Encrypting a digital object based on a key ID selected therefor

• US 6,816,596 B1
• Filed: 03/15/2000
• Issued: 11/09/2004
• Est. Priority Date: 01/14/2000
• Status: Expired due to Term

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Venkatesan, Ramarathnam, Peinado, Marcus
• Primary Examiner(s): MOISE, EMMANUEL LIONEL
• Application Number:
  US09/526,292
• Time in Patent Office: 1,700 Days
• Field of Search: 713/162, 713/176, 713/186, 713/164, 713/168, 713/165, 713/177, 380/201, 380/43, 380/270, 380/273, 380/274, 380/277, 705/54, 705/51
• US Class Current: 380/277
• CPC Class Codes: G06F 21/109 by using specially-adapted hardware at the client
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/84 output devices, e.g. displays or monitors
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G07F 9/002 Vending machines being part of a centrally controlled network of vending machines
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds

Abstract

To encrypt a digital object, a key ID is selected for the digital object, and a function ƒ( ) having an input and an output is selected. The selected key ID is then employed as the input to the function ƒ( ), and the output of such function ƒ( ) is employed as the key (KD) for the digital object: ƒ(key ID)→key (KD). The digital object is then encrypted according to such key (KD), and the encrypted digital object is distributed.

Claims

1. A method of encrypting a digital object comprising:

selecting a key ID for the digital object;

selecting a function ƒ

( ) having an input and an output;

employing the selected key ID as the input to the function ƒ

( );

employing the output of such function ƒ

( ) as the key (KD) for the digital object;

2. The method of claim 1 comprising distributing the key ID along with the encrypted digital object.

3. The method of claim 1 comprising selecting the key ID for the digital object according to a member selected from a group consisting of randomly and serially.

4. The method of claim 1 comprising employing the selected key ID along with a secret seed as the input to the function ƒ

( );

5. The method of claim 4 wherein the seed has a seed ID, and wherein the method comprises employing the selected key ID and the secret seed along with the seed ID as the input to the function ƒ

( );

6. The method of claim 1 comprising employing the output of the function ƒ

( ) as a symmetric encryption and decryption key (KD) for the digital object.

7. The method of claim 1 comprising selecting a one-way function ƒ

( ).

8. The method of claim 7 comprising selecting a one-way function ƒ

( ) from a group consisting of a secure hashing algorithm (SHA) or an MD5 algorithm.

9. The method of claim 1 further comprising:

receiving a request for the key (KD) from a requestor, the request including the key ID;

employing the included key ID as the input to the function ƒ

( );

employing the output of such function ƒ

( ) as the requested key (KD);

10. The method of claim 9 comprising receiving the request for the key (KD) including the key ID as distributed along with the encrypted digital object.

11. The method of claim 9 comprising employing the selected key ID along with a secret seed as the input to the function ƒ

( );

 

ƒ

(key ID, seed)→

key (KD),

both when producing the key (KD) to encrypt the digital object and when producing the key (KD) to distribute to the requestor.

12. The method of claim 11 wherein the seed has a seed ID, and wherein the method comprises employing the selected key ID and the secret seed along with the seed ID as the input to the function ƒ

( );

13. The method of claim 9 comprising employing the output of the function ƒ

( ) as a symmetric encryption and decryption key (KD) for the digital object.

14. The method of claim 9 comprising selecting a one-way function ƒ

( ).

15. The method of claim 14 comprising selecting a one-way function ƒ

( ) from a group consisting of a secure hashing algorithm (SHA) or an MD5 algorithm.

16. The method of claim 9 further comprising:

receiving a license request for a digital license including the key (KD) from a license requester, the license request including the key ID;

approving the license request;

employing the included key ID as the input to the function ƒ

( );

employing the output of such function ƒ

( ) as the requested key (KD);

 

ƒ

(key ID)→

key (KD); and

distributing such key (KD) to the license requestor as part of a digital license.

17. The method of claim 16 comprising receiving a license request for a digital license including the key (KD), the license request including the key ID as distributed along with the encrypted digital object.

18. The method of claim 9 further comprising providing an authorized key server with the selected function ƒ

( ), wherein the request for the key (KD) is received by the key server.

19. The method of claim 18 comprising:

employing the key ID along with a secret seed as the input to the function ƒ

( );

20. The method of claim 19 wherein the secret seed has a seed ID, the method comprising:

employing the key ID and the secret seed along with the seed ID as the input to the function ƒ

( );

21. A method of producing a key (KD) for decrypting a digital object, the digital object having been encrypted by:

selecting a key ID for the digital object;

selecting a function ƒ

( ) having an input and an output;

employing the selected key ID as the input to the function ƒ

( );

employing the output of such function ƒ

( ) as the key (KD) for the digital object;

22. The method of claim 21 comprising employing the selected key ID along with a secret seed as the input to the function ƒ

( );

23. The method of claim 22 wherein the seed has a seed ID, and wherein the method comprises employing the selected key ID and the secret seed along with the seed ID as the input to the function ƒ

( );

24. The method of claim 21 comprising selecting a one-way function ƒ

( ).

25. The method of claim 24 comprising selecting a one-way function ƒ

( ) from a group consisting of a secure hashing algorithm (SHA) or an MD5 algorithm.

26. The method of claim 21 further comprising:

receiving a license request for a digital license including the key (KD) from a license requester, the license request including the key ID;

approving the license request;

employing the included key ID as the input to the function ƒ

( );

employing the output of such function ƒ

( ) as the requested key (KD);

27. The method of claim 21 further comprising receiving the selected function ƒ

( ).

28. The method of claim 27 wherein the key ID is employed along with a secret seed as the input to the function ƒ

( );

29. The method of claim 28 wherein the secret seed has a seed ID, and wherein the key ID, the secret seed, and the seed ID are employed as the input to the function ƒ

( );

30. A method of requesting a key (KD) for decrypting a digital object, the digital object having been encrypted by:

selecting a key ID for the digital object;

selecting a function ƒ

( ) having an input and an output;

employing the selected key ID as the input to the function ƒ

( );

employing the output of such function ƒ

( ) as the key (KD) for the digital object;

31. The method of claim 30 for requesting a digital license including the key (KD) for decrypting the digital object, the method comprising:

sending a request for the digital license including the key (KD), the request including the key ID,

wherein upon approval of the request,

the included key ID is employed as the input to the function ƒ

( ); and

the output of such function ƒ

( ) is employed as the requested key (KD);

32. The method of claim 30 wherein the digital object has been encrypted by:

selecting a key ID for the digital object;

selecting a secret seed having a seed ID

selecting a function ƒ

( ) having an input and an output;

employing the selected key ID and the selected seed as the input to the function ƒ

( );

employing the output of such function ƒ

( ) as the key (KD) for the digital object;

33. The method of claim 32 wherein the digital object has been encrypted by:

selecting a key ID for the digital object;

selecting a secret seed having a seed ID

selecting a function ƒ

( ) having an input and an output;

employing the selected key ID, the selected seed, and the seed ID thereof as the input to the function ƒ

( );

employing the output of such function ƒ

( ) as the key (KD) for the digital object;

34. A method of producing a security key comprising:

selecting a key ID for the key;

selecting a function ƒ

( ) having an input and an output;

employing the selected key ID as the input to the function ƒ

( );

employing the output of such function ƒ

( ) as the key;

35. The method of claim 34 comprising selecting the key ID for the key according to a member selected from a group consisting of randomly and serially.

36. The method of claim 34 comprising employing the selected key ID along with a secret seed as the input to the function ƒ

( );

37. The method of claim 36 wherein the seed has a seed ID, and wherein the method comprises employing the selected key ID and the secret seed along with the seed ID as the input to the function ƒ

( );

38. The method of claim 34 comprising employing the output of the function ƒ

( ) as a symmetric encryption and decryption key.

39. The method of claim 34 comprising selecting a one-way function ƒ

( ).

40. The method of claim 39 comprising selecting a one-way function ƒ

( ) from a group consisting of a secure hashing algorithm (SHA) or an MD5 algorithm.

41. The method of claim 34 wherein the key is employed to encrypt a digital object, the method further comprising:

receiving a request for the key from a requester to decrypt the encrypted digital object, the request including the key ID;

employing the included key ID as the input to the function ƒ

( );

employing the output of such function ƒ

( ) as the requested key;

42. The method of claim 41 comprising employing the selected key ID along with a secret seed as the input to the function ƒ

( );

43. The method of claim 42 wherein the seed has a seed ID, and wherein the method comprises employing the selected key ID and the secret seed along with the seed ID as the input to the function ƒ

( );

44. The method of claim 41 comprising employing the output of the function ƒ

( ) as a symmetric encryption and decryption key.

45. The method of claim 41 comprising selecting a one-way function ƒ

( ).

46. The method of claim 45 comprising selecting a one-way function ƒ

( ) from a group consisting of a secure hashing algorithm (SHA) or an MD5 algorithm.