METHOD, CONTENT OWNER DEVICE, COMPUTER PROGRAM, AND COMPUTER PROGRAM PRODUCT FOR DISTRIBUTING CONTENT ITEMS TO AUTHORIZED USERS

• US 20160210443A1
• Filed: 02/27/2014
• Published: 07/21/2016
• Est. Priority Date: 08/29/2013
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: ARNGREN, Tommy, NSLUND, Mats
• Granted Patent: US 10,289,810 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/1012 to domains
• CPC Class Codes: G06F 21/1015 to users
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords

Abstract

Disclosed is, among other things, a method for distributing content items to authorized users. The method comprising: a content owner device (190), COD, obtaining a first content item (196a); the COD (190) obtaining a first tag associated with the first content item (196a); the COD (190) obtaining a first content key, CK1, for said first content item (196a); the COD (190) encrypting the first content item (196a) using CK1, thereby producing a first encrypted content item; the COD (190) using at least the first tag and a key derivation function, KDF, to derive a first derived key, DK1; the COD (190) encrypting CK1 using the DK1, thereby producing a first encrypted content key, ECK1; and the COD (190) transmitting information to a content server (108), the information comprising: the first encrypted content item and the first tag.

Claims

1. A method for distributing content items to authorized users, the method comprising:

a content owner device (COD) obtaining a first content item;

the COD obtaining a first tag associated with the first content item;

the COD obtaining a first content key, CK1, for said first content item;

the COD encrypting the first content item, using CK1, thereby producing a first encrypted content item;

the COD using at least the first tag and a key derivation function, (KDF) to derive a first derived key, DK1;

the COD encrypting CK1 using the DK1, thereby producing a first encrypted content key, ECK1; and

the COD transmitting information to a content server, the information comprising;

the first encrypted content item and the first tag.

2. The method of claim 1, wherein the COD uses at least the first tag, the key derivation function, and a master key to derive the first derived key, wherein the first tag comprises a keyword associated with the first content item.

3. The method of claim 1, further comprising:

the COD receiving from a user'"'"'s communication device a first content item identifier for identifying the first content item and a keyword;

the COD, in response to receiving the first content item identifier, determining whether or not the user is authorized to obtain the first content item identified by the first content item identifier; and

the COD in response to determining that the user is authorized to obtain the first content item, transmitting to the user'"'"'s communication device DK1.

4. The method of claim 3, wherein, in response to determining that the user is authorized to obtain the first content item, the COD i) derives DK1 using at least the master key, the KDF, and the keyword and ii) transmits DK1 to the user'"'"'s communication device after deriving DK1.

5. The method of claim 1, further comprising:

the COD receiving from a user'"'"'s communication device a first content item identifier for identifying the first content item and a keyword;

the COD, in response to receiving the first content item identifier, determining whether or not the user is authorized to obtain the first content item identified by the first content item identifier; and

the COD, in response to determining that the user is authorized to obtain the first content item, i) retrieving ECK1, ii) decrypting ECK1 using DK1, thereby producing CK1, and iii) transmitting to the user'"'"'s communication device CK1.

6. The method of claim 5, wherein, after retrieving ECK1 but prior to decrypting ECK1 using DK1, the COD derives DK1 using at least the master key, the KDF, and the keyword.

7. The method of claim 1, further comprising:

the communication device transmitting to the content server a content query;

the content server, in response to the query, transmitting to the communication device a search result satisfying the query, wherein the search result comprises an identifier identifying the first content item;

the communication device obtaining from the content server, by downloading or streaming, the first encrypted content item;

the communication device obtaining ECK1;

the communication device transmitting to the COD a message comprising the first tag;

the communication device receiving DK1 from the COD;

the communication device using DK1 to decrypt ECK1, thereby producing CK1; and

the communication device using the produced CK1 to decrypt the first encrypted content item.

8. The method of claim 5, further comprising:

the communication device transmitting to the content server a content query;

the content server, in response to the query, transmitting to the communication device a search result satisfying the query, wherein the search result comprises an identifier identifying the first content item;

the communication device obtaining from the content server, by downloading or streaming, the first encrypted content item;

the communication device transmitting to the COD a message comprising the first tag;

the communication device receiving from the COD a response message sent by the COD in response to said message, said response comprising CK1; and

the communication device using CK1 received in the response message to decrypt the first encrypted content item.

9. The method of claim 1, further comprising:

the COD obtaining a second tag associated with the first content item;

the COD deriving a second derived key (DK2) using at least the first content item identifier, a master key, the second tag, and the key derivation function; and

the COD encrypting CK1 using the DK2, thereby producing a second encrypted content key, ECK2, wherein

the information transmitted to the content server further comprises the second tag.

10. The method of claim 9, further comprising:

the COD receiving from a second communication device the first content item identifier and the second tag;

the COD, in response to receiving the first content item identifier and the second tag, determining whether or not a user of the second communication device is authorized to obtain the first content item associated with the first content item identifier; and

the COD, in response to determining that the user is authorized to obtain the first content item, transmitting to the user'"'"'s communication device at least one of DK2 and CK1.

11. A content owner device (COD) for distributing content items to authorized users, the COD comprising a processor and a computer readable medium (CRM), said CRM containing computer readable instructions executable by said processor whereby said COD is operative to:

obtain a first content item;

obtain a first tag associated with the first content item;

obtain a first content key, CK1, for said first content item;

encrypt the first content item using CK1, thereby producing a first encrypted content item;

use at least the first tag and a key derivation function to derive a first derived key, DK1;

encrypt CK1 using the DK1, thereby producing a first encrypted content key, ECK1; and

transmit information to the content server, the information comprising;

the first encrypted content item and the first tag.

12. The COD of claim 11, wherein the COD is further operative to use at least the first tag, the first key derivation function, and a master key to derive the first derived key, wherein the first tag comprises a keyword associated with the first content item.

13. The COD of claim 11, wherein the COD is further operative to:

receive from a user'"'"'s communication device a first content item identifier identifying the first content item;

in response to receiving the first content item identifier, determine whether or not the user is authorized to obtain the first content item identified by the first content item identifier; and

in response to determining that the user is authorized to obtain the first content item, transmit to the user'"'"'s communication device at least one of DK1 and CK1.

14. The COD of claim 13, wherein the COD is further operative such that, in response to determining that the user is authorized to obtain the first content item, the COD i) derives DK1 using at least the master key and the first tag and ii) transmits DK1 to the user'"'"'s communication device after deriving DK1.

15. The COD of claim 11, wherein the COD is further operative to:

receive from a user'"'"'s communication device a first content item identifier identifying the first content item;

determine whether or not the user is authorized to obtain the first content item identified by the first content item identifier in response to receiving the first content item identifier; and

in response to determining that the user is authorized to obtain the first content item, i) retrieve ECK1, ii) decrypt ECK1 using DK1, thereby producing CK1, and iii) transmit to the user'"'"'s communication device DK1.

16. The COD of claim 15, wherein the COD is configured such that, after retrieving ECK1 but prior to decrypting ECK1 using DK1, the COD is operative to derive DK1 using at least the master key and the first tag.

17. The COD of claim 11, wherein the COD is further operative to:

obtain a second tag associated with the first content item;

derive a second derived key (DK2) using at least the first content item identifier, a master key, the second tag, and the key derivation function; and

encrypt CK1 using the DK2, thereby producing a second encrypted content key, ECK2, wherein

the information transmitted to the content server further comprises the second tag.

18. The COD of claim 17, wherein the COD is further operative to:

receive from a second communication device the first content item identifier and the second tag;

determine whether or not a user of the second communication device is authorized to obtain the first content item associated with the first content item identifier in response to receiving the first content item identifier and the second tag; and

transmit to the user'"'"'s communication device least one of DK2 and CK1 in response to determining that the user is authorized to obtain the first content item.

19. A computer program product comprising a non-transitory computer readable medium storing computer readable instructions which when run on a content owner device (COD) causes the to:

obtain a first content item;

obtain a first tag associated with the first content item;

obtain a first content key, CK1, for said first content item;

encrypt the first content item using CK1, thereby producing a first encrypted content item;

use at least the first tag and a key derivation function to derive a first derived key, DK1;

encrypt CK1 using the DK1, thereby producing a first encrypted content key, ECK1; and

transmit information to the content server, the information comprising;

the first encrypted content item and the first tag.

20. The computer program product of claim 19, wherein the computer readable instructions comprises instructions configured to configure the COD such that, in response to the COD receiving from a user'"'"'s communication device a first content item identifier for identifying the first content item and a keyword, the COD determines whether or not the user is authorized to obtain the first content item identified by the first content item identifier.

21. A content owner device (COD) for distributing content items to authorized users, the COD comprising:

a transmitter;

a memory; and

a processor coupled to the memory and the transmitter, wherein the COD is configured to;

obtain a first tag associated with a first content item;

obtain a first content key, CK1, for said first content item;

encrypt the first content item using CK1, thereby producing a first encrypted content item;

use at least the first tag and a key derivation function to derive a first derived key, DK1;

encrypt CK1 using the DK1, thereby producing a first encrypted content key, ECK1; and

employ the transmitter to transmit information to the content server, the information comprising;

the first encrypted content item and the first tag.