Method and apparatus for secure key delivery for decrypting bulk digital content files at an unsecure site

• US 8,130,963 B2
• Filed: 12/11/2007
• Issued: 03/06/2012
• Est. Priority Date: 07/08/2003
• Status: Active Grant

• Current Assignee: Bruker Daltonics, Inc. (Bruker Corporation), Callahan Cellular LLC (Intellectual Ventures LLC)
• Original Assignee: Imophaze Research Co LLC (Intellectual Ventures LLC)
• Inventors: Deaver, John, Klebe, Skott C., Johnson, Woodrow W.
• Primary Examiner(s): SHAN, APRIL YING
• Application Number:
  US11/953,983
• Publication Number:
  US 20080181414A1
• Time in Patent Office: 1,547 Days
• Field of Search: 380/238, 380/239, 380/277, 380/28, 380/278, 380/37, 380/225, 380/228, 705/51, 705/59, 713/193, 713/165, 726/26
• US Class Current: 380/278
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04N 2005/91364 the video signal being scrambled
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/4623 Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/631 Multimode Transmission, e.g. transmitting basic layers and enhancement layers of the content over different transmission paths or transmitting with different error corrections, different keys or with different transmission protocols
• CPC Class Codes: H04N 21/63345 by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 5/913 for scrambling ; for copy protection

Abstract

Rather than downloading each content document on demand from the publisher location to the user site, at the publisher location, each content document is encrypted and then multiple encrypted documents are assembled into a distribution archive that is itself encrypted with a scheduled key. The distribution archive is then downloaded into a content server at the user site. When the content server receives the distribution archive, it decrypts the archive file and unpacks the encrypted documents. The scheduled key used to decrypt an archive file is included with an archive file that was sent previously to the user site in accordance with the subscription service. The scheduled key to decrypt the first archive file sent to the user is sent from the publisher to the user over a communication channel different from the communication channel used to send the archive file from the publisher to the user.

Claims

1. A method comprising:

a server computing device encrypting each of a plurality of digital content documents with a corresponding key to generate corresponding encrypted document content for each of the plurality of digital content documents;

the server computing device computing for each digital content document a document identifier that is computed from, but cannot be derived solely from, each digital content document'"'"'s corresponding encrypted document content, wherein the computing for each digital content document a document identifier further includes using a text string embedded in program code in the server computing device;

the server computing device creating a key pair list of document identifier and decryption key pairs;

the server computing device assembling each digital content document'"'"'s corresponding encrypted document content and the key pair list into a distribution archive file; and

the server computing device encrypting the distribution archive file with a scheduled key unique to the distribution archive file.

2. The method of claim 1, wherein the distribution archive file includes another scheduled key for a distribution archive file next to the distribution archive file in a stream of distribution archive files.

3. The method claim 1, wherein the distribution archive file includes a non-encrypted scheduled key for a distribution archive file next to the distribution archive file in a stream of distribution files.

4. The method of claim 1, wherein the distribution archive file includes an encrypted newly generated scheduled key.

5. A non-transitory computer-readable medium having executable computer instructions stored therein, the instructions comprising:

instructions for encrypting each digital content document with a key to generate encrypted document content at a publishing site;

instructions for computing each digital content document a document identifier that is computed from, but cannot derived solely from, the encrypted document content at the publishing site, wherein the instructions for computing for each digital content document a document identifier further includes using a text string embedded in program code in the publishing site;

instructions for creating a list of document identifier and decryption key pairs at the publishing site;

instructions for assembling the encrypted document content for each digital content document and the key pair list into a distribution archive file at the publishing site;

instructions for encrypting the distribution archive file with a scheduled key unique to that distribution archive file at the publishing site and for placing the encrypted distribution file on a stream of distribution archive files from the publishing site to an unsecured site.

6. The non-transitory computer-readable medium of claim 5, wherein the instructions further comprises program code for recomputing a document identifier with a text string embedded in program code located at the unsecured site.

7. The non-transitory computer-readable medium of claim 6 wherein the text string embedded in program code at the publishing site is the same as the text string embedded in program code at the unsecured site.

8. An apparatus, comprising:

a server computing device;

a memory device containing one or more programs which when executed, implementing operations of;

encrypting each of a plurality of digital content documents with a corresponding key to generate corresponding encrypted document content for each of the plurality of digital content documents;

computing for each digital content document a document identifier that is computed from, but cannot be derived solely from, each digital content document'"'"'s corresponding encrypted document content, wherein the computing for each digital content document a document identifier further includes using a text string embedded in program code in the server computing device;

creating a key pair list of document identifier and decryption key pairs;

assembling each digital content document'"'"'s corresponding encrypted document content and the key pair list into a distribution archive file; and

encrypting the distribution archive file with a scheduled key unique to the distribution archive file.

9. The apparatus of claim 8, wherein the distribution archive file includes another scheduled key for a distribution archive file next to the distribution archive file in a stream of distribution archive files.

10. The apparatus of claim 8, wherein the distribution archive file includes a non-encrypted scheduled key for a distribution archive file next to the distribution archive file in a stream of distribution archive files.

11. The apparatus of claim 8, wherein the distribution archive file includes an encrypted newly generated schedule key.