System for and method of authenticating a client

• US 5,784,464 A
• Filed: 01/31/1996
• Issued: 07/21/1998
• Est. Priority Date: 05/02/1995
• Status: Expired due to Term

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Akiyama, Ryota, Munakata, Akio, Koga, Yuzuru, Ishizaki, Masayuki
• Primary Examiner(s): Buczinski, Stephen C.
• Application Number:
  US08/594,895
• Time in Patent Office: 902 Days
• Field of Search: 380/21, 380/23, 380/24, 380/25, 395/187.01
• US Class Current: 713/155
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: H04H 60/15 on receiving information
• CPC Class Codes: H04H 60/23 using cryptography, e.g. encryption, authentication, key distribution
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04N 21/23895 involving multiplex stream encryption
• CPC Class Codes: H04N 21/25816 involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/25833 involving client hardware characteristics, e.g. manufacturer, processing or storage capabilities allocation of resources considering hardware capabilities in multiprogramming arrangements G06F9/5044; allocation of resources considering software capabilities in multiprogramming arrangements G06F9/5055
• CPC Class Codes: H04N 21/26613 for generating or managing keys in general key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04
• CPC Class Codes: H04N 21/4181 for conditional access
• CPC Class Codes: H04N 21/42684 Client identification by a unique number or address, e.g. serial number, MAC address, socket ID network arrangements, protocols or services for addressing or naming H04L61/00
• CPC Class Codes: H04N 21/43853 involving multiplex stream decryption arrangements using cryptography for the use of broadcast information or broadcast-related information H04H60/23
• CPC Class Codes: H04N 21/44204 Monitoring of content usage, e.g. the number of times a movie has been viewed, copied or the amount which has been watched monitoring of user activities for profile generation for accessing a video database G06F16/739; protecting generic digital content where the protection is independent of the precise nature of the content G06F21/10; arrangements for monitoring the use made of the broadcast services in broadcast systems H04H60/31
• CPC Class Codes: H04N 21/4623 Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/6118 involving cable transmission, e.g. using a cable modem
• CPC Class Codes: H04N 21/6143 involving transmission via a satellite
• CPC Class Codes: H04N 21/6187 involving transmission via a telephone network, e.g. POTS
• CPC Class Codes: H04N 21/63775 : for uploading keys, e.g. for a client to communicate its public key to the server key management H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 21/8352 : involving content or source identification data, e.g. Unique Material Identifier [UMID]
• CPC Class Codes: H04N 7/1675 : Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

A key management unit of a service provider system generates an individual key corresponding to a portable module connected to a service client making an access request and informs an authenticating unit of this individual key. The individual key is stored beforehand also in the portable module. A random-number generator generates a random number, transmits this random number to the portable module and informs the authenticating unit of it. The portable module encrypts the random number with the individual key and sends it back to the service provider system. An encrypting portion of the authenticating unit encrypts the random number with the individual key. A comparator of the authenticating unit compares data encrypted by the encrypting portion with encrypted data transmitted from the portable module and, if the two items of data are coincident with each other, confirms an access request from the portable module.

Claims

1. A system for authenticating a client in a data distributing system having a data supplying apparatus for holding data and a client receiving the data distributed via a communication interface from said data supplying apparatus, said data supplying apparatus comprising:

a key outputting unit for outputting a first key generated by processing identification data intrinsic to each said client;

random-number generating means for generating a random number in response to an access request from said client;

first encrypting means for encrypting the random number and the identification data with said first key and thereby outputting a first authenticator;

first transmitting means for transmitting the random number to said client;

first receiving means for receiving a second authenticator from said client; and

comparing means for comparing the first and second authenticators with each other and, if the two authenticators are coincident with each other, authenticating the access request from said client;

said client comprising;

identification data holding means for holding an identification data intrinsic to said client;

access requesting means for making an access request to said data supplying apparatus with said identification data;

second receiving means for receiving the random number transmitted from said data supplying apparatus;

key holding means for holding a second key identical with said first key;

second encrypting means for encrypting the random number and said identification data with the second key and thereby outputting the second authenticator; and

second transmitting means for transmitting the second authenticator to said data supplying apparatus.

2. A system for authenticating a client according to claim 1, wherein said data supplying apparatus distributes, only when said comparing means determines that the two authenticators are coincident with each other, the data to said client.

3. A system for authenticating a client according to claim 1, wherein said data supplying apparatus distributes the encrypted data to said client, and said client further comprises first decrypting means for decrypting the encrypted data.

4. A system for authenticating a client according to claim 3, wherein said data supplying apparatus further comprises third encrypting means for encrypting a third key by use of the first key for decrypting the data,

said client further comprising second decrypting means for decrypting the encrypted third key by use of the second key, and

said first decrypting means decrypts the encrypted data with the third key decrypted by said second decrypting means.

5. A system for authenticating a client according to claim 4, wherein said data supplying apparatus further includes;

a plurality of storage devices for storing the encrypted data;

third decrypting means for decrypting the encrypted data stored in said one storage device by use of the third key;

key updating means for updating the third key;

third encrypting means for encrypting the data decrypted by said third decrypting means by use of the third key updated by said key updating means; and

storing means for storing said other storage device with the data encrypted by said third encrypting means.

6. A system for authenticating a client according to claim 5, wherein said third decrypting means, said key updating means, said third encrypting means and said storing means are started at intervals of a fixed time.

7. A system for authenticating a client according to claim 1, wherein said client is constructed of a body unit for receiving the data and a module unit detachably attached to said body unit, and

said module unit includes at least said key holding means and said second encrypting means.

8. A method of authenticating a client in a data distributing system constructed of a data supplying apparatus for holding data and a client receiving the data transmitted via a communication interface from said data supplying apparatus, said method comprising the steps of:

causing said client to make an access request to said data supplying apparatus with an identification data for identifying said client itself informed to the apparatus;

causing said data supplying apparatus to generate a random number in response to the access request, transmit the random number to said client, encrypt the random number and said identification data by use of a first key generated by processing said identification data and convert the encrypted number into a first authenticator;

causing said client to encrypt the random number by use of a second key previously held as the one having the same content as that of the first key, convert the encrypted random number and said identification data into a second authenticator to said data supplying apparatus, and

causing said data supplying apparatus to compare the first authenticator with the second authenticator and, if the two authenticators are coincident with each other, authenticate that an access request is given from said client.