DIGITAL RIGHTS MANAGEMENT SYSTEM TRANSFER OF CONTENT AND DISTRIBUTION

• US 20130268759A1
• Filed: 04/30/2012
• Published: 10/10/2013
• Est. Priority Date: 04/10/2012
• Status: Active Grant

• Current Assignee: JP Morgan Chase Bank, N.A. (JP Morgan Chase & Co)
• Original Assignee: Western Digital Technologies Incorporated (Western Digital Corporation)
• Inventors: BLANKENBECKLER, David L., Ybarra, Danny, Hesselink, Lambertus
• Granted Patent: US 8,914,634 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority

Abstract

The present invention relates to digital rights management (DRM) for content that may be downloaded and securely transferred from one storage to another storage. The storage may be a disk drive, or network attached storage. The storage performs cryptographic operations and provides a root of trust. The DRM system enables secure copying or transfer of content from one storage device to another storage device. In this embodiment, a trusted server that is authenticated and trusted by both storage devices brokers the transfer of content. The trusted server may be a separate entity of the DRM system or may be a component or function of an existing server of the DRM system. In another embodiment, the storage devices may transfer content in a peer-to-peer fashion. The transfer of content may be authorized and controlled based on a digital certificate associated with the content.

Claims

1. A first storage device configured to provide content to a player system for rendering of the content, wherein the content has been transferred by a trusted server from a second storage device, said first storage device comprising:

a storage medium comprising a user area that is accessible by the player system and a non-user area that is not accessible by the player system; and

a controller comprising a cryptographic module providing a hardware root of trust and a secured memory, wherein the controller is configured to authenticate the player system, establish a secured communication channel with the player system based on the authentication, provide, to the player system, a first cryptographic key, wherein the first cryptographic key is unique to the second storage device and based on a key that was concealed by the second storage device, provide, to the player system, a second cryptographic key that is associated with the content, and provide, to the player system, the content in encrypted form from the user area of the storage medium, wherein the content is accessible based on a cryptographic combination of the first cryptographic key and the second cryptographic key.

2. The first storage device of claim 1, wherein the controller is configured to authenticate the player system based on public key infrastructure.

3. The first storage device of claim 1, wherein the cryptographic module is configured to encrypt the first cryptographic key that is unique to the second storage device based on a key that is concealed by the cryptographic module.

4. The first storage device of claim 1, wherein the cryptographic module is configured to encrypt the first cryptographic key that is unique to the second storage device based on a key that is concealed by the cryptographic module.

5. A player system configured to play encrypted content transferred by a trusted server, said system comprising:

a first interface configured to communicate with a first storage device storing encrypted content, wherein the content was transferred by the trusted server to the first storage device from a second storage device; and

a processor configured to authenticate the first storage device, establish a secured communication channel with the first storage device via the first interface, receive, from the first storage device, a binding cryptographic key that is unique to the second storage device and based on a key that was concealed in the second storage device, receive, from the first storage device, a second cryptographic key that is associated with the content, determine an access key for the content based on a cryptographic combination of the binding cryptographic key and the second cryptographic key, receive, from the first storage device, the encrypted content, and decrypt the content based on the access key.

6. The player system of claim 5, wherein the processor is configured to mutually authenticate with the first storage device based on a public key infrastructure.

7. The player system of claim 5, wherein the processor is configured to determine authorization for playback of the content from the first storage based on a digital certificate.

8. The player system of claim 5, wherein the processor is configured to render the content into an audio format.

9. The player system of claim 5, wherein the processor is configured to render the content into a video format.

10. The player system of claim 5, further comprising an output interface for outputting the content to a display.

11. A method of enabling authorized transfer of content via a trusted server from a first storage to a second storage, said method comprising:

receiving a binding key that is unique to the first storage and binds the content to the first storage;

encrypting, by the second storage, the binding key based on a second concealed key that is concealed on the second storage;

storing the encrypted binding key in the secure area of the second storage;

receiving a first cryptographic key from the first storage;

encrypting, by the second storage, the first cryptographic key based on a second concealed key that is concealed on the second storage; and

storing the first cryptographic key in the secure area of the second device.

12. The method of claim 11, further comprising copying the encrypted content from the first storage to the second storage.

13. The method of claim 11, further comprising authorizing transfer of the content based on the received at least one digital certificate.

14. The method of claim 11, further comprising establishing a secured communication channel via the trusted server with the first storage.

15. The method of claim 11, further comprising receiving, from a trusted site, a digital certificate indicating that the content has been copied.

16. The method of claim 11, further comprising encrypting the digital certificate and storing the encrypted digital certificate in the secure area of the second storage.

17. The method of claim 11, wherein establishing the secured communication channel comprises authenticating the first storage via a host device.

18. The method of claim 11, wherein receiving a binding key that is unique to the first storage comprises receiving an ephemeral binding key that is generated based on a request by the second storage.

19. The method of claim 11, wherein the binding key is based on a first concealed key that is concealed on the first storage.

20. The method of claim 11, authorizing copying of the content based on at least one of a digital certificate or a permission specified in secure metadata of the content.