Secure Application Processing Systems and Methods

• US 20150215293A1
• Filed: 01/29/2015
• Published: 07/30/2015
• Est. Priority Date: 01/29/2014
• Status: Active Grant

• Current Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Original Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Inventors: BOCCON-GIBOD, Gilles, CHAVANNE, Pierre, ELLISON, Gary
• Granted Patent: US 10,419,400 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Abstract

Systems and methods are described for securely and efficiently processing electronic content. In one embodiment, a first application running on a first computing system establishes a secure channel with a second computing system, the secure channel being secured by one or more cryptographic session keys. The first application obtains a license from the second computing system via the secure channel, the license being encrypted using at least one of the one or more cryptographic session keys, the license comprising a content decryption key, the content decryption key being further encrypted using at least one of the one or more cryptographic session keys or one or more keys derived therefrom. The first application invokes a second application to decrypt the license using at least one of the one or more cryptographic session keys, and further invokes the second application to decrypt the content decryption key using at least one of the one or more cryptographic session keys or one or more keys derived therefrom, and to decrypt a piece of content using the content decryption key. The first application then provides access to the decrypted piece of content in accordance with the license.

Claims

1. A method performed by a first application running on a first computing system, the method comprising:

establishing a secure channel with a second computing system, the secure channel being secured by one or more cryptographic session keys;

obtaining a license from the second computing system via the secure channel, the license being encrypted using at least in part one of the one or more cryptographic session keys, the license comprising a content decryption key, the content decryption key being further encrypted using at least one of the one or more cryptographic session keys or one or more keys derived therefrom;

invoking a second application to decrypt the license using at least one of the one or more cryptographic session keys;

invoking the second application to decrypt the content decryption key using at least one of the one or more cryptographic session keys or one or more keys derived therefrom, and to decrypt a piece of content using the content decryption key; and

providing access to the piece of content.

2. The method of claim 1, in which establishing a secure channel with the second computing system comprises invoking a secure key box running on the first computing system to obtain information for transmission to the second computing system.

3. The method of claim 1, in which the second application is running on the first computer system.

4. The method of claim 1, in which the second application comprises a secure key box application accessible to the first application via an application programming interface.

5. The method of claim 1, in which the second application comprises a firmware application running on a secure processing unit.

6. The method of claim 1, in which the first application comprises a digital rights management engine for governing access to the piece of content in accordance with the license.