System and method for enhanced piracy protection in a wireless personal communication device

• US 8,561,211 B1
• Filed: 05/16/2012
• Issued: 10/15/2013
• Est. Priority Date: 07/31/2001
• Status: Active Grant

• Current Assignee: Marvell Asia Pte Limited (Marvell Technology Group Limited)
• Original Assignee: Marvell International Limited (Marvell Technology Group Limited)
• Inventors: Woodward, Ernest E.
• Primary Examiner(s): PYZOCHA, MICHAEL J
• Application Number:
  US13/473,142
• Time in Patent Office: 517 Days
• Field of Search: 726/31, 380/231, 705/57
• US Class Current: 726/31
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes

Abstract

A key-sharing scheme is used to control distribution and use of video and audio content in personal digital assistants (PDAs) and other wireless devices. A private key is split into key-shares using a Blakley-Shamir key splitting technique and the key-shares are distributed to various network entities including a finance server and security server. Key-shares are also stored in a user'"'"'s subscriber identity module (SIM) and a security processor of the PDA. The key-shares from the network entities are provided to the PDA after the user requests specific video or audio content and credit verification is performed. The PDA'"'"'s security processor combines the key-shares to form the decryption key for use in playing the content by the PDA'"'"'s communications processor. When a service limit is reached, the PDA'"'"'s security processor purges the key-shares to prevent further use of the content.

Claims

1. A method of controlling content usage in a communication device, comprising:

receiving a first key-share, a second key-share, and an encrypted content over a communication link in response to a request to access the encrypted content and verification of a credit; and

combining at least the first key-share, the second key-share when the credit is verified, and a device-dependent key-share that is pre-stored in the communication device, to generate a decryption key to decrypt the encrypted content.

2. The method according to claim 1, further comprising:

receiving an authentication code provided along with the encrypted content.

3. The method according to claim 1, further comprising:

storing the device-dependent key-share in a processor of the communication device.

4. The method according to claim 1, further comprising:

purging at least one of the key-shares when usage of the decrypted content exceeds a service limit.

5. The method according to claim 1, further comprising:

retrieving a user-dependent key-share from a subscriber identity module (SIM) inserted into the communication device, the user-dependent key-share being used in part to decrypt the encrypted content.

6. The method according to claim 5, wherein the user-dependent key-share is pre-stored in the subscriber identity module (SIM).

7. The method according to claim 1, further comprising:

prohibiting storage of the decrypted content.

8. A method of controlling content usage in a communication device using a decryption key that is divided into a plurality of key-shares, the method comprising:

providing the communication device a first key-share in response to a request for content; and

verifying a credit by a finance server in communication with the communication device;

providing to the communication device a second key-share when the credit is verified by the finance server; and

combining the first and second key-shares with a third key-share that is device dependent and pre-stored in the communication device for use in decrypting the content.

9. The method according to claim 8, further comprising:

monitoring usage of the content with a security processor of the communication device.

10. The method according to claim 9, further comprising:

receiving the request for the content from the communication device, the request identifying the content.

11. The method according to claim 8, further comprising:

receiving the content from a security server;

encrypting the content in the security server with an encryption key; and

providing the encrypted content from the security server to the communication device over a communication link.

12. The method according to claim 11, wherein a content server and the security server communicate over a non-secure network, and the method includes the content server adding security to the content prior to providing the content to the security server.

13. The method according to claim 8, wherein the providing the first key-share is performed by a security server in communication with the communication device.

14. The method according to claim 8, wherein the third key-share is stored in a subscriber identity module (SIM) associated with a user, and wherein a fourth key-share is stored in the communication device and associated with a security processor of the communication device, and wherein the security processor combines the first, second, third and fourth key-shares to decrypt the content.

15. The method according to claim 8, wherein the content comprises at least one of video content and music content.

16. A device, comprising:

an interface configured to receive a first key-share, a second key-share, and encrypted content over a communication link in response to a request to access the encrypted content and verification of a credit; and

a hardware processor configured to combine at least the first key-share, the second key-share when the credit is verified, and a device-dependent key-share that is pre-stored in the device, to generate a decryption key to decrypt the encrypted content.

17. The device according to claim 16, wherein the interface is further configured to receive an authentication code provided along with the encrypted content.

18. The device according to claim 16, wherein the hardware processor is further configured to store the device-dependent key-share.

19. The device according to claim 16, wherein the hardware processor is further configured to purge at least one of the key-shares when usage of the decrypted content exceeds a service limit.

20. The device according to claim 16, wherein the hardware processor is further configured to retrieve a user-dependent key-share from a subscriber identity module (SIM) inserted into the device, the user-dependent key-share being used in part to decrypt the encrypted content.

21. A method of controlling content usage in a communication device, comprising:

receiving a first key-share, a second key-share, and encrypted content over a communication link in response to a request to access the encrypted content and verification of a credit; and

combining at least the first key-share, the second key-share that is received from a server that maintains finance information when the credit is verified, and a device-dependent key-share that is pre-stored in the communication device, to generate a decryption key to decrypt the encrypted content.