Media content protection utilizing public key cryptography

• US 6,550,011 B1
• Filed: 10/07/1999
• Issued: 04/15/2003
• Est. Priority Date: 08/05/1998
• Status: Expired due to Fees

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Sims, J Robert III
• Primary Examiner(s): Barron, Gilberto
• Assistant Examiner(s): Callahan, Paul E.
• Application Number:
  US09/414,213
• Time in Patent Office: 1,286 Days
• Field of Search: 713/194, 380/279, 365/52, 705/39, 705/54, 705/65
• US Class Current: 713/193
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 2211/008 Public Key, Asymmetric Key, Asymmetric Encryption
• CPC Class Codes: G06F 2221/2121 Chip on media, e.g. a disk or tape with a chip embedded in its case
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G11B 20/00086 Circuits for prevention of unauthorised reproduction or copying, e.g. piracy indicating unauthorised use of record carriers in general G11B23/28; scrambling for television signal recording H04N5/913; network architectures or network protocols for network security H04L63/00; cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
• CPC Class Codes: G11B 20/00137 involving measures which result in a restriction to contents recorded on or reproduced from a record carrier to authorised users
• CPC Class Codes: G11B 20/00144 involving a user identifier, e.g. a unique customer ID
• CPC Class Codes: G11B 20/0021 involving encryption or decryption of contents recorded on or reproduced from a record carrier
• CPC Class Codes: G11B 20/00253 wherein the key is stored on the record carrier
• CPC Class Codes: G11B 20/00543 wherein external data is encrypted, e.g. for secure communication with an external device or for encrypting content on a separate record carrier
• CPC Class Codes: G11B 20/0071 involving a purchase action
• CPC Class Codes: G11B 20/00746 wherein the usage restriction can be expressed as a specific number
• CPC Class Codes: G11B 20/00768 wherein copy control information is used, e.g. for indicating whether a content may be copied freely, no more, once, or never, by setting CGMS, SCMS, or CCI flags

Abstract

A system and method for providing protection of content which may be transmitted over unsecure channels, including storage and transmission in bulk media, transmission over a network such as the Internet, transmission between components of an open system, and broadcast transmitted, to compliant storage devices and/or compliant use devices is disclosed. The technique for providing protection from unauthorized utilization of the content so stored is provided publicly in order to allow for those utilizing a conforming media device to master or generate content protected according to the present invention. According to a preferred embodiment, public key cryptography is utilized to identify compliant devices and to transmit cryptographic keys protecting content data. In the preferred embodiment content is protected using private key cryptography to optimize system performance.

Claims

1. A method for preventing unauthorized utilization of content, said method comprising the steps of:

establishing a plurality of compliant devices ones of which are storage devices and other ones of which are use devices, wherein ones of said plurality of compliant devices meet different levels of compliant operation and all of said plurality of compliant devices meet a minimum operational level of protecting a cryptographic key associated with protected content, and wherein each compliant device of said plurality of compliant devices includes at least one element of the set consisting of a public cryptographic key and an electronic certificate;

selecting a first cryptographic key to be associated with said content;

encrypting said content using said first cryptographic key;

selecting content use information from a set of pre-established content use information to proscribe use of said content;

protecting said selected content use information from unauthorized alteration;

identifying ones of said plurality of compliant devices for which utilization of said content is to be authorized to thereby establish an authorized compliant device set, wherein said authorized compliant device set includes only compliant devices of said plurality of compliant devices meeting a desired threshold standard of operation;

establishing acceptable compliant device information, wherein said acceptable compliant device information includes at least one element of the set consisting of said public cryptographic key and said electronic certificate for each compliant device of said authorized compliant device set;

associating said first cryptographic key, said protected content use information and said acceptable compliant device information with said encrypted content; and

storing said first cryptographic key in a secure storage area of a storage device of said authorized compliant device set.

2. The method of claim 1, wherein the step of protecting said selected content use information comprises the step of:

encrypting said selected content use information using said first cryptographic key.

3. The method of claim 1, wherein the step of protecting said selected content use information comprises the step of:

creating a protected hash of said selected content use information.

4. The method of claim 1, wherein said minimum operational level of protecting a cryptographic key associated with protected content requires said compliant device to never communicate a cryptographic key associated with protected content in unencrypted form external to said compliant device.

5. The method of claim 1, wherein said step of establishing compliant device information comprises the step of:

listing public cryptographic keys of devices meeting a particular standard of operation.

6. The method of claim 1, wherein said step of establishing compliant device information comprises the step of:

listing the electronic certificates of certificate authorities trusted to determine devices meet said particular standard of operation.

7. The method of claim 1, wherein said step of establishing compliant device information comprises the steps of:

listing public cryptographic keys of devices meeting a particular standard of operation; and

listing the electronic certificates of certificate authorities trusted to determine devices meet said particular standard of operation.

8. The method of claim 1, wherein said step of identifying ones of said plurality of compliant devices to establish an authorized compliant device set comprises the step of:

identifying compliant devices including a particular implementation, wherein said particular implementation is selected from the group consisting of a hardware implementation, a software implementation, a high security implementation, a low security implementation, an audio device implementation, a video device implementation, and a banking device implementation.

9. The method of claim 1, wherein said step of identifying ones of said plurality of compliant devices to establish an authorized compliant device set comprises the step of:

identifying an electronic certificate associated with a particular trusted certification authority.

10. The method of claim 1, further comprising the step of:

cloning at least a secure portion of a compliant device of said plurality of compliant devices, wherein a cloned at least a secure portion of said compliant device provides operational abilities with respect to protected content coextensive with that of said at least a secure portion of said compliant device cloned.

11. The method of claim 10, wherein said cloning step renders said at least a secure portion of said compliant device cloned inoperable for further use with said protected content.

12. The method of claim 10, wherein said cloning step produces a backup copy of said at least a secure portion of said complaint device cloned.

13. A system for protecting content, said system comprising:

a set of content use rules wherein portions of said content use rules are selectable to be associated with protected content in order to define authorized uses thereof;

a protected form of said content, wherein said protected form of said content includes an encryption of said content, a content key associated with said encryption of said content, an identification of devices authorized for use with said content, and a subset of said content use information defining authorized use of said content;

a plurality of devices providing compliant operation according to said system, wherein said compliant operation according to said system at least proscribes the use and communication of said content key associated with said protected content, and wherein said plurality of compliant devices comprise;

a use device having a secure storage area associated therewith, wherein said use device includes a public/secret cryptographic key set, wherein a secret key of said public/secret cryptographic key set is stored in said secure storage area; and

a storage device storing said identification of devices authorized for use with said content, wherein said storage device operates under control of an instruction set and has a secure storage area associated therewith, wherein said content key is stored in said secure storage area and is passable to said use device under control of said instruction set only if said use device is identifiable with said identification of devices authorized for use with said content.

14. The system of claim 13, wherein said encryption of said content is stored separate from said storage device.

15. The system of claim 13, wherein said use device further comprises:

a decryption engine for asymmetric decryption of messages protected using said public/secret cryptographic key set; and

a decryption engine for symmetric decryption of said content using said content key.

16. The system of claim 13, wherein said storage device further comprises:

encryption engine for asymmetric encryption of said content key using said public/secret cryptographic key set.

17. The system of claim 13, wherein said secure storage area associated with said use device is disposed in a security device including a memory, a processor, and an instruction set incarcerated in a tamper resistant housing removably coupled to a remainder of said use device.

18. The system of claim 13, wherein said secure storage area associated with said storage device is disposed in a security device including a memory, a processor, and an instruction set incarcerated in a tamper resistant housing removably coupled to a remainder of said storage device.

19. A method for protecting electronic content, said method comprising the steps of:

providing a compliant first device having a secure storage area associated therewith;

providing a compliant second device having a secure storage area associated therewith;

providing a content cryptographic key;

encrypting said content using said content cryptographic key;

storing said content cryptographic key in said secure storage area of said compliant first device;

identifying particular rules of a plurality of rules to establish authorized uses of said content;

preventing unauthorized alteration of said identified rules;

identifying devices of a plurality of devices authorized for use with said content to thereby provide identified device information;

preventing unauthorized alteration of said identified device information;

providing a device public/secret cryptographic key set;

storing a device secret key of said device public/secret cryptographic key set in said secure storage area of said compliant second device;

establishing communication between said compliant first device and said compliant second device to thereby provide a communication link;

comparing, at said compliant first device, information with respect to said compliant second device to said identified device information;

determining if said compliant second device is authorized for use with said content at least in part from information derived from said comparing step; and

if said compliant second device is determined to be authorized for use with said content at said determining step, performing the steps of;

encrypting, at said compliant first device, said content cryptographic key using a public key of said device public/secret cryptographic key set;

communicating said encrypted content cryptographic key from said compliant first device to said compliant second device;

decrypting, at said compliant second device, said encrypted content cryptographic key using said secret key stored in said compliant second device'"'"'s secure storage area; and

storing said content cryptographic key in said compliant second device'"'"'s secure storage area, wherein said stored content cryptographic key is identified with said content by said compliant second device.

20. The method of claim 19, wherein said step of comparing utilizes said public key provided to said compliant first device from said compliant second device via said communication link.

21. The method of claim 19, wherein said step of comparing utilizes an electronic certificate provided to said compliant first device from said compliant second device via said communication link.

22. The method of claim 19, wherein said step of identifying said devices of said plurality of devices authorized for use with said content includes a step selected from the group consisting of:

identifying an implementation of devices considered to provide an acceptable level of operational compliance;

identifying a certificate authority considered to provide an acceptable level of determination of operational compliance of devices;

identifying an electronic certificate associated with a group of devices considered to provide an acceptable level of operational compliance; and

identifying a public key associated with a group of devices considered to provide an acceptable level of operational compliance.

23. The method of claim 19, wherein at least one of said steps of preventing unauthorized alteration of said identified rules and preventing unauthorized alteration of said identified device information comprises the step of:

providing said one of said identified rules and said identified device information in clear text and associating a protection code therewith, wherein said protection code is relied upon to detect alteration of said clear text information.

24. A method for protecting electronic content comprising:

providing a compliant device having a secure storage area with at least a device secret key of a device public/secret cryptographic key set stored therein;

encrypting said content using a content cryptographic key;

identifying devices of a plurality of devices authorized for use with said content to thereby provide identified device information;

determining if said compliant device is authorized for use with said content at least in part through reference to said identified device information; and

if said compliant device is determined to be authorized for use with said content at said determining step, performing the steps of;

.

decrypting said encrypted content cryptographic key using said secret key stored in said compliant device'"'"'s secure storage area; and

storing said content cryptographic key in said compliant device'"'"'s secure storage area, wherein said stored content cryptographic key is identified with said content by said compliant device.

25. The method of claim 24, further comprising:

establishing rules for authorized uses of said content, wherein use of said content cryptographic key stored in said compliant device'"'"'s secure storage area to decrypt said encrypted content is in accordance with said rules for authorized uses of said content.

26. The method of claim 24, further comprising:

comparing, at a second compliant device, information with respect to said compliant device to said identified device information.

27. The method of claim 26, wherein said step of comparing utilizes a public key corresponding to said secret key stored in said compliant device'"'"'s secure storage area provided to said second compliant device from said compliant device via a communication link therebetween.

28. The method of claim 26, wherein said step of comparing utilizes an electronic certificate provided to said second compliant device from said compliant device via a communication link therebetween.

29. A system for protecting content comprising:

a plurality of devices providing compliant operation which at least proscribes the use and communication of a content key associated with a protected content, and wherein said plurality of compliant devices comprise;

a use device having a secure storage area associated therewith, wherein said use device includes a public/secret cryptographic key set, wherein a secret key of said public/secret cryptographic key set is stored in said secure storage area; and

a storage device storing identification of compliant devices authorized for use with said content, wherein said storage device has a secure storage area associated therewith storing said content key which is passable to said use device only if said use device is identifiable with said identification of devices authorized for use with said content.

30. The system of claim 29, further comprising:

a set of content use rules wherein portions of said content use rules are selectable to be associated with protected content in order to define authorized uses thereof, wherein use of protected content by said use device is in accordance with portions of said content use rules associated therewith.

31. The system of claim 29, wherein said protected content comprises:

an encryption of said content, a content key associated with said encryption of said content, an identification of devices authorized for use with said content, and a subset of said content use information defining authorized use of said content.

32. The system of claim 29, wherein said secure storage area associated with said use device is disposed in a security device including a memory, a processor, and an instruction set incarcerated in a tamper resistant housing removably coupled to a remainder of said use device.