Encryption method and apparatus for use in digital distribution system

• US 7,567,671 B2
• Filed: 06/10/2005
• Issued: 07/28/2009
• Est. Priority Date: 06/10/2005
• Status: Active Grant

• Current Assignee: Aniruddha Gupte
• Original Assignee: Aniruddha Gupte
• Inventors: Gupte, Aniruddha
• Primary Examiner(s): Smithers, Matthew B
• Assistant Examiner(s): Fields, Courtney D
• Application Number:
  US11/150,526
• Publication Number:
  US 20060280303A1
• Time in Patent Office: 1,509 Days
• Field of Search: 380/239
• US Class Current: 380/239
• CPC Class Codes: H04N 21/23439 for generating different versions
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/2541 Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/25435 involving characteristics of content or additional data, e.g. video resolution or the amount of advertising
• CPC Class Codes: H04N 21/25875 involving end-user authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; arrangements for secret or secure communication including means for verifying the identity or authority of a user of the system H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/26613 for generating or managing keys in general key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/835 Generation of protective data, e.g. certificates protecting software against unauthorised usage in a vending or licensing environment G06F21/10
• CPC Class Codes: H04N 21/8355 involving usage data, e.g. number of copies or viewings allowed
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

A method to securely distribute media content such as Audio or Video with associated media information as part of a media package, in a media distribution system. The media content is encrypted and can be decrypted using a code, process or algorithm called a program key which is further encrypted and stored in the media package as one or both of a service encrypted program key or a locally encrypted program key. When a payment arrangement is not required the program key can be obtained by decrypting the locally encrypted program key, but when a payment arrangement is required, the locally encrypted program key cannot be decrypted or is not present and the service encrypted program key must be decrypted using a decryption message provided by a server after the payment arrangement is made. Media content, the locally encrypted program key and the service encrypted program key are re-encrypted periodically to ensure the security of the media package.

Claims

1. A method to securely distribute media content with associated media information as part of a media package in a media distribution system, the method comprising the steps of:

a) encrypting the media content prior to distribution and storing it as part of the media package so that it can be decrypted using a program key;

b) encrypting the program key using a first set of local hardware identifiers available on a first digital system and creating local decryption information that is used with the first set of local hardware identifiers to decrypt the encrypted program key;

c) storing the locally encrypted program key and local decryption information in the media package;

d) transferring the media package to an e-PVR in a second digital system with a second set of local hardware identifiers when presentation of the media content is requested by a user;

e) attempting to decrypt the locally encrypted program key using the local decryption information and the second set of local hardware identifiers; and

f) failing to decrypt the locally encrypted program key when first and second set of local identifiers is not the same and the first and second digital system is not the same, and succeeding when the first and second digital system is the same and the first and second hardware identifiers are the same, and when successful presenting the media content.

2. The method of claim 1 wherein the step of encrypting the program key using a first set of local hardware identifiers includes using media access control addresses of multiple devices on the local digital system as the hardware identifiers.

3. The method of claim 1 where the step of attempting to decrypt the encrypted program using local hardware identifiers involves using a common local library.

4. The method of claim 1 further including the steps of:

a) determining that a threshold has been reached;

b) attempting to decrypt the local encrypted program key;

c) determining that the locally encrypted program key was decrypted and obtaining the program key;

d) re-encrypting the program key using the first set of local hardware identifiers available on the first local digital system so that the re-encrypted program key is not the same as the locally encrypted program key and creating new local decryption information that is used with the first set of local hardware identifiers to decrypt the re-encrypted program key; and

e) storing the re-encrypted program key and the new local decryption information in the media package to replace the locally encrypted program key and local decryption information respectively.

5. The method of claim 1 also including the step of requiring that a payment be made prior to e-PVR decrypting the encrypted portion of media package prior to presenting the stored media content and when the second digital system is the same as the first digital system, the step of decrypting the portion of media package does not require a payment.

6. A method to ensure the security of a media package which includes a first decryption information used to decrypt a first encrypted portion of media package, when distributed by a media distribution service and received and stored by an e-PVR by using communication with the media distribution system, the method comprising the steps of:

a) determining that a threshold has been reached;

b) selecting the first encrypted portion of media package;

c) sending a decryption request message including a least a portion of the media information to the distribution service and receiving a re-encryption message;

d) using the re-encryption message to re-encrypt the first encrypted portion of the media package with a new encryption process, thus creating a second encrypted portion of the media package;

e) storing the second encrypted portion of the media package in the media package on the storage device to replace the first encrypted portion of media package; and

f) replacing first decryption information with a second decryption information needed to decrypt the second encrypted portion of the media package.

7. The method of claim 6, where the step of using the re-encryption message to replace the encrypted portion of the media package with a second encrypted portion of the media package further includes the steps of:

a) using the re-encryption message to decrypt the first encrypted portion of the media package to reveal an unencrypted portion of the media package;

b) using the re-encryption message to re-encrypt the unencrypted portion of the stored media package as the second encrypted portion of media package.

8. The method of claim 6, where the step of using the re-encryption message to replace the encrypted portion of the media package with a second encrypted portion of the media package instead substitutes the step of using the re-encryption message to re-encrypt the encrypted portion of the stored media package as the second encrypted portion of media package without decrypting the first encrypted portion and appending the second decryption information to the first decryption information.

9. The method of claim 6 where the step of determining that a threshold has been exceeded includes testing that a condition has been met and the condition is selected from the list of an elapsed time, a presentation count related to the number of times the media content has been presented by the e-PVR, a randomly selected time, a change to a common local library of the e-PVR, a change to a list of local hardware identifiers, and a re-encryption command sent by the media distribution service.

10. The method of claim 6 also including the step of requiring that a payment be made prior to e-PVR decrypting the encrypted portion of media package prior to presenting the stored media content and when the step of determining that a threshold has been exceeded, the step of decrypting the portion of media package does not require a payment.

11. The method of claim 6 further including the steps of:

a) encrypting the media content;

b) providing a program key that is used to decrypt the media content;

c) encrypting the program key arid storing it in the media package as the first encrypted portion of media package;

d) providing and storing decryption information as part of media package, where the decryption information is used to decrypt the encrypted program key;

e) including the decryption information as part of the decryption request messages sent to the distribution service.

12. The method of claim 6 further including the step of storing a decryption description under control of the distribution service where the decryption description is part of the re-encryption message received by the e-PVR.

13. A method to securely distribute media content with associated media information as part of a media package in a media distribution system, the method comprising the steps of:

a) encrypting the media content prior to distribution and storing it as part of the media package so that it can be decrypted using a program key;

b) encrypting the program key as a service encrypted program key so that the service encrypted program key can only be decrypted using a decryption message from a distribution service and storing the service encrypted program key as part of the media package;

c) receiving the media package by an e-PVR in response to a request by a user for presentation of the media content, the e-PVR being part of a first digital system and storing the media package;

d) decrypting the service encrypted program key revealing the program key and encrypting the program key as a locally encrypted program key so that the locally encrypted program key can only be decrypted by devices that are part of the first digital system and can only be decrypted within the parameters of associated digital rights rules and storing the locally encrypted program key and encrypted digital rights rules as part of the media package;

e) decrypting the locally encrypted program key when the media package is on the first digital system to reveal the program key; and

f) decrypting the service encrypted program key when the media package is on a second digital system to reveal the program key;

g) using the program key to decrypt and present media content.

14. The method of claim 13 further including prior to the initial step of decrypting the service encrypted program key the steps of:

a) creating service decryption information to assist with the decryption of the service encrypted program key and storing the service decryption information as a part of the media package;

b) sending a decryption request message from the first e-PVR to a distribution service where the decryption request message includes the service decryption information and a payment method and if required, a payment by a user of the first e-PVR;

c) receiving by the first e-PVR a decryption message sent from the distribution service; and

d) using the decryption message by the first e-PVR to enable the decryption of the service encrypted program key revealing the program key.

15. The method of claim 13 where the step of encrypting the program key as the locally encrypted program key includes the steps of encrypting the program key by the first e-PVR using a first set of local hardware identifiers and creating local decryption information that is used with the first set of local hardware identifiers to decrypt the locally encrypted program key and where a second e-PVR in a second digital system does not share the local hardware identifiers and so cannot decrypt the local encrypted program key.

16. The method of claim 13 wherein the step of decrypting the service encrypted program key when the media package is on a second digital system to reveal the program key includes the step of encrypting the program key as a locally encrypted program key so that locally encrypted program key can only be decrypted by devices that are part of the second digital system and can only be decrypted in association with local decryption information and digital rights rules and storing the locally encrypted program key, local decryption information and encrypted digital rights rules as part of the media package.

17. The method of claim 13 wherein the step of encrypting the program key as a locally encrypted program key uses a set of local hardware identifiers.

18. The method of claim 17 where the step of using local hardware identifiers involves using media access control addresses of multiple devices on the local digital system as the hardware identifiers.

19. The method of claim 17 wherein the step of encrypting the program key as a locally encrypted program key using local hardware identifiers involves using a common local library.

20. A method to securely distribute media content with associated media information as part of a media package in a media distribution system, the method comprising the steps of:

a) encrypting the media content prior to distribution and storing it as part of the media package;

b) creating a program key that is used to decrypt the media content;

c) encrypting the program key to create a service encrypted program key and creating service decryption information that is used with a decryption description to decrypt the encrypted program key, storing the service encrypted program key and service decryption information in the media package;

d) transferring the media package to a first e-PVR in a first digital system with a first set of local hardware identifiers when a user has requested presentation of the media content;

e) sending a decryption request message from the first e-PVR to a distribution service where the decryption request message includes the service decryption information and a payment method and if required, a payment by a user of the first e-PVR and receiving by the first e-PVR a decryption message sent from the distribution service;

f) using the decryption message by the first e-PVR to enable the decryption of the service encrypted program key revealing the program key;

g) encrypting the program key by the first e-PVR using the first set of local hardware identifiers to create a locally encrypted program key and creating local decryption information that is used with the first set of local hardware identifiers to decrypt the locally encrypted program key within the parameters of associated digital rights rules, storing the locally encrypted program key, local decryption information and encrypted digital rights rules in the media package;

h) transferring the media package to a second e-PVR on a second digital system with a second set of hardware identifiers;

i) selecting the media content for presentation by the second e-PVR and attempting to decrypt the locally encrypted program key using the local decryption information and the second set of local hardware identifiers;

j) failing to decrypt the locally encrypted program key when first and second set of local identifiers is not the same and the first and second digital system is not the same, and succeeding when the first and second digital system is the same and the first and second hardware identifiers are the same, and when successful presenting the media content.

21. The method of claim 20 when the second e-PVR has failed to decrypt the locally encrypted program key further including the steps of:

a) sending a decryption request message from the second e-PVR to a distribution service where the decryption request message includes the service decryption information and a payment method and if required, a payment by a user of the second e-PVR and receiving by the second e-PVR a decryption message sent from the distribution service;

b) using the decryption message by the second e-PVR to enable the decryption of the service encrypted program key revealing the program key;

c) encrypting the program key by the second e-PVR using a set of local hardware identifiers to create a locally encrypted program key and creating local decryption information that is used with the set of local hardware identifiers to decrypt the locally encrypted program key within the parameters of associated digital rights rules, storing the locally encrypted program key, local decryption information and encrypted digital rights rules in the media package; and

d) using the program key to decrypt and present the media content on the second e-PVR.

22. A method to secure media content where the media content is recorded by a first e-PVR that is part of a first digital system to allow unlimited use on the first digital system and to prevent use by a second e-PVR that is part of a second digital system consisting of the steps of:

a) recording the media content by the first e-PVR and storing it as part of a media package;

b) encrypting the media content and creating a program key comprising at least a portion of decryption information required to decrypt the media content;

c) encrypting the program key so that it can be decrypted only by using information related to the first digital system and storing it in the media package as a local encrypted program key; and

d) transferring media package to another e-PVR in the same local digital system;

e) decrypting the locally encrypted program key to obtain program key using locally available information;

f) using the program key obtained to decrypt media content for presentation.

23. The method of claim 22 further including the steps of:

a) transferring the media package to second e-PVR in a second digital system;

b) attempting to decrypt the locally encrypted program key using information related to the second digital system; and

c) failing to decrypt the locally encrypted program key when the information related to the second digital systems is not the same as the information related to the first digital system.