Key management for content protection

• US 6,880,081 B1
• Filed: 02/11/2000
• Issued: 04/12/2005
• Est. Priority Date: 07/15/1999
• Status: Expired due to Term

• Current Assignee: Synamedia Limited
• Original Assignee: NDS Limited (Cisco Systems, Inc.)
• Inventors: Itkis, Yevgeny Yakov (Gene)
• Primary Examiner(s): Morse, Gregory
• Assistant Examiner(s): HENEGHAN, MATTHEW E
• Application Number:
  US09/502,867
• Time in Patent Office: 1,887 Days
• Field of Search: 713/163, 380/2
• US Class Current: 713/163
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/0836 using tree structure or hierarchical structure

Abstract

A method for content access control operative to enable authorized devices to access protected content and to prevent unauthorized devices from accessing protected content, the method comprising: providing a plurality of authorized devices; dividing the plurality of authorized devices into a plurality of groups, each of the plurality of authorized devices being comprised in at least one of the plurality of groups, no two devices of the plurality of authorized devices being comprised in exactly the same groups; determining whether at least one device of the plurality of authorized devices is to be prevented from having access to the protected content and, if at least one device is to be prevented, removing all groups comprising the at least one device from the plurality of groups, thus producing a set of remaining groups; and determining an authorized set comprising groups from the set of remaining groups, such that each device of the plurality of authorized devices which was not determined, in the determining whether step, to be prevented from having access is comprised in at least one group of the authorized set.

Claims

1. A method for black box analysis of a device capable of accessing protected content, the method comprising:

providing a device to be analyzed;

providing a plurality of group keys comprising n+m group keys, each of n and m being greater than or equal to 1;

inputting to the device a data item comprising encrypted protected content and n encrypted versions of a content key for accessing the protected content, each of the n encrypted versions being encrypted in accordance with a different one of the n group keys;

receiving, from the device, decrypted content representing a decryption of the protected content;

determining whether the received content is one of the following;

erroneous; and

null, and producing a result; and

identifying a set of group keys comprising at least one group key which is known to the device based, at least in part, on the result,

wherein the data item also comprises m encrypted versions of at least one invalid content key encrypted in accordance with the m group keys.

2. A method according to claim 1 and also comprising performing the following steps at least once before performing the identifying step:

choosing a new plurality of encrypted versions of the content key; and

performing the inputting, receiving and determining steps.

3. A method according to claim 2 and wherein the choosing a new plurality step comprises choosing based, at least in part, on at least one of the following:

at least one result of the determining step performed before the choosing step; and

the plurality of encrypted versions of the content key used in the inputting step performed before the choosing step.

4. A method according to claim 1 and wherein the identifying step comprises identifying the one of the plurality of group keys with which the invalid content key is encrypted.

5. A method according to claim 1 and wherein the identifying step comprises identifying a group key which is not one of the plurality of group keys with which the invalid content key is encrypted.

6. A method according to claim 1 and wherein the identifying step comprises identifying a group key which is one of the plurality of group keys and which the invalid content key is encrypted.

7. A method for black box analysis of a device capable of accessing protected content, the method comprising:

providing a device to be analyzed;

analyzing the device, the analyzing comprising;

inputting to the device a data item, the data item comprising;

encrypted protected content;

a plurality of encrypted versions of a content key for accessing the protected content, each of the plurality of encrypted versions being encrypted in accordance with a different one of a plurality of group keys; and

at least one invalid content key encrypted in accordance with at least one additional group key, the additional group key not being comprised in the plurality of group keys;

receiving, from the device, decrypted content representing a decryption of the protected content;

determining whether the received content is one of the following;

erroneous; and

null, and producing a result; and

identifying a set of group keys comprising at least one group key which is known to the device based, at least in part, on the result.

8. A method according to claim 7 and also comprising performing the following steps at least once before performing the identifying step:

choosing a new plurality of encrypted versions of the content key; and

performing the inputting, receiving and determining steps.

9. A method according to claim 8 and wherein the choosing a new plurality step comprises choosing based, at least in part, on at least one of the following:

at least one result of the determining step performed before the choosing step; and

the plurality of encrypted versions of the content key used in the inputting step performed before the choosing step.

10. A method according to claim 7 and wherein the identifying group comprises identifying the one of the plurality of group keys with which the invalid content key is encrypted.

11. A method according to claim 7 and wherein the identifying group comprises identifying a group key which is not one of the plurality of group keys with which the invalid content key is encrypted.

12. A method according to claim 7 and wherein the identifying step comprises identifying a group key which is one of the plurality of group keys with which the invalid content key is encrypted.

13. A method according to claim 7 and wherein the at least one additional group key comprises a plurality of additional group keys.

14. A method for black box analysis of a device capable of accessing protected content, the method comprising:

providing a device to be analyzed;

analyzing the device, the analyzing comprising;

providing a plurality of group keys comprising n+m group keys, each of n and m being greater than or equal to 1;

inputting to the device a data item, the data item comprising;

encrypted protected content;

n encrypted versions of a content key for accessing the protected content, each of the n encrypted versions being encrypted in accordance with a different one of the n group keys; and

at least one invalid content key encrypted in accordance with the m group keys;

receiving from the device, decrypted content representing a decryption of the protected content;

determining whether the received content is one of the following;

erroneous; and

null, and producing a result; and

identifying a set of group keys comprising at least one group key which is known to the device based, at least in part, on the result.

15. A method according to claim 14 and also comprising performing the following step at least once before performing the identifying step:

choosing a new plurality of encrypted versions of the counter key; and

performing the inputting, receiving and determining steps.

16. A method according to claim 15 and wherein the choosing a new plurality step comprises choosing based, at least in part, on at least one of the following:

at least one result of the determining step performed before the choosing step; and

the plurality of encrypted versions of the content key used in the inputting step performed before the choosing step.

17. A method according to claim 14 and wherein the identifying step comprises identifying the one of the plurality of group keys with which the invalid content key is encrypted.

18. A method according to claim 14 and wherein the identifying step comprises identifying a group key which is not one of the plurality of group keys with which the invalid content key is encrypted.

19. A method according to claim 14 and wherein the identifying step comprises identifying a group key which is one of the plurality of group keys with which the invalid content key is encrypted.

20. A method according to claim 14 and wherein the at least one additional group key comprises a plurality of additional group keys.