Apparatus, method and computer program product for protecting copyright data within a computer system

• US 6,236,727 B1
• Filed: 06/24/1997
• Issued: 05/22/2001
• Est. Priority Date: 06/24/1997
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Urda, John William, Lam, Wai Man, Ciacelli, Mark Louis, Kouloheris, Jack Lawrence, Fetkovich, John Edward
• Primary Examiner(s): Swann, Tod R.
• Assistant Examiner(s): JACK, TODD M
• Application Number:
  US08/881,139
• Time in Patent Office: 1,428 Days
• Field of Search: 380/3, 380/4, 380/49, 380/5, 380/10, 369/84
• US Class Current: 380/212
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G11B 20/00086 Circuits for prevention of unauthorised reproduction or copying, e.g. piracy indicating unauthorised use of record carriers in general G11B23/28; scrambling for television signal recording H04N5/913; network architectures or network protocols for network security H04L63/00; cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
• CPC Class Codes: G11B 20/0021 involving encryption or decryption of contents recorded on or reproduced from a record carrier
• CPC Class Codes: G11B 20/00224 wherein the key is obtained from a remote server
• CPC Class Codes: G11B 20/00449 content scrambling system [CSS]
• CPC Class Codes: G11B 20/00478 wherein contents are decrypted and re-encrypted with a different key when being copied from/to a record carrier
• CPC Class Codes: G11B 20/00507 wherein consecutive physical data units of the record carrier are encrypted with separate encryption keys, e.g. the key changes on a cluster or sector basis
• CPC Class Codes: H04N 21/4408 involving video stream encryption, e.g. re-encrypting a decrypted video stream for redistribution in a home network

Abstract

Apparatus, method and computer program product are provided for digitally processing an encrypted data stream scrambled, for example, according to content scrambling system (CSS) technology. This digital processing insures against communication of clear data within the computer system from a central processing unit (CPU) to any accessible structure, such as memory or a system bus. Descrambling of the (CSS) scrambled data stream occurs within a module executing on the CPU, which is followed by reencryption of the data prior to transfer from the CPU. By so processing the data, integrity of copyrighted material is maintained, while allowing for software descrambling of the CSS encrypted data stream. Various techniques for establishing the encryption/decryption algorithm pair employed are described. Decryption of the re-encrypted data can occur at a receiving software module and/or a receiving hardware device, such as a decoder.

Claims

1. Apparatus for processing a scrambled data stream within a computer system having a central processing unit (CPU) coupled to receive the scrambled data stream, comprising:

descrambling means within the central processing unit for descrambling the received, scrambled data stream to produce a clear data stream;

re-encryption means within the central processing unit for re-encrypting the clear data stream to produce an encrypted data stream, wherein said scrambled data stream is produced from a different encryption algorithm than said encrypted data stream;

means for transferring the encrypted data stream from the central processing unit to a second structure of the computer system, said second structure being coupled to the CPU; and

decryption means coupled to the second structure for receiving the encrypted data stream therefrom and for decrypting the encrypted data stream to produce said clear data stream, wherein said clear data stream is unexposed when transferred from the central processing unit to said second structure coupled to the CPU, while said descrambling means within the central processing unit accomplishes descrambling of the received scrambled data stream.

2. The apparatus of claim 1, wherein said scrambled data stream comprises a scrambled, encoded data stream and wherein said apparatus further comprises a decoder coupled to said decryption means for decoding a clear, encoded data stream produced by said decryption means.

3. The apparatus of claim 2, wherein said clear, encoded data stream comprises a video data stream and wherein said decoder comprises an MPEG video decoder.

4. The apparatus of claim 2, wherein said scrambled, encoded data stream comprises a CSS scrambled, MPEG encoded data stream, and wherein said descrambling means comprises means for CSS descrambling the scrambled, encoded data stream within the CPU and said decoder comprises means for MPEG decoding said clear, encoded data stream.

5. The apparatus of claim 2, wherein said decoder comprises a decoding hardware device and said decryption means resides within said decoding hardware device.

6. The apparatus of claim 1, wherein said reencryption means further comprises means for providing a key for use in re-encrypting the clear data stream, and wherein said decryption means includes means for employing the key in decrypting the encrypted data stream.

7. The apparatus of claim 6, wherein said reencryption means further comprises means for encrypting said key to produce an encrypted key, and for multiplexing the encrypted key and the encrypted data stream into a multiplexed data stream for transfer to said second structure coupled to the CPU, and wherein said decryption means further comprises means for demultiplexing said multiplexed data stream to obtain said encrypted key and said encrypted data stream, and wherein said decryption means further comprises means for decrypting said encrypted key.

8. The apparatus of claim 1, further comprising means for selecting an encryption/decryption algorithm pair for use by said re-encryption means and said decryption means.

9. The apparatus of claim 8, wherein said means for selecting comprises means for downloading a decryption algorithm of said selected encryption/decryption algorithm pair from said reencryption means to said decryption means, said means for downloading including means for encrypting the decryption algorithm for transfer between the reencryption means and the decryption means.

10. The apparatus of claim 8, wherein said means for selecting comprises means for selecting said encryption/decryption algorithm pair from a plurality of encryption/decryption algorithm pairs at said re-encryption means and said decryption means, and wherein said means for selecting comprises means for noticing the decryption means which decryption algorithm of said plurality of encryption/decryption algorithm pairs corresponds with an encryption algorithm employed by said re-encryption means.

11. The apparatus of claim 1, wherein said decryption means comprises a decryption module disposed within the central processing unit, and said second structure coupled to the CPU comprises memory.

12. Apparatus for processing a data stream within a computer system having a central processing unit (CPU) coupled to receive the data stream, said apparatus comprising:

encryption means within the CPU for encrypting identified copyright data within the data stream to produce therefrom encrypted data;

means for transferring the encrypted data from the central processing unit to a structure of the computer system coupled thereto, wherein said copyright data is only transferred from the central processing unit as said encrypted data; and

decryption means coupled to said structure receiving the encrypted data, said decryption means comprising means for decrypting the encrypted data.

13. The apparatus of claim 12, further comprising means for identifying within the central processing unit said copyright data of the data stream, said means for identifying providing said identified copyright data to said encryption means.

14. The apparatus of claim 13, wherein the data stream comprises a scrambled, encoded data stream, and wherein said apparatus further comprises descrambling means for descrambling the scrambled, encoded data stream within the central processing unit to produce a clear, encoded data stream, and wherein said means for identifying comprises means for examining the clear, encoded data stream to identify copyright data for encryption by said encryption means.

15. The apparatus of claim 12, wherein said decryption means comprises a microcode decryption device.

16. The apparatus of claim 12, wherein said data stream comprises a scrambled data stream, and wherein said apparatus further comprises means for descrambling the scrambled data stream prior to said encrypting of the identified copyright data by said encryption means, wherein said scrambled data stream is produced from a different encryption algorithm than said encrypted data produced by said encryption means.

17. The apparatus of claim 12, wherein said encryption means further comprises means for providing a key for use in said encrypting of the identified copyright data and for use by said decryption means for decrypting the encrypted data.

18. The apparatus of claim 17, wherein said encryption means further comprises means for encrypting said key to produce an encrypted key, and for multiplexing the encrypted key and the encrypted data into a multiplexed data stream for transfer to said structure coupled to the CPU, and wherein said decryption means further comprises means for demultiplexing said multiplexed data stream to obtain said encrypted key and said encrypted data, and wherein said decryption means further comprises means for decrypting said encrypted key.

19. The apparatus of claim 12, further comprising means for selecting an encryption/decryption algorithm pair for use by said encryption means and said decryption means from a plurality of predefined encryption/decryption algorithm pairs, said selected encryption/decryption algorithm pair comprising an encryption algorithm and a corresponding decryption algorithm, said encryption algorithm being employed by said encryption means, and said corresponding decryption algorithm being employed by said decryption means.

20. A method for processing a scrambled data stream within a computer system having a central processing unit and a structure coupled thereto, said method comprising:

(a) receiving the scrambled data stream at the central processing unit (CPU);

(b) descrambling the scrambled data stream within a module executing on the central processing unit to produce clear data;

(c) re-encrypting the clear data within the central processing unit, said re-encrypting producing at least partially encrypted data;

(d) subsequent to said re-encrypting, transferring the at least partially encrypted data from the central processing unit to a second structure of the computer system, said second structure being coupled to the central processing unit; and

(e) subsequent to said transferring, retrieving and decrypting the at least partially encrypted data to produce clear data, wherein said clear data is unexposed when transferred from the central processing unit to the structure coupled thereto, while said descrambling occurs within the module executing on the central processing unit, and wherein the scrambled data stream is produced from a different encryption algorithm than employed by said re-encrypting (c) to produce said at least partially encrypted data.

21. The method of claim 20, wherein the scrambled data stream comprises a scrambled, encoded data stream, and wherein said decrypting (e) comprises producing clear, encoded data, and wherein said method further comprises decoding said clear, encoded data to produce said clear data.

22. The method of claim 21, wherein said scrambled, encoded data stream comprises a CSS scrambled, MPEG encoded data stream, and wherein said descrambling (b) comprises CSS descrambling said scrambled, encoded data stream within the CPU, and said decoding comprises MPEG decoding said clear, encoded data to produce said clear data.

23. The method of claim 20, wherein said reencrypting (c) includes employing a key in reencrypting the clear data, and wherein said method further comprises providing said key for said decrypting (e), said decrypting employing said key in decrypting the at least partially encrypted data.

24. The method of claim 23, wherein said reencrypting (c) includes encrypting said key to produce an encrypted key, and multiplexing the encrypted key and the at least partially encrypted data into a multiplexed data stream, and wherein said decrypting (e) further comprises demultiplexing said multiplexed data stream to obtain said encrypted key and said at least partially encrypted data, and said decrypting (e) further comprises decrypting said encrypted key and employing said key in decrypting said at least partially encrypted data.

25. The method of claim 20, further comprising selecting an encryption/decryption algorithm pair for use by said re-encrypting (c) and said decrypting (e), said selecting comprising choosing said selected encryption/decryption algorithm pair from a plurality of predefined encryption/decryption algorithm pairs.

26. The method of claim 25, wherein said reencrypting (c) accomplishes said selecting and said re-encrypting further comprises downloading a decryption algorithm of the selected encryption/decryption algorithm pair for use by said decrypting (e).

27. The method of claim 20, wherein said decrypting (e) comprises decrypting the at least partially encrypted data within the central processing unit, and wherein said structure coupled to the central processing unit comprises a memory structure, said retrieving (e) comprising retrieving said at least partially encrypted data from said memory structure.

28. A method for processing a data stream within a computer system having a central processing unit and a structure outside the central processing unit coupled thereto, said method comprising:

(a) receiving the data stream at the central processing unit (CPU);

(b) encrypting identified copyright data within the data stream to produce encrypted data;

(c) subsequent to said encrypting (b), transferring the encrypted data from the central processing unit to the structure coupled thereto, wherein said copyright data is only transferred from the central processing unit as said encrypted data; and

(d) retrieving the encrypted data from the structure coupled to the CPU and decrypting the encrypted data to produce clear data, said decrypting occurring after transfer of the encrypted data to the structure outside the central processing unit, wherein said clear data is unexposed within the computer system when transferred between the central processing unit and the structure coupled thereto.

29. The method of claim 28, further comprising identifying within the central processing unit said copyright data of the data stream for use by said encrypting (b).

30. The method of claim 29, wherein said data stream comprises a scrambled data stream, and said method further comprises descrambling the scrambled data stream prior to said identifying of the copyright data, and wherein said scrambled data stream is produced from a different encryption algorithm than employed by said encrypting (b).

31. The method of claim 28, wherein said encrypting (b) includes employing a key in encrypting said identified copyright data and providing said key to said decrypting (d).

32. The method of claim 31, wherein said encrypting (b) further comprises encrypting said key to produce an encrypted key, and multiplexing the encrypted key and the encrypted data into a multiplexed data stream for transfer to said structure coupled to the CPU, and wherein said decrypting (d) further comprises demultiplexing said multiplexed data stream to obtain said encrypted key and said encrypted data, and wherein said decrypting (d) further comprises decrypting said encrypted key for use in decrypting said encrypted data.

33. The method of claim 28, further comprising selecting an encryption/decryption algorithm pair from a plurality of predefined encryption/decryption algorithm pairs, and wherein said encrypting (b) comprises employing an encryption algorithm of said selected encryption/decryption algorithm pair in encrypting said identified copyright data, and said decrypting (d) comprises employing a corresponding decryption algorithm of said selected encryption/decryption algorithm pair for use in decrypting the encrypted data.

34. A computer program producing comprising a computer usable medium having computer readable program code means therein for use in processing a scrambled data stream within a computer system having a central processing unit and a structure coupled thereto, said computer readable program code means in said computer program product comprising:

computer readable program code means for causing a computer to affect receiving of the scrambled data stream at the central processing unit and for descrambling the scrambled data stream within the central processing unit to produce clear data, and for re-encrypting the clear data within the central processing unit to produce at least partially encrypted data;

computer readable program code means for causing a computer to affect transferring of said at least partially encrypted data from the central processing unit to the structure coupled thereto; and

computer readable program code means for causing a computer to affect retrieving of the at least partially encrypted data from the structure coupled to the CPU and for decrypting the at least partially encrypted data, said decrypting producing clear data, wherein said clear data is unexposed when transferred from the central processing unit to the structure coupled thereto, while said descrambling occurs within the central processing unit.

35. The computer readable program code means of claim 34, wherein the scrambled data stream comprises a scrambled, encoded data stream, and wherein said computer readable program code means in said computer program product further comprises computer readable program code means for causing a computer to affect decoding of clear, encoded data produced by said computer readable program code means for decrypting the at least partially encrypted data.

36. The computer readable program code means of claim 35, wherein said scrambled, encoded data stream comprises a CSS scrambled, MPEG encoded data stream and wherein said computer readable code means for descrambling said scrambled, encoded data stream comprises computer readable program code means for causing a computer to affect CSS descrambling of the scrambled, encoded data stream, and wherein said computer readable program code means for decoding comprises computer readable program code means for causing a computer to affect MPEG decoding of said clear, encoded data stream.

37. A computer program product comprising a computer useable medium having computer readable program code means therein for use in processing a data stream within a computer system having a central processing unit and a structure outside the central processing unit coupled thereto, said computer readable program code means in said computer program product comprising:

computer readable program code means for causing a computer to affect receiving of the data stream at the central processing unit and encrypting of identified copyright data within the data stream to produce encrypted data;

computer readable program code means for causing a computer to affect transferring of the encrypted data from the central processing unit to the structure outside the central processing unit; and

computer readable program code means for causing a computer to affect retrieving and decrypting of the encrypted data after transfer to the structure outside the central processing unit, wherein clear data is unexposed within the computer system when transferred between the central processing unit and the structure coupled thereto.

38. The computer readable program code means of claim 37, further comprising computer readable program code means for causing a computer to affect identifying said copyright data of the data stream for encrypting.

39. The computer readable program code means of claim 37, wherein said computer readable program code means for encrypting the identified copyright data includes computer readable program code means for causing a computer to affect said encrypting using a key and for providing said key to said computer readable program code means for decrypting the encrypted data.

40. The computer readable program code means of claim 39, wherein said computer readable program code means for encrypting comprises computer readable program code means for causing a computer to affect encrypting of said key to produce an encrypted key, and for multiplexing the encrypted key and the encrypted data into a multiplexed data stream for transfer to said structure coupled to the CPU, and wherein said computer readable program code means for decrypting comprises computer readable program code means for causing a computer to affect demultiplexing of the multiplexed data stream to obtain said encrypted key and said encrypted data, and for decrypting the encrypted key for use in decrypting the encrypted data.

41. The computer readable program code means of claim 37, further comprising computer readable program code means for causing a computer to affect selecting an encryption/decryption algorithm pair for use in encrypting said identified copyright data and decrypting said encrypted data, said selected encryption/decryption algorithm pair being selected from a plurality of predefined encryption/decryption algorithm pairs, and further comprising computer readable program code means for causing a computer to affect noticing of a corresponding decryption algorithm of the selected encryption/decryption algorithm pair to said computer readable program code means for decrypting the encrypted data.