System and method for key distribution and network connectivity

• US 6,988,204 B2
• Filed: 04/16/2002
• Issued: 01/17/2006
• Est. Priority Date: 04/16/2002
• Status: Expired due to Term

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Alve, Jukka, Kangas, Mauri
• Primary Examiner(s): Barron, Gilberto
• Assistant Examiner(s): Zand, Kambiz
• Application Number:
  US10/124,637
• Publication Number:
  US 20030196089A1
• Time in Patent Office: 1,372 Days
• Field of Search: 713/171, 713/172, 713/193, 380/45, 380/281, 380/282, 380/283, 380/284, 327/545, 327/546
• US Class Current: 713/193
• CPC Class Codes: G06F 21/109 by using specially-adapted hardware at the client
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04N 21/2541 Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/835 Generation of protective data, e.g. certificates protecting software against unauthorised usage in a vending or licensing environment G06F21/10

Abstract

Systems and methods for distributing keys of the sort used for purposes including logging onto computer networks, accessing authorized domains, and accessing persistently-protected data. Also discussed is a smart card that offers network connectivity to a media device.

Claims

1. A method for distributing access keys to one or more media devices, comprising:

selecting a media device;

selecting an access key stored on a smart card;

determining the conditions for distribution of the selected access key from said smart card to the selected media device, and if the conditions are met;

receiving at said smart card a public key relating to the selected media device;

having said smart card create an encrypted copy of the selected access key, the encryption being performed according to said public key;

having said smart card dispatch said encrypted copy to the selected media device; and

having said smart card decrement an incorporated counter, the value of said counter specifying how many more copies of the selected access key the smart card is permitted to distribute, wherein the smart card is capable of distributing more than one copy of the selected access key.

2. The method of claim 1, wherein the selected access key allows the selected media device to access data within an authorized domain.

3. The method of claim 1, wherein an initial value for the counter associated with the selected access key is set in association with the storing of the selected access key.

4. The method of claim 1, wherein the conditions for the distribution of the selected key comprise:

the counter value indicating that a copy of the selected access key is permitted.

5. The method of claim 1, wherein the conditions for the distribution of the selected key comprise:

having said smart card determine the selected media device'"'"'s compliance with a predetermined standard for content protection; and

having the selected media device determine said smart card'"'"'s compliance with a predetermined standard for content protection.

6. The method of claim 5, wherein determining compliance involves examining a digital certificate.

7. The method of claim 1, wherein media device selection is performed by inserting the smart card into a smart card interface of the selected media device.

8. The method of claim 1, further comprising:

having said smart card maintain a second access key;

selecting said second access key;

determining the conditions for the distribution of the second access key to the selected media device; and

if the conditions are met,

having said smart card create an encrypted copy of said second access key, the encryption being performed according to said public key;

having said smart card dispatch, to the selected media device, said encrypted copy of said second access key; and

having said smart card decrement a second counter associated with the second access key, the value of said second counter specifying how many more copies of said second access key the smart card is permitted to distribute.

9. The method of claim 1, wherein said smart card is inserted into a smart card interface of the selected media device.

10. The method of claim 1, wherein said smart card is inserted into a smart card interface of a second media device, said second media device being operatively connected to the selected media device.

11. A system for distributing access keys, comprising:

a smart card possessing a storage location having program code stored therein, said smart card further possessing a processor operatively connected to said storage location for carrying out instructions in accordance with said stored program code;

wherein said program code, when executed by said processor, causes said processor to perform the steps of;

maintaining at least one access key in a memory of said smart card;

enabling the selection of one of the access keys;

enabling the selection of a media device;

determining the conditions for the distribution of a selected access key from said smart card to a selected media device, and if the conditions are met;

receiving a public key relating to the selected media device;

creating an encrypted copy of the selected access key, the encryption being performed according to said public key;

dispatching said encrypted copy to the selected media device; and

decrementing a counter incorporated within the smart card and associated with the selected access key, the value of said counter specifying how many more copies of the selected access key the smart card is permitted to distribute, wherein the smart card is capable of distributing more than one copy of the selected access key.

12. The system of claim 11, wherein the selected access key allows the selected media device to access data within an authorized domain.

13. The system of claim 11, wherein an initial value for the counter associated with the selected access key is set in association with the storing of the selected access key.

14. The system of claim 11, wherein the conditions for the distribution of the selected access key involves examining that the counter value associated with the selected key permits creation of the encrypted copy of the selected key.

15. The system of claim 11, wherein said program code, when executed by said processor, further causes said processor to perform the step of:

determining the selected media device'"'"'s compliance with a predetermined standard for content protection.

16. The system of claim 15, wherein determining compliance involves examining a digital certificate.

17. The system of claim 11, wherein said program code, when executed by said processor, further causes said processor to perform the steps of:

maintaining a second access key in said memory;

enabling the selection of said second access key;

determining the conditions for the distribution of the second access key to the selected media device, and if the conditions are met;

creating an encrypted copy of said second access key, the encryption being performed according to said public key;

dispatching, to the selected media device, said encrypted copy of said second access key; and

decrementing a counter associated with the second access key, the value of said counter specifying how many more copies of said second access key the smart card is permitted to distribute.

18. The system of claim 11, wherein said smart card is inserted into a smart card interface of the selected media device.

19. The system of claim 11, wherein said smart card is inserted into a smart card interface of a second media device, said second media device being operatively connected to the selected media device.