Digital video content transmission ciphering and deciphering method and apparatus

• US 6,477,252 B1
• Filed: 08/29/1999
• Issued: 11/05/2002
• Est. Priority Date: 08/29/1999
• Status: Expired due to Term

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Faber, Robert W., Graunke, Gary L., Traw, Brendan S., Lee, David A.
• Primary Examiner(s): Hayes, Gail
• Assistant Examiner(s): SONG, HOSUK
• Application Number:
  US09/385,590
• Time in Patent Office: 1,164 Days
• Field of Search: 380/200-203, 380/211, 380/229, 380/44, 380/259-261, 380/268, 380/37, 380/42, 380/46, 713/171, 713/193, 705/56
• US Class Current: 380/200
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G11B 20/00086 Circuits for prevention of unauthorised reproduction or copying, e.g. piracy indicating unauthorised use of record carriers in general G11B23/28; scrambling for television signal recording H04N5/913; network architectures or network protocols for network security H04L63/00; cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
• CPC Class Codes: H04K 1/00 Secret communication
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/0662 with particular pseudorandom sequence generator
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04N 21/25816 involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/4122 additional display device, e.g. video projector digital output for controlling a plurality of local displays G06F3/1423
• CPC Class Codes: H04N 21/4143 embedded in a Personal Computer [PC]
• CPC Class Codes: H04N 21/4367 Establishing a secure communication between the client and a peripheral device or smart card
• CPC Class Codes: H04N 21/4627 Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/63345 by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

A video source device provides a basis value to a symmetric ciphering/deciphering process to a video sink device, to which the video source device is to provide a video content. The video source device ciphers the video content for transmission to the video sink device, including generation of a first cipher key through functional transformation of the basis value. The video source device further verifies periodically that the transmitted video content is indeed being symmetrically deciphered by the video sink device. The video sink device practices symmetric deciphering, including generation of a first decipher key through functional transformation of the basis value. The video sink device also provides verification values to the video source device to facilitate confirmation of symmetric deciphering. In one embodiment, the video source and sink devices further authenticate each other, including generation of an authentication key, which is used in the generation of the first cipher/decipher key.

Claims

1. In a video source device, a method comprising:

providing a basis value for a symmetric ciphering/deciphering process to enable a video sink device to receive video content from the video source device;

ciphering the video content for transmission to the video sink device, including

generation of a first cipher key through functional transformation of the basis value in a block mode of operation and performing stream ciphering based on the first cipher key; and

verifying periodically symmetrical deciphering of the transmitted video content by the video sink device.

2. The method of claim 1, wherein said ciphering process comprises subsequent generation of a plurality of cipher keys using the first cipher key.

3. The method of claim 1, wherein the functional transformation comprises employing an authentication key generated as an integral part of an authentication process authenticating the video sink device.

4. The method of claim 3, wherein said authentication key is generated using identifiers of the video source device and the video sink device, and said authentication process comprises exchanging the identifiers.

5. The method of claim 1, wherein said periodic verification comprises receiving selected ones of a plurality of verification values from the video sink device at predetermined points in time during said ciphering/deciphering process, and comparing the received verification values to corresponding ones of a plurality of verification reference values.

6. The method of claim 5, wherein said ciphering process comprises generating a pseudo random bit sequence for ciphering the video content, said verification reference values are symmetrically derived from the pseudo random bit sequence.

7. In a video source device, a method comprising:

authenticating a video sink device to receive a video content from the video source device, including generation of an authentication key;

ciphering the video content for transmission, to the video sink device in a stream mode of operation, including generation of a first cipher key using at least the authentication key in a block mode of operation; and

verifying periodically symmetrical deciphering of the transmitted video content by the video sink device.

8. The method of claim 7, wherein said ciphering process further comprises subsequent generation of a plurality of cipher keys using the first cipher key.

9. The method of claim 7, wherein said authentication key is generated using identifiers of the video source and sink devices, and said authentication process comprises exchanging the identifiers.

10. The method of claim 7, wherein said periodic verification comprises receiving selected ones of a plurality of verification values from the video sink device at predetermined points in time during the ciphering/deciphering process, and comparing the received verification values to corresponding ones of a plurality of verification reference values.

11. The method of claim 10, wherein said ciphering process comprises generating a pseudo random bit sequence for ciphering the video content, said verification reference values are symmetrically derived from the pseudo random bit sequence.

12. An apparatus comprising:

a first control unit to provide a basis value for a symmetric ciphering/deciphering process to enable a video sink device to receive a video content from the video source device;

a cipher unit coupled to the first control unit including a stream cipher unit to cipher the video content for transmission to the video sink device, and further including a block cipher unit that generates a first cipher key through functional transformation of the basis value in a block mode of operation;

wherein output of the block cipher unit is input into the stream cipher unit and input back into the block cipher unit as feedback; and

a second control unit coupled to the cipher unit to periodically verify symmetrical deciphering of the transmitted video content by the video sink device.

13. The apparatus of claim 12, wherein said block cipher unit is further to generate a plurality of additional cipher keys using the first cipher key.

14. The apparatus of claim 13, wherein said first control unit is further to authenticate the video sink device and generate an authentication key as an integral part of the authentication process, and the block cipher unit to functionally transform the basis value employing the authentication key.

15. The apparatus of claim 12, wherein said second control unit receives selected ones of a plurality of verification values from the video sink device at predetermined points in time during said ciphering/deciphering process, and compares the received verification values to corresponding ones of a plurality of verification reference values.

16. The apparatus of claim 15, wherein said the stream cipher unit is further to generate a pseudo random bit sequence for ciphering the video content, and said second control unit derives said verification reference values from the pseudo random bit sequence.

17. An apparatus comprising:

a first control unit to authenticate a video sink device to receive a video content from the video source device, including generation of an authentication key;

a cipher unit coupled to the first control unit including a stream cipher unit to cipher the video content for transmission to the video sink device, and further including a block cipher unit to generate a first cipher key using at least the authentication key; and

a second control unit coupled to the cipher unit to verify periodically symmetrical deciphering of the transmitted video content by the video sink device.

18. The apparatus of claim 17, wherein said block cipher unit is further to generate said first cipher key using at least said authentication key, and to successively generate a plurality of additional cipher keys using the first cipher key.

19. The apparatus of claim 17, wherein said first control unit also exchanges device identifiers with the video sink device, and generates the authentication key using the device identifiers.

20. The apparatus of claim 17, wherein said second control unit receives selected ones of a plurality of verification values from the video sink device at predetermined points in time during the ciphering/deciphering process, and compares the received verification values to corresponding ones of a plurality of verification reference values.

21. The apparatus of claim 20, wherein said ciphering/deciphering the video content, said verification reference values are derived from the pseudo random bit sequence.

22. The apparatus of claim 20, further comprising means for generating a pseudo random bit sequence for ciphering/deciphering the video content, and means for deriving verification reference values from the pseudo random bit sequence.

23. In a video sink device, a method comprising:

receiving a basis value for a symmetric ciphering/deciphering process from a video source device;

deciphering received video content in ciphered form from the video source device using a stream mode of operation, including generation of a first decipher key through functional transformation of the basis value in a block mode of operation and performing stream ciphering based on the first cipher key; and

providing periodically verification values to the video source device to trigger verification that the ciphered video content is indeed being symmetrically deciphered.

24. The method of claim 23, wherein said deciphering process comprises subsequent generation of a plurality of decipher keys using the first decipher key.

25. The method of claim 23, wherein the functional transformation comprises employing an authentication key generated as an integral part of an authentication process authenticating the video source device.

26. The method of claim 23, wherein said authentication key is generated using identifiers of the video source and the sink device, and said authentication process include exchanging the identifiers.

27. The method of claim 23, wherein said deciphering processes comprises generating a pseudo random bit sequence for deciphering the video content, said periodic provision of selected ones of verification values include symmetrically deriving the verification values from the pseudo random bit sequence.

28. In a video sink device, a method comprising:

authenticating a video source device, including generation of an authentication key in a block mode of operation;

deciphering ciphered video content received from the video source device using a stream mode of operation, including generation of a first decipher key using at least the authentication key in a block mode of operation; and

providing periodically verification values to the video source device to trigger verification that the ciphered video content is indeed being symmetrically deciphered.

29. The method of claim 28, wherein said deciphering process further comprises subsequent generation of a plurality of decipher keys using the first decipher key.

30. The method of claim 28, wherein said authentication key is generated using identifiers of the video source and the sink device, and said authentication process include exchanging the identifiers.

31. The method of claim 28, wherein said deciphering process comprises generating a pseudo random bit sequence for deciphering the video content, and said verification values are symmetrically derived from the pseudo random bit sequence.

32. An apparatus comprising:

a first control unit to receive a basis value for a symmetric ciphering/deciphering process from a video source device;

a decipher unit coupled to the first control unit including a stream decipher unit to decipher ciphered video content from the vide source device, and further including a block decipher unit that generates a first decipher key through functional transformation of the basis value in a block mode of operation; and

a second control unit coupled to the decipher unit to periodically provide verification values to the video source device to trigger verification that indeed the ciphered video content is being symmetrically deciphered.

33. The apparatus of claim 32, wherein said block decipher unit is further to perform said functionally transformation of the basis value to generate the initial decipher key, and to successively generate a plurality of additional decipher keys using the first decipher key.

34. The apparatus of claim 33, wherein said first control unit is further to authenticate the video source device and generate an authentication key as an integral part of the authentication process, and the block decipher unit to functionally transform the basis value employing the authentication key.

35. The apparatus of claim 33, wherein said stream decipher unit is further to generate a pseudo random bit sequence for deciphering the video content, and said second control unit derives said verification values from the pseudo random bit sequence.

36. An apparatus comprising:

a first control unit to authenticate a video source device, including generation of an authentication key;

a decipher unit coupled to the first control unit including a stream decipher unit to decipher ciphered video content from the video source device, and further including a block decipher unit to generate a first decipher key using at least the authentication key; and

a second control unit coupled to the decipher unit to provide periodically verification values to the video source device to trigger verification that the ciphered video content is indeed being symmetrically deciphered.

37. The apparatus of claim 36, wherein said decipher unit comprises a block decipher unit is further to generate said first decipher key using at least said authentication key, and to successively generate a plurality of additional decipher keys using the first decipher key.

38. The apparatus of claim 36, wherein said first control unit also exchanges device identifiers with the video source device, and generates the authentication key using the device identifiers.

39. The apparatus of claim 36, wherein said stream decipher unit is further to generate a pseudo random bit sequence for deciphering the video content, said verification values are derived from the pseudo random bit sequence.

40. A method comprising:

providing a basis value and an identification key for a symmetric ciphering/deciphering process to a receiving device;

receiving an identification key from the receiving device;

authenticating the receiving device by generating a common secret authentication key based upon a preconfigured array of private keys and an identifier associated with the receiving device;

ciphering content for transmission to the receiving device using a first cipher key, the first cipher key based upon block ciphered basis value using common secret authorization key; and

transmitting the ciphered content from the source device to the receiving device.

41. The method of claim 40, further comprising:

authenticating the source device to provide content to the receiving device, wherein the authenticating the source device comprises generating a source device authentication key;

receiving the ciphered content from the source device; and

symmetrically deciphering the ciphered content, wherein the deciphering the ciphered content comprises generating a first decipher key using at the source device authentication key.

42. The method of claim 40, wherein the receiving device and the source device comprise identifiers, wherein the authentication keys are based on their corresponding identifiers.

43. The method of claim 40, wherein the periodically verifying the symmetrical deciphering of the ciphered content comprises receiving the verification values from the receiving device and comparing the verification values with the corresponding verification reference values derived from a pseudo random bit sequence.

44. The method of claim 40, further comprising providing a basis value associated with a symmetric ciphering/deciphering process to the receiving device to receive the ciphered content from the source device, wherein the basis value comprises a random number.

45. A method comprising:

authenticating a receiving device to receive content from a source device, wherein the authenticating the receiving device comprises generating a receiving device authorization key;

authenticating the source device to provide content to the receiving device, wherein the authenticating the source device comprises generating a source device authentication key;

ciphering the content for transmission to the receiving device, wherein the ciphering the content comprises generating a first cipher key using at least the receiving device authorization key;

transmitting the ciphered content from the source device to the receiving device;

receiving the ciphered content from the source device; and

deciphering the ciphered content, wherein the deciphering the ciphered content comprises generating a first decipher key using at the source device authentication key.

46. The method of claim 45, further comprising:

periodically providing verification values from the receiving device to the source device to trigger verification of the deciphering of the ciphered content;

receiving the verification values from the receiving device; and

verifying the deciphering of the ciphered content.

47. The method of claim 45, further comprising:

providing a basis value associated with a ciphering/deciphering process from the source device to the receiving device;

receiving the basis value associated with the ciphering/deciphering process;

ciphering the content, wherein the ciphering the content comprises generating the first cipher key through functional transformation of the basis value; and

symmetrically deciphering the ciphered content, wherein the deciphering the ciphered content comprises generating the first decipher key through functional transformation of the basis value.

48. A method comprising:

providing a basis value from a source device to a sink device, wherein the basis value is a first random number;

providing a source identification key from the source device to the sink device;

receiving a sink identification key at the source device from the sink device;

independently generating authentication key at the source device and at the sink device, wherein the source device and the sink device having respective copies of the authentication key;

generating an initial session key for transmission session by block ciphering the basis value using the authentication key as a block cipher key;

generating a second random number;

stream ciphering content using the initial session key; and

generating a frame key for the next frame by block ciphering an immediately preceding version of the second random number using the initial session key as the block cipher key.

49. The method of claim 48, further comprising generating a current version of the second random number by generating a pseudo random bit sequence using a stream cipher with the previous version of the second random number and the frame key.

50. The method of claim 48, wherein the source device generates its copy of the authentication key by summing private key of its provided array indexed by the sink identification key.

51. The method of claim 48, wherein the sink device generates its copy of the authentication key by summing private key of its provided array indexed by the source identification key.

52. An apparatus comprising:

a source device to provide a basis value to a sink device, wherein the basis value is a first random number;

the source device to provide a source identification key to the sink device;

the source device to receive a sink identification key from the sink device, wherein the sink identification key is generated by the sink device;

the source device to independently generate an authentication key, wherein a respective copy of the authentication key is also generated by the sink device;

a block cipher unit to generate an initial session key for transmission session by block ciphering the basis value using the authentication key as a block cipher key;

the source device generating a second random number;

a stream cipher unit to stream cipher content using the initial session key; and

the source device to generate a frame key for the next frame by block ciphering an immediately preceding version of the second random number using the initial session key as the block cipher key.

53. The apparatus of claim 52, wherein the source device is further to generate a current version of the second random number by generating a pseudo random bit sequence using a stream cipher with the previous version of the second random number and the frame key.

54. The apparatus of claim 52, wherein the source device generates its copy of the authentication key by summing private key of its provided array indexed by the sink identification key.

55. The apparatus of claim 52, wherein the sink device generates its copy of the authentication key by summing private key of its provided array indexed by the source identification key.

56. The apparatus of claim 52, means for generating a copy of the authentication key for the sink device by summing private key of its provided array indexed by the source identification key.

57. An apparatus comprising:

means for providing a basis value to a sink device, wherein the basis value is a first random number;

means for providing a source identification key to the sink device;

means for receiving a sink identification key from the sink device;

means for independently generating an authentication key;

means for generating an initial session key for transmission session by block ciphering the basis value using the authentication key as a block cipher key;

means for generating a second random number;

means for stream ciphering content using the initial session key; and

means for generating a frame key for the next frame by block ciphering an immediately preceding version of the second random number using the initial session key as the block cipher key.

58. The apparatus of claim 57, further comprises means for generating a current version of the second random number by generating a pseudo random bit sequence using a stream cipher with the previous version of the second random number and the frame key.

59. The apparatus of claim 57, further comprises means for generating a copy of the authentication key for a source device by summing private key of its provided array indexed by the sink identification key.

60. An apparatus comprising:

means for providing a basis value for a symmetric ciphering/deciphering process to enable a video sink device to receive a video content from a video source device;

means for ciphering the video content in a stream mode of operation for transmission to the video sink device, and further means for generating a first cipher key through functional transformation of the basis value in a block mode of operation and performing stream ciphering based on the first cipher key; and

means for periodically verifying symmetrical deciphering of the transmitted video content by the video sink device.

61. The apparatus of claim 60, further comprising means for generating a plurality of additional cipher keys using the first cipher key.

62. The apparatus of claim 60, further comprising means for generating a pseudo random bit sequence for ciphering the video content, and means for deriving verification reference values from the pseudo random bit sequence.

63. An apparatus comprising:

means for authenticating a video sink device to receive a video content from a video source device, including generating an authentication key;

means for ciphering the video content in a stream mode of operation for transmission to the video sink device, and further means for generating a first cipher key using at least the authentication key in a block mode of operation; and

means for verifying periodically symmetrical deciphering of the transmitted video content by the video sink device.

64. The apparatus of claim 63, further comprising means for generating said first cipher key using at least said authentication key, and for successively generating a plurality of additional cipher keys using the first cipher key.

65. An apparatus comprising:

means for receiving a basis value for a symmetric ciphering/deciphering process from a video source device;

means for deciphering ciphered video content in a stream mode of operation from the vide source device, and means for generating a first decipher key through functional transformation of the basis value in a block mode of operation and performing stream ciphering based on the first cipher key; and

means for periodically providing verification values to the video source device for triggering verification that indeed the ciphered video content is being symmetrically deciphered.

66. The apparatus of claim 65, further comprising means for performing functional transformation of the basis value for generating the initial decipher key, and for successively generating a plurality of additional decipher keys using the first decipher key.

67. The apparatus of claim 65, further comprising means for generating a pseudo random bit sequence for deciphering the video content, wherein said verification values are derived from the pseudo random bit sequence.

68. An apparatus comprising:

means for authenticating a video source device, including generating an authentication key;

means for deciphering ciphered video content in a steam mode of operation from the video source device, and means for generate a first decipher key using at least the authentication key in a block mode of operation; and

means for providing periodically verification values to the video source device for triggering verification that the ciphered video content is indeed being symmetrically deciphered.

69. The apparatus of claim 68, further comprising means for generating said first decipher key using at least said authentication key, and means for successively generating a plurality of additional decipher keys using the first decipher key.

70. The apparatus of claim 68, further comprising means for generating a pseudo random bit sequence for deciphering the video content, wherein said verification values are derived from the pseudo random bit sequence.