Method, apparatus and system for use in distributed and parallel decryption

• US 20050074125A1
• Filed: 08/18/2004
• Published: 04/07/2005
• Est. Priority Date: 10/03/2003
• Status: Active Grant

• Current Assignee: Sony Corporation (Sony Group Corp.), Sony Electronics Inc. (Sony Group Corp.)
• Original Assignee: Sony Corporation (Sony Group Corp.), Sony Electronics Inc. (Sony Group Corp.)
• Inventors: Chavanne, Pierre, Kawamoto, Yoji, Swenson, Eric, Steele, Oscar
• Granted Patent: US 8,103,004 B2
• Time in Patent Office: Days
• US Class Current: 380/278
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

The present embodiments advantageously provide methods and systems for use in decrypting content, and in some preferred embodiments expanding a security environment to distribute the computational processing involved in decryption. In some embodiments, a method for use in decrypting content is provided that receives a first content key at a first system for the decryption of a first track of encrypted content; encrypts the first content key according to a first instance key known at the first system; communicates the first encrypted content key over an externally accessible communication link to a second system; generates the first instance key at the second system independent of the first system; decrypts the first encrypted content key using the generated first instance key at the second system; and decrypts the first track of encrypted content using the first unencrypted content key at the second system.

Claims

1. A method for use in decrypting content, comprising:

receiving a first content key at a first system for the decryption of a first track of encrypted content;

encrypting the first content key according to a first instance key known at the first system producing a first encrypted content key;

communicating the first encrypted content key over an externally accessible communication link to a second system;

generating the first instance key at the second system independent of the first system;

decrypting the first encrypted content key using the generated first instance key at the second system providing a first unencrypted content key; and

decrypting the first track of encrypted content using the first unencrypted content key at the second system.

2. The method of claim 1, wherein the generating the first instance key at the second system comprises generating the first instance key at the second system according to a first value of a second key generation indicator and a master key known at the second system.

3. The method of claim 1, further comprising:

simultaneously decrypting a second track of encrypted content using a second unencrypted content key at the second system while decrypting the first track of encrypted content using the first unencrypted content key at the second system.

4. The method of claim 3, further comprising:

receiving a second content key at the first system for the decryption of the second track of encrypted content;

encrypting the second content key according to the first instance key known at the first system producing a second encrypted content key;

communicating the second encrypted content key over the communication link to the second system;

decrypting the second encrypted content key using the generated first instance key at the second system providing the second unencrypted content key; and

implementing the decrypting of the second track of encrypted content using the second unencrypted content key at the second system.

5. The method of claim 1, further comprising:

renewing the first system including receiving a second instance key;

encrypting a third content key at the first system according to the second instance key producing a third encrypted content key;

communicating the third encrypted content key over the communication link to the second system;

notifying the second system of the renewing of the first system;

generating the second instance key at the second system independent of the first system;

decrypting the third encrypted content key using the generated second instance key at the second system providing a second unencrypted content key; and

decrypting of a third track of encrypted content using the third unencrypted content key at the second system.

6. The method of claim 5, further comprising:

preventing the use of the first instance key following the generation of the second instance key at the second system.

7. The method of claim 5, wherein the notifying the second system of the renewing of the first system comprises communicating a first key generation indicator to the second system where a first value of the first key generator is different than a first value of the second key generation indicator.

8. The method of claim 1, further comprising:

determining that a first time period has expired; and

preventing the decryption at the second system with the first unencrypted content key of a remaining portion of the first track that is still encrypted when the first time period has expired.

9. The method of claim 8, wherein the communicating the first encrypted content key further comprises communicating a first lifetime of the first content key such that the determining that the first time period has expired comprises determining the first lifetime of the first content key has expired;

and

communicating a second lifetime of the first content key to the second system such that the second system again allows decryption at the second system with the first unencrypted content key of at least some of the remaining portion of the first track that was unencrypted when the first time period expired.

10. A method for use in decrypting content, comprising:

receiving a first encrypted content key, wherein the first encrypted content key is encrypted by an external system using a first instance key;

generating the first instance key independent of the external system;

decrypting the first encrypted content key using the first generated instance key;

extracting a first content key through the decryption of the first encrypted content key; and

decrypting a first track of encrypted content with the first content key.

11. The method of claim 10, further comprising:

receiving a second encrypted content key, wherein the second encrypted content key is encrypted by the external system using the first instance key;

decrypting the second encrypted content key using the first generated instance key;

extracting a second content key through the decryption of the second encrypted content key; and

simultaneously decrypting a second track of encrypted content with the second content key while decrypting the first track of the encrypted content with the first content key.

12. The method of claim 10, further comprising:

receiving a first count from the external system;

determining whether a second internal count matches the first count; and

generating a second instance key independent of the external system when the second count does not match the first count and preventing further decryption with the first instance key.

13. A system comprising:

a main system coupled with a network to receive a first content key;

a sub-system;

a communication link coupled between the main system and sub-systems;

the main system comprising a first instance key and an encryption circuit such that the encryption circuit encrypts the first content key with the first instance key to produce a first encrypted content key, and the main system communicates the first encrypted content key to the sub-system over the communication link; and

the sub-system comprises a first slot, a decryption circuit coupled with the first slot, and an instance key generator coupled with the decryption circuit, such that the sub-system stores the first encrypted content key in the first slot, the instance key generator generates a first generated instance key independent of the main system such that the first generated instance key is substantially identical to the first instance key of the main system, and the decryption circuit decrypts first encrypted content key with the first generated instance key retrieving the unencrypted first content key and decrypts at least a portion of a first track of encrypted content using the unencrypted first content key.

14. The system of claim 13, wherein the sub-system further comprises a master key, wherein the instance key generator utilizes the master key to generate the first generated instance key.

15. The system of claim 14, wherein the sub-system further comprises a counter that generates a first count such that the instance key generator utilizes the combination of the master key and the first count to generate the first generated instance key.

16. The system of claim 15, wherein the communication link is a user accessible bus.

17. The system of claim 13, wherein the sub-system further comprises a digital signal processor coupled with the decryption circuit, wherein the digital signal processor receives the decrypted first content from the decryption circuit and renders the first content from the sub-system.

18. The system of claim 13, wherein the sub-system further comprises a second slot such that the sub-system stores a second encrypted content key in the second slot, the instance key generator generates a second generated instance key independent of the main system, and the decryption circuit decrypts second encrypted content key with the second generated instance key retrieving the unencrypted second content key and decrypts at least a portion of a second track of encrypted content using the unencrypted second content key.

19. The system of claim 13, wherein the main system further receives a second instance key replacing the first instance key, and further receives a second content key, such that the encryption circuit encrypts the second content key with the second instance key to produce an second encrypted content key, and the main system communicates the second encrypted content key to the sub-system over the communication link;

and

the instance key generator generates a second generated instance key independent of the main system such that the second generated instance key is substantially identical to the second instance key of the main system, and the decryption circuit decrypts the second encrypted content key with the second generated instance key retrieving the unencrypted second content key and decrypts second encrypted content using the unencrypted second content key.

20. The system of claim 19, wherein the decryption circuit prevents further decryption using the generated first instance key following the generation of the generated second instance key.