Systems and methods for providing secure server key operations

• US 7,443,985 B2
• Filed: 08/23/2006
• Issued: 10/28/2008
• Est. Priority Date: 06/28/2002
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Yarmolenko, Vladimir, Cottrille, Scott C., Krishnaswamy, Vinay, Kostal, Gregory, Narin, Attila
• Primary Examiner(s): Barron, Jr.; Gilberto
• Assistant Examiner(s): Lemma; Samson B
• Application Number:
  US11/508,437
• Publication Number:
  US 20060280309A1
• Time in Patent Office: 797 Days
• Field of Search: 380/277, 380/278
• US Class Current: 380/278
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

A key management interface that allows for different key protection schemes to be plugged into a digital rights management system is disclosed. The interface exposes the functionality of signing data, decrypting data encrypted using a public key, and re-encrypting data encrypted using the public key exported by the interface to a different authenticated principal (i.e., a different public key). Thus, a secure interface can be provided such that the data does not enter or leave the interface in the clear. Such an interface exports private key operations of signing and decryption, and provides security and authentication for the digital asset server in licensing and publishing. During publishing, a client can encrypt asset keys such that only a specified entity can decrypt it, using a plug-in, for example, that implements the aforementioned interface. During licensing, the license issuing entity can use the interface to decrypt keys for assets and to sign licenses and rights labels such that the asset is protected and consumable by a host digital rights management platform. The interface thus provides an abstraction for key operations.

Claims

1. A method for providing secure server key operations in a system comprising a front-end server that is accessible via a global communications network and a back-end server that is coupled to the front-end server via a local communications network, the method comprising:

generating, on the front-end server, a certificate signing public-private key pair for use in connection with signing a certificate, wherein the certificate signing public-private key pair includes a certificate signing public key and a certificate signing private key;

generating a content protection public-private key pair for use in connection with encrypting or decrypting a piece of digital content, wherein the content protection public-private key pair includes a content protection public key and a content protection private key;

storing the certificate signing private key on the front-end server;

storing the content protection private key on the back-end server so as to avoid such content protection private key from being directly accessible via the global communications network; and

providing to a client application, a certificate chain that includes the certificate signing public key and the content protection public key.

2. The method of claim 1, further comprising:

signing a certificate using the certificate signing private key; and

providing the signed certificate to the client application.

3. The method of claim 1, further comprising:

receiving a request for a signing licensor certificate; and

providing, in response to the request, a licensor certificate signed using certificate signing private key.

4. The method of claim 1, wherein the certificate chain enables the client application to encrypt the piece of digital content to the content protection public key.

5. The method of claim 1, wherein the certificate chain enables the client application to decrypt an encrypted piece of digital content that has been encrypted to the content protection public key.

6. The method of claim 1, wherein the certificate chain enables the client application to encrypt a content protection symmetric key to the content protection public key.

7. The method of claim 1, wherein the certificate chain enables the client application to decrypt an encrypted content protection symmetric key that has been encrypted to the content protection public key.

8. A method for providing secure server key operations in a system comprising a front-end server that is accessible via a global communications network and a back-end server that is coupled to the front-end server via a local communications network, the method comprising:

generating a content protection public-private key pair for use in connection with encrypting or decrypting a content symmetric key used to protect a piece of digital content, wherein the content protection public-private key pair includes a content protection public key and a content protection private key;

storing the content protection private key on the back-end server so as to avoid such content protection private key from being directly accessible via the global communications network;

generating, on the front-end server, a certificate signing public-private key pair, wherein the certificate signing public-private key pair includes a certificate signing public key and a certificate signing private key;

storing the certificate signing private key on the front-end server; and

publishing the content protection public key via a root licensor certificate that is signed using the certificate signing private key.

9. The method of claim 8, wherein the root licensor certificate is signed by a trusted entity.

10. The method of claim 8, further comprising:

publishing the certificate signing public key via a signing licensor certificate.

11. The method of claim 8, wherein the signing licensor certificate is signed, on the back-end server, using a digital signature that is based on the content protection private key.

12. A method for providing secure server key operations in a digital rights management system, the method comprising:

generating a root public-private key pair that includes a root private key and a root public key for use in connection with signing a certificate, wherein the certificate signing public-private key pair includes a certificate signing public key and a certificate signing private key;

issuing a root licensor certificate that contains the root public key;

periodically generating a current rolling public-private key pair that includes a current rolling public key and a current rolling private key for use in connection with encrypting or decrypting a content symmetric key used to protect a piece of digital content, wherein the content protection public-private key pair includes a content protection public key and a content protection private key;

receiving a request from a client application to perform a digital rights management operation; and

performing the digital rights management operation using the current rolling public-private key pair,

each current rolling public-private key being generated and stored on a back-end server coupled via a local communications network to a front-end server that is accessible via a global communications network, the root private key being stored on the front-end server, each current rolling private key being stored at the back-end server so as to avoid such current rolling private key from being directly accessible via the global communications network.

13. The method of claim 12, wherein the request to perform the digital rights management operation is a request for a signed rights label, and

wherein performing the digital rights management operation comprises signing a rights label using the current rolling private key, wherein the rights label includes rights data that represents a set of parameters for licensing a piece of digital content and, for each of one or more authorized users, a respective set of one or more rights that the authorized user has in the digital content.

14. The method of claim 13, wherein the received rights label includes an encrypted content key that was encrypted to the current rolling public key.

15. The method of claim 13, further comprising:

providing the signed rights label to a client application.

16. The method of claim 12, wherein the request to perform the digital rights management operation is a request for a licensor certificate, and

wherein performing the digital rights management operation comprises providing to a client application a current licensor certificate enables the client application to encrypt a content key to the current rolling public key, wherein the content key is used to encrypt or decrypt a piece of digital content.

17. The method of claim 12, wherein the request to perform the digital rights management operation is a request for a license to use a piece of digital content, and

wherein performing the digital rights management operation comprises using the current rolling private key to determine whether to issue a license to use to piece of digital content.

18. The method of claim 17, further comprising:

issuing a license to use the piece of digital content.

19. The method of claim 18, further comprising:

re-encrypting a content key to a user-supplied persona key that ties the piece of digital content to a user requesting the license.