. The content distributor also transmits the user key to the content destination, allowing the content destination to decrypt the set of session keys with the user key, and thereby use the set of decrypted session keys to decrypt the content. In a further embodiment of the invention, the session keys are a time-varying sequence of session keys.

Claims

1. A method to distribute content via a network, the method including:

at a content provider, generating a set of session keys and encrypting content utilizing the set of session keys to generate encrypted content;

communicating the set of session keys to a content distributor;

at the content distributor, encrypting the set of session keys utilizing a user key to generate a set of encrypted keys;

transmitting the encrypted content to a content destination;

transmitting the set of encrypted keys from the content distributor to the content destination;

transmitting the user key from the content distributor to the content destination so as to enable the content destination to decrypt the set of encrypted keys to extract the set of session keys; and

at the content destination, utilizing the set of session keys to decrypt the encrypted content.

2. The method of claim 1 wherein the set of session keys comprises a time-varying sequence of session keys.

3. The method of claim 1 wherein the communication of the set of session keys to the content distributor includes:

at the content provider, encrypting the set of session keys utilizing a product key to generate a set of master encrypted keys;

communicating the set of master encrypted keys from the content provider to the content distributor;

communicating the product key from the content provider to the content distributor; and

at the content distributor, decrypting the set of master encrypted keys utilizing the product key to extract the set of session keys.

4. The method of claim 3 wherein the product key is encrypted with a public key of the content distributor prior to communication of the product key from the content provider to the content distributor so that the public key is only available to the content distributor.

5. The method of claim 1 including receiving, from the content destination and at the content distributor, a request to deliver of the content to the content destination.

6. The method of claim 5 including receiving, from the content destination and at the content distributor, a user certificate in association with the request.

7. The method of claim 5 including receiving, from the content destination and at the content distributor, a copy-protected device certificate in association with the request.

8. The method of claim 3 including, at the content distributor, generating a request for access criteria and the product key, and communicating the request for the access criteria to the content provider.

9. The method of claim 8 including, at the content provider attaching a signature of the content provider to the access criteria and the product key to cryptographically bind the access criteria with the product key, and communicating the signature, the access criteria and the product key to the content distributor.

10. The method of claim 9 including, at the content provider, encrypting the product key with a public key of the content distributor prior to communication of the product key to the content distributor.

11. The method of claim 10 including, at the content distributor, verifying the signature of the content provider, and decrypting the product key utilizing a private key of the content distributor, the product key being utilized to decrypt the set of master encrypted keys to extract the set of session keys.

12. The method of claim 1 including issuing, from the content distributor to the content destination, a request for user secure device information.

13. The method of claim 12 including issuing, from the content distributor to the content provider, a request for subscription information.

14. The method of claim 13 including constructing, at the content distributor, an order request for the content based on the secure device information, the access criteria and the subscription information and communicating the order request from the content distributor to the content destination for acceptance.

15. The method of claim 14 wherein the order request includes a signature of the content distributor, and wherein the user process verifies the signature of the content distributor.

16. The method of claim 15 wherein the content destination generates an order, signs the order utilizing a user signature and communicates the order to the content distributor.

17. The method of claim 16 wherein the content distributor, responsive to receipt of the order, verifies access criteria and the user signature within a physically secure environment.

18. The method of claim 1 wherein the content distributor creates a secure network session with the content destination, creates the user key, encrypts the user key with a public key of the content destination, and communicates the encrypted user key to the content destination utilizing secure network session.

19. The method of claim 18 wherein the content destination decrypts the encrypted user key utilizing a private key associated with the content destination to extract the user key for a purpose of decrypting the set of encrypted keys.

20. A system to distribute content via a network, the system including:

a content distributor coupled, via the network, to a content provider and to a content destination;

the content provider operating to generate a set of session keys, encrypt content utilizing the set of session keys, and to communicate the set of session keys to the content distributor;

the content distributor operating to encrypt the set of session keys utilizing a user key to generate a set of encrypted keys, to transmit the set of encrypted keys to the content destination, and to transmit the user key from the content distributor to the content destination so as to enable the content destination to decrypt the set of encrypted keys to extract the set of session keys; and

the content destination operating to utilize the set of session keys to decrypt the encrypted content.

21. The system of claim 20 wherein the set of session keys comprises a time-varying sequence of session keys.

22. The system of claim 20 wherein the content provider is to encrypt the set of session keys utilizing a product key to generate a set of master encrypted keys, to communicate the set of master encrypted keys from the content provider to the content distributor, and to communicate the product key from the content provider to the content distributor;

and wherein the content distributor is to decrypt the set of master encrypted keys utilizing the product key to extract the set of session keys.

23. The system of claim 22 wherein the product key is encrypted with a public key of the content distributor prior to communication of the product key from the content provider to the content distributor so that the public key is only available to the content distributor.

24. The system of claim 20 wherein the content distributor is to receive a request for delivery of the content to the content destination.

25. The system of claim 24 wherein the content distributor is to receive a user certificate in association with the request.

26. The system of claim 24 wherein the content distributor is to receive a copy-protected device certificate in association with the request.

27. The system of claim 22 wherein the content distributor is to generate a request for access criteria and the product key, and to communicate the request for the access criteria to the content provider.

28. The system of claim 27 wherein the content provider is to attach a signature of the content provider to the access criteria and the product key to cryptographically bind the access criteria with the product key, and to communicate the signature, the access criteria and the product key to the content distributor.

29. The system of claim 28 wherein the content provider is to encrypt the product key with a public key of the content distributor prior to communication of the product key to the content distributor.

30. The system of claim 28 wherein the content distributor is to verify the signature of the content provider, and to decrypt the product key utilizing a private key of the content distributor, the product key being utilized to decrypt the set of master encrypted keys to extract the set of session keys.

31. The system of claim 20 wherein the content distributor is to issue, to the content destination, a request for user secure device information.

32. The system of claim 31 wherein the content distributor is to issue, to the content provider, a request for subscription information.

33. The system of claim 32 wherein the content distributor is to construct an order request for the content based on the secure device information, the access criteria and the subscription information and to communicate the order request from the content distributor to the content destination for acceptance.

34. The system of claim 33 wherein the order request includes a signature of the content distributor, and wherein the user process verifies the signature of the content distributor.

35. The system of claim 34 wherein the content destination is to generate an order, to sign the order utilizing a user signature and to communicate the order to the content distributor.

36. The system of claim 35 wherein the content distributor, responsive to receipt of the order, is to verify access criteria and the user signature within a physically secure environment.

37. The system of claim 20 wherein the content distributor is to create a secure network session with the content destination, to create the user key, to encrypt the user key with a public key of the content destination, and to communicate the encrypted user key to the content destination utilizing secure network session.

38. The system of claim 37 wherein the content destination is to decrypt the encrypted user key utilizing a private key associated with the content destination to extract the user key for a purpose of decrypting the set of encrypted keys.

39. A system to distribute content via a network, the system including:

content distributor means coupled, via the network, to a content provider means and to a content destination means;

the content provider means operating to generate a set of session keys, encrypt content utilizing the set of session keys, and to communicate the set of session keys to the content distributor means;

the content distributor means operating to encrypt the set of session keys utilizing a user key to generate a set of encrypted keys, to transmit the set of encrypted keys to the content destination means, and to transmit the user key from the content distributor means to the content destination means so as to enable the content destination means to decrypt the set of encrypted keys to extract the set of session keys; and

the content destination means operating to utilize the set of session keys to decrypt the encrypted content.

40. A machine-readable medium storing a sequence of instructions that, when executed by a machine, cause the machine to perform a method to distribute content via a network, the method including:

at a content provider, generating a set of session keys and encrypting content utilizing the set of session keys to generate encrypted content;

communicating the set of session keys to a content distributor;

at the content distributor, encrypting the set of session keys utilizing a user key to generate a set of encrypted keys;

transmitting the encrypted content to a content destination;

transmitting the set of encrypted keys from the content distributor to the content destination;

transmitting the user key from the content distributor to the content destination so as to enable the content destination to decrypt the set of encrypted keys to extract the set of session keys; and

at the content destination, utilizing the set of session keys to decrypt the encrypted content.