Method for broadcast encryption and key revocation of stateless receivers

• US 7,698,551 B2
• Filed: 04/28/2005
• Issued: 04/13/2010
• Est. Priority Date: 01/26/2001
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Lotspiech, Jeffrey Bruce, Naor, Dalit, Naor, Simeon
• Primary Examiner(s): NGUYEN, MINH DIEU T
• Application Number:
  US11/117,677
• Publication Number:
  US 20050195980A1
• Time in Patent Office: 1,811 Days
• Field of Search: 713162-163, 380/277, 705/50, 725/31, 709202-203, 709217-219, 709227-229
• US Class Current: 713/163
• CPC Class Codes: G11B 20/0021 involving encryption or decryption of contents recorded on or reproduced from a record carrier
• CPC Class Codes: H04L 12/18 for broadcast or conference , e.g. multicast
• CPC Class Codes: H04L 2209/605 Copy protection
• CPC Class Codes: H04L 2209/606 Traitor tracing
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/0836 using tree structure or hierarchical structure
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

A tree is used to partition stateless receivers in a broadcast content encryption system into subsets. Two different methods of partitioning are disclosed. When a set of revoked receivers is identified, the revoked receivers define a relatively small cover of the non-revoked receivers by disjoint subsets. Subset keys associated with the subsets are then used to encrypt a session key that in turn is used to encrypt the broadcast content. Only non-revoked receivers can decrypt the session key and, hence, the content.

Claims

1. A digital processing apparatus accessing a computer readable storage medium storing logic, the logic comprising:

assigning each user in a group of users respective private information I_u;

selecting at least one session encryption key K;

partitioning users not in a revoked set R into disjoint subsets S_il, . . . S_im having associated subset keys L_il, . . . L_im;

encrypting the session key K with the subset keys L_il, . . . , L_im to render m encrypted versions of the session key K;

identifying subsets of users using a subset difference routine wherein respective groups of users correspond to a universe of sets S_l, . . . , S_w that can be described as “

a first subtree A minus a second subtree B that is entirely contained in A”

with each node in the tree having a set of labels, one unique to the node and others that are induced by ancestor nodes and with each user being assigned labels from all nodes hanging from nodes in a direct path between the user and the root but not from nodes in the direct path itself, further comprising;

partitioning the users into groups S_l, . . . , S_w, wherein “

w”

is an integer, and the groups establish subtrees in a tree;

using private information I_u to decrypt the session key, wherein the act of decrypting includes using information i_j such that a user belongs to a subset S_ij, and retrieving a subset key L_ij using the private information of the user.