PLATFORM-HARDENED DIGITAL RIGHTS MANAGEMENT KEY PROVISIONING

• US 20140173756A1
• Filed: 12/19/2012
• Published: 06/19/2014
• Est. Priority Date: 12/19/2012
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Chhabra, Siddhartha, Lal, Reshma
• Granted Patent: US 9,009,854 B2
• Time in Patent Office: Days
• US Class Current: 726/29
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Abstract

Embodiments of an invention for platform-hardened digital rights management key provisioning are disclosed. In one embodiment, a processor includes an execution unit to execute one or more instructions to create a secure enclave in which to run an application to receive digital rights management information from a provisioning server in response to authentication of the application by a verification server.

Claims

1. A processor comprising:

an execution unit to execute one or more instructions to create a secure enclave in which to run an application to receive digital rights management information from a provisioning server in response to authentication of the application by a verification server.

2. The processor of claim 1, wherein the digital rights management information includes a Digital Transmission Content Protection key.

3. The processor of claim 1, wherein the authentication involves an Enhanced Protection ID algorithm.

4. A method comprising:

initiating a client in a secure enclave;

requesting, by the client, digital rights management (DRM) provisioning information from a provisioning server;

requesting, by the client, authentication by a verification server;

providing, by the client, proof of authentication to the provisioning server; and

receiving, by the client, the DRM provisioning information.

5. The method of claim 4, wherein the digital rights management information includes a Digital Transmission Content Protection key.

6. The method of claim 4, wherein the authentication involves an Enhanced Protection ID algorithm.

7. The method of claim 4, further comprising sealing the DRM provisioning information to the secure enclave.

8. The method of claim 7, further comprising storing the sealed DRM provisioning information in a non-volatile memory.

9. The method of claim 4, further comprising generating, by the client, an identity report.

10. The method of claim 9, further comprising signing, by the client using an Enhanced Protection ID (EPID) private key, the identity report.

11. The method of claim 10, wherein requesting authentication includes sending the signed identity report to the verification server.

12. The method of claim 11, further comprising receiving, by the client from the verification server, proof of authentication, wherein the authentication involves verifying the signed identity report.

13. The method of claim 12, wherein verifying the signed identity report uses an EPID public key corresponding to the EPID private key.

14. The method of claim 4, further comprising receiving, by the client from the provisioning server, a first key component.

15. The method of claim 14, further comprising generating, by the client, a second key component.

16. The method of claim 15, further comprising sending, by the client to the provisioning server, the second key component.

17. The method of claim 16, further comprising generating, by the client, a shared secret key.

18. The method of claim 17, further comprising decrypting, by the client, the DRM provisioning information using the shared secret key.

19. A system comprising:

a processor having an execution unit to execute one or more instructions to create a secure enclave in which to run an application to receive digital rights management information from a provisioning server in response to authentication of the application by a verification server; and

a nonvolatile memory in which to store the digital rights management information.

20. The system of claim 19 wherein the digital rights management information includes a Digital Transmission Content Protection key.