TECHNIQUE FOR SECURELY COMMUNICATING AND STORING PROGRAMMING MATERIAL IN A TRUSTED DOMAIN

• US 20160182461A1
• Filed: 07/02/2015
• Published: 06/23/2016
• Est. Priority Date: 07/20/2004
• Status: Active Grant

• Current Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Original Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Inventors: Helms, William, Hayashi, Michael T., Leddy, Kevin J., Christman, David A.
• Granted Patent: US 10,178,072 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/26613 for generating or managing keys in general key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/6334 for authorisation, e.g. by transmitting a key wireless communications network key management H04W12/04; wireless communications network access security H04W12/08
• CPC Class Codes: H04N 21/63775 for uploading keys, e.g. for a client to communicate its public key to the server key management H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

A “trusted domain” is established within which content received from a communications network, e.g., a cable TV network, is protected from unauthorized copying thereof, in accordance with the invention. In an illustrative embodiment, the trusted domain includes a device associated with a user which receives content from the cable TV network. The content may be encrypted using a content key in accordance, e.g., with a 3DES encryption algorithm before it is stored in the device. In addition, a first encrypted content key version and a second encrypted content key version are generated by respectively encrypting the content key with a public key associated with the device and another public key associated with the user, in accordance with public key cryptography. The first and second encrypted content key versions are stored in association with the encrypted content in the device storage. The encrypted content can be migrated from a first device to a second device, and can be decrypted in the second device in the second device is associated with the same user, and also provided with the second encrypted content key version.

Claims

1-49. -49. (canceled)

50. Apparatus to securely transmit content to a device in a network, said apparatus comprising:

an interface configured to connect to said network;

a memory comprising an encrypted content file;

a processor configured to execute at least one computer program, said at least one computer program comprising a plurality of instructions which are configured to, when executed, cause said apparatus to;

receive a request from said device for a copy of said encrypted content file, said request comprising a public key of said device;

retrieve a first encrypted content key from said memory;

retrieve a private key associated with said apparatus from said memory;

decrypt said first encrypted content key to reveal said content key;

encrypt said content key with said public key of said device to form said second encrypted content key; and

transmit said second encrypted content key and said copy of said encrypted content file to said device.

51. The apparatus of claim 50 wherein said network comprises a home network within a home of a user.

52. The apparatus of claim 50 wherein said plurality of instructions are further configured to, when executed, cause said apparatus to, in response to said request, identify said encrypted content file in said memory.

53. The apparatus of claim 50 wherein said device is configured to decrypt said second encrypted content key with a second private key associated with said device to form said content key.

54. The apparatus of claim 53 wherein said content key is configured to decrypt said encrypted content file.

55. The apparatus of claim 54 wherein:

said encrypted content file is encrypted via a symmetrical cipher technique;

said content key comprising a key of said symmetrical cipher technique; and

said public key and said second private key comprising a public-private key pair according to a public key encryption technique.

56. The apparatus of claim 50 wherein said secure transmission does not involve a distribution network headend or a separate control access management device.

57. A method for use in an apparatus for decrypting encrypted content in a device remote from said apparatus, said encrypted content in said device being decrypted using a content key, said method comprising:

receiving from said device a first encrypted content key;

searching a database for a first cryptographic element which is associated with a user of said device;

using said first cryptographic element to decrypt said first encrypted content key, thereby recovering said content key;

using a second cryptographic element which is associated with said device to encrypt said recovered content key, thereby generating a second encrypted content key; and

providing said second encrypted content key to said device where said content key is recoverable based on at least said second encrypted content key.

58. The method of claim 57 wherein said first cryptographic element is identified based on data representative of said user of said device.

59. The method of claim 58 wherein said data includes an identity of said user.

60. The method of claim 57 wherein said content key includes a secret key in accordance with a Data Encryption Standard (DES) technique.

61. The method of claim 57 wherein said first cryptographic element includes an encryption key in accordance with a public key algorithm.

62. The method of claim 57 wherein said second cryptographic element includes an encryption key in accordance with a public key algorithm.

63. The method of claim 57 wherein said content includes entertainment programming content.

64. A computer-readable apparatus comprising media configured to store a computer program thereon, said computer program comprising a plurality of instructions which are configured to, when executed by a processor:

receive from a device remote from an apparatus configured to decrypt encrypted content a first encrypted content key;

search a database for a first cryptographic element which is associated with a user of said device;

use said first cryptographic element to decrypt said first encrypted content key, and therefore recover a content key configured to decrypt said encrypted content;

use a second cryptographic element which is associated with said device to encrypt said recovered content key, and therefore generate a second encrypted content key; and

provide said second encrypted content key to said device where said content key is recoverable based on at least said second encrypted content key.

65. The computer-readable apparatus of claim 64, wherein said plurality of instructions are further configured to determine that said user of said device and said device are associated with a shared subscriber account.

66. The computer-readable apparatus of claim 64 wherein said first cryptographic element is identified based on data representative of said user of said device.

67. The computer-readable apparatus of claim 66 wherein said data includes an identity of said user.

68. The computer-readable apparatus of claim 64 wherein said first cryptographic element includes an encryption key in accordance with a public key algorithm.

69. The computer-readable apparatus of claim 64 wherein said encrypted content comprises programming content and configured to be viewable on a plurality of devices in communication with a network established by said user.