Key management system for digital content player

• US 6,398,245 B1
• Filed: 12/01/1998
• Issued: 06/04/2002
• Est. Priority Date: 08/13/1998
• Status: Expired due to Term

• Current Assignee: Sandpiper CDN, LLC (Theseus LF Asset Holdings, LLC)
• Original Assignee: International Business Machines Corporation
• Inventors: Lotspiech, Jeffrey B., Gruse, George Gregory, Milsted, Kenneth Louis, Hurtado, Marco M.
• Primary Examiner(s): Trammell, James P.
• Assistant Examiner(s): Elisca, Pierre E.
• Application Number:
  US09/203,307
• Time in Patent Office: 1,281 Days
• Field of Search: 705/1, 705/71, 705/59, 705/64, 380/4, 380/24, 380/25, 380/21, 380/3, 380/49, 380/23, 380/45, 380/203, 380/228, 713/200, 713/201, 713/202, 713/176, 340/825.31, 340/825.34
• US Class Current: 280/228
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 30/0617 Representative agent
• CPC Class Codes: G06Q 30/0623 Item investigation
• CPC Class Codes: G06Q 30/0633 Lists, e.g. purchase orders, compilation or processing
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services

Abstract

A method of managing keys used by a digital content player on a computer system. According to the method, digital content data encrypted with a first encrypting key is decrypted using a first decrypting key, and re-encrypted using a second encrypting key. A second decrypting key is encrypted using a third encrypting key to produce an encrypted second decrypting key. In one preferred method, an encrypted first decrypting key that was encrypted using a fourth encrypting key is received, and the encrypted first decrypting key is decrypted using a fourth decrypting key to reproduce the first decrypting key. A digital content player for use on a computer system is also provided. The content player includes a decrypter that decrypts digital content data, which was encrypted with a first encrypting key, using a first decrypting key so as to produce the content data. An encrypter re-encrypts the content data using a second encrypting key and encrypts a second decrypting key using a third encrypting key. In one preferred content player, a receiver receives an encrypted first decrypting key that was encrypted using a fourth encrypting key, and the decrypter decrypts the encrypted first decrypting key using a fourth decrypting key to reproduce the first decrypting key.

Claims

1. A method of managing keys used by a digital content player on a user system, said method comprising the steps of:

decrypting encrypted digital content data using a first decrypting key to produce content data, the encrypted content data having been produced by encrypting the content data with a first encrypting key;

re-encrypting the content data using a second encrypting key; and

encrypting a second decrypting key using a third encrypting key to produce an encrypted second decrypting key on the user system;

removing the non-encrypted second decrypting key from the user system; and

breaking a third decrypting key into multiple segments and storing each segment separately on the user system.

wherein the first decrypting key is used to decrypt data that has been encrypted with the first encrypting key, the second decrypting key is used to decrypt data that has been encrypted with the second encrypting key, and the third decrypting key is used to decrypt data that has been encrypted with the third encrypting key.

2. The method as defined in claim 1, further comprising the steps of:

receiving an encrypted first decrypting key, the first decrypting key having been encrypted using a fourth encrypting key to produce the encrypted first decrypting key; and

decrypting the encrypted first decrypting key using a fourth decrypting key to reproduce the first decrypting key.

3. The method as defined in claim 2, further comprising the step of removing the first decrypting key from the user system.

4. The method as defined in claim 2, wherein the step of re-encrypting the content data includes the sub-steps of:

watermarking the content data to produce watermarked content data; and

re-encrypting the watermarked content data using the second encrypting key.

5. The method as defined in claim 2, wherein the step of receiving an encrypted first decrypting key includes the sub-steps of:

transferring the first decrypting key, which has been encrypted with a fifth encrypting key, to a site that possesses a fifth decrypting key; and

receiving the encrypted first decrypting key after it has been decrypted using the fifth decrypting key and then re-encrypted using the fourth encrypting key.

6. The method as defined in claim 5, further comprising the steps of:

creating the third encrypting key and a third decrypting key;

creating the fourth encrypting key and the fourth decrypting key; and

receiving the first decrypting key after it has been encrypted with the fifth encrypting key.

7. The method as defined in claim 5, wherein the fifth encrypting key is a public key and the fifth decrypting key is a corresponding private key.

8. The method as defined in claim 2, further comprising the step of receiving the encrypted digital content data.

9. The method as defined in claim 2, wherein the first encrypting key and the first decrypting key are symmetric keys.

10. The method as defined in claim 9, wherein the second encrypting key and the second decrypting key are symmetric keys.

11. The method as defined in claim 10, wherein the third encrypting key and a third decrypting key are symmetric keys.

12. The method as defined in claim 11, wherein the fourth encrypting key is a public key and the fourth decrypting key is a corresponding private key.

13. The method as defined in claim 1, further comprising the step of removing the first decrypting key from the user system.

14. The method as defined in claim 1,

wherein the content data includes music data, and

the steps of decrypting, re-encrypting, and encrypting are performed for each separate selection of music data.

15. The method as defined in claim 1, wherein the steps of decrypting, re-encrypting, and encrypting are performed in a tamper-resistant environment in order to deter unauthorized access to the first decrypting key and the non-encrypted second decrypting key.

16. The method as defined in claim 1, wherein the steps of decrypting, re-encrypting, and encrypting are performed by the user system.

17. A method of managing keys used by a digital content player on a computer system, said method comprising the steps of:

creating a first encrypting key and a first decrypting key;

creating a second encrypting key and a second decrypting key;

receiving an encrypted third decrypting key, a third decrypting key having been encrypted with a fourth encrypting key to produce the encrypted third decrypting key;

transferring the encrypted third decrypting key to a site that possesses a fourth decrypting key;

receiving a re-encrypted third decrypting key, the encrypted third decrypting key having been decrypted using the fourth decrypting key and then re-encrypted using the first encrypting key to produce the re-encrypted third decrypting key;

receiving the digital content data, the digital content data having been encrypted with a third encrypting key;

decrypting the re-encrypted third decrypting key using the first decrypting key to reproduce the third decrypting key;

decrypting the content data using the third decrypting key to produce decrypted content data;

watermarking the decrypted content data to produce watermarked content data;

creating a fifth encrypting key and a fifth decrypting key;

encrypting the watermarked content data using the fifth encrypting key;

encrypting the fifth decrypting key using the second encrypting key to produce an encrypted fifth decrypting key;

removing the third decrypting key and the non-encrypted fifth decrypting key from the computer system; and

breaking the second decrypting key into multiple segments and storing each segment separately on the computer system,

wherein the first decrypting key is used to decrypt data that has been encrypted with the first encrypting key, the second decrypting key is used to decrypt data that has been encrypted with the second encrypting key, the third decrypting key is used to decrypt data that has been encrypted with the third encrypting key, the fourth decrypting key is used to decrypt data that has been encrypted with the fourth encrypting key, and the fifth decrypting key is used to decrypt data that has been encrypted with the fifth encrypting key.

18. A computer-readable medium encoded with a program for managing keys used by a digital content player on a user system, said program containing instructions for performing the steps of:

decrypting encrypted digital content data using a first decrypting key to produce content data, the encrypted content data having been produced by encrypting the content data with a first encrypting key;

re-encrypting the content data using a second encrypting key; and

encrypting a second decrypting key using a third encrypting key to produce an encrypted second decrypting key on the user system;

removing the non-encrypted second decrypting key from the user system; and

breaking a third decrypting key into multiple segments and storing each segment separately on the user system,

wherein the first decrypting key is used to decrypt data that has been encrypted with the first encrypting key, the second decrypting key is used to decrypt data that has been encrypted with the second encrypting key, and the third decrypting key is used to decrypt data that has been encrypted with the third encrypting key.

19. The computer-readable medium encoded with a program for managing keys used by a digital content player as defined in claim 18, wherein said program further contains instructions for performing the steps of:

receiving an encrypted first decrypting key, the first decrypting key having been encrypted using a fourth encrypting key to produce the encrypted first decrypting key; and

decrypting the encrypted first decrypting key using a fourth decrypting key to reproduce the first decrypting key.

20. The computer-readable medium encoded with a program for managing keys used by a digital content player as defined in claim 19, wherein said program further contains instructions for performing the step of removing the first decrypting key from the user system.

21. The computer-readable medium encoded with a program for managing keys used by a digital content player as defined in claim 19, wherein the step of re-encrypting the content data includes the sub-steps of:

watermarking the content data to produce watermarked content data; and

re-encrypting the watermarked content data using the second encrypting key.

22. The computer-readable medium encoded with a program for managing keys used by a digital content player as defined in claim 19, wherein the step of receiving an encrypted first decrypting key includes the sub-steps of:

transferring the first decrypting key, which has been encrypted with a fifth encrypting key, to a site that possesses a fifth decrypting key; and

receiving the encrypted first decrypting key after it has been decrypted using the fifth decrypting key and then re-encrypted using the fourth encrypting key.

23. The computer-readable medium encoded with a program for managing keys used by a digital content player as defined in claim 22, wherein said program further contains instructions for performing the step of:

receiving the first decrypting key after it has been encrypted with the fifth encrypting key,

wherein the fifth encrypting key is a public key and the fifth decrypting key is a corresponding private key.

24. The computer-readable medium encoded with a program for managing keys used by a digital content player as defined in claim 19, wherein said program further contains instructions for performing the step of receiving the encrypted digital content data.

25. The computer-readable medium encoded with a program for managing keys used by a digital content player as defined in claim 19,

wherein the first encrypting key and the first decrypting key are symmetric keys, and

the second encrypting key and the second decrypting key are symmetric keys.

26. The computer-readable medium encoded with a program for managing keys used by a digital content player as defined in claim 25,

wherein the third encrypting key and a third decrypting key are symmetric keys, and

the fourth encrypting key is a public key and the fourth decrypting key is a corresponding private key.

27. The computer-readable medium encoded with a program for managing keys used by a digital content player as defined in claim 18,

wherein the content data includes music data, and

the steps of decrypting, re-encrypting, and encrypting are performed for each separate selection of music data.

28. The computer-readable medium encoded with a program for managing keys used by a digital content player as defined in claim 18, wherein the steps of decrypting, re-encrypting, and encrypting are performed in a tamper-resistant environment in order to deter unauthorized access to the first decrypting key and the non-encrypted second decrypting key.

29. A digital content player for use on a user system, said digital content player comprising:

a decrypter that decrypts encrypted digital content data using a first decrypting key so as to produce content data, the encrypted content data having been produced by encrypting the content data with a first encrypting key; and

an encrypter that re-encrypts the content data using a second encrypting key, that encrypts a second decrypting key using a third encrypting key to produce an encrypted second decrypting key on the user system, that removes the non-encrypted second decrypting key from the user system, and that breaks a third decrypting key into multiple segments and stores each segment separately on the user system,

wherein the first decrypting key is used to decrypt data that has been encrypted with the first encrypting key, the second decrypting key is used to decrypt data that has been encrypted with the second encrypting key, and the third decrypting key is used to decrypt data that has been encrypted with the third encrypting key.

30. The digital content player as defined in claim 29, further comprising:

a receiver that receives an encrypted first decrypting key, the first decrypting key having been encrypted using a fourth encrypting key to produce the encrypted first decrypting key,

wherein the decrypter decrypts the encrypted first decrypting key using a fourth decrypting key to reproduce the first decrypting key.

31. The digital content player as defined in claim 30, wherein the decrypter removes the first decrypting key from the user system.

32. The digital content player as defined in claim 30, wherein the encrypter watermarks the content data before re-encrypting it using the second encrypting key.

33. The digital content player as defined in claim 30, further comprising:

a transmitter that transfers the first decrypting key, which has been encrypted with a fifth encrypting key, to a site that possesses a fifth decrypting key,

wherein the receiver receives the encrypted first decrypting key after it has been decrypted using the fifth decrypting key and then re-encrypted using the fourth encrypting key.

34. The digital content player as defined in claim 33,

wherein the receiver receives the first decrypting key after it has been encrypted with the fifth encrypting key, and

the fifth encrypting key is a public key and the fifth decrypting key is a corresponding private key.

35. The digital content player as defined in claim 30, wherein the receiver receives the encrypted digital content data.

36. The digital content player as defined in claim 30,

wherein the first encrypting key and the first decrypting key are symmetric keys, and

the second encrypting key and the second decrypting key are symmetric keys.

37. The digital content player as defined in claim 36,

wherein the third encrypting key and a third decrypting key are symmetric keys, and

the fourth encrypting key is a public key and the fourth decrypting key is a corresponding private key.

38. The digital content player as defined in claim 29,

wherein the content data includes music data, and

for each separate selection of music data, the decrypter operates to decrypt the encrypted content data, and the encrypter operates to re-encrypt the content data and encrypt the second decrypting key.

39. The digital content player as defined in claim 29, wherein the decrypter and encrypter operate in a tamper-resistant environment in order to deter unauthorized access to the first decrypting key and the non-encrypted second decrypting key.

40. A method of managing keys used by a digital content player on a user system, said method comprising the steps of:

decrypting encrypted digital content data using a first decrypting key to produce content data, the encrypted content data having been produced by encrypting the content data with a first encrypting key;

re-encrypting the content data using a second encrypting key;

encrypting a second decrypting key using a third key to produce an encrypted second decrypting key; and

storing the third key on the user system,

wherein the third key is a secret symmetric key that exists only on the user system, and the first decrypting key is used to decrypt data that has been encrypted with the first encrypting key, and the second decrypting key is used to decrypt data that has been encrypted with the second encrypting key.

41. A method of managing keys used by a digital content player on a computer system, said method comprising the steps of:

decrypting encrypted digital content data using a first decrypting key to produce content data, the encrypted content data having been produced by encrypting the content data with a first encrypting key using a first encryption algorithm;

re-encrypting the content data using a second encrypting key and a second encryption algorithm, which is different than the first encryption algorithm; and

encrypting a second decrypting key using a third encrypting key to produce an encrypted second decrypting key,

wherein the first decrypting key is used to decrypt data that has been encrypted with the first encrypting key, and the second decrypting key is used to decrypt data that has been encrypted with the second encrypting key.

42. The method as defined in claim 41, wherein the second encryption algorithm is SEAL.

43. The method as defined in claim 41, wherein the second encryption algorithm is a stream cipher and the first encryption algorithm is a block cipher.

44. A digital content player comprising:

a decrypter that decrypts encrypted digital content data using a first decrypting key so as to produce content data, the encrypted content data having been produced by encrypting the content data with a first encrypting key using a first encryption algorithm;

an encrypter that re-encrypts the content data using a second encrypting key and a second encryption algorithm, which is different than the first encryption algorithm, and that encrypts a second decrypting key using a third key to produce an encrypted second decrypting key; and

storage that stores the third key,

wherein the third key is a secret symmetric key that exists only within the digital content player, and

the first decrypting key is used to decrypt data that has been encrypted with the first encrypting key, and the second decrypting key is used to decrypt data that has been encrypted with the second encrypting key.

45. A digital content player for use on a computer system, said digital content player comprising:

a decrypter that decrypts encrypted digital content data using a first decrypting key so as to produce content data, the encrypted content data having been produced by encrypting the content data with a first encrypting key using a first encryption algorithm; and

an encrypter that re-encrypts the content data using a second encrypting key and a second encryption algorithm, which is different than the first encryption algorithm, and that encrypts a second decrypting key using a third encrypting key to produce an encrypted second decrypting key,

wherein the first decrypting key is used to decrypt data that has been encrypted with the first encrypting key, and the second decrypting key is used to decrypt data that has been encrypted with the second encrypting key.

46. The digital content player as defined in claim 45, wherein the second encryption algorithm is a stream cipher and the first encryption algorithm is a block cipher.