Digital rights management system and methods for provisioning content to an intelligent storage

• US 8,831,218 B2
• Filed: 04/30/2012
• Issued: 09/09/2014
• Est. Priority Date: 04/10/2012
• Status: Active Grant

• Current Assignee: JP Morgan Chase Bank, N.A. (JP Morgan Chase & Co)
• Original Assignee: Western Digital Technologies Incorporated (Western Digital Corporation)
• Inventors: Blankenbeckler, David L., Ybarra, Danny O., Hesselink, Lambertus
• Primary Examiner(s): MOORTHY, ARAVIND K
• Application Number:
  US13/460,766
• Publication Number:
  US 20130268749A1
• Time in Patent Office: 862 Days
• Field of Search: 713/153, 713/189, 380/201, 380/202, 726/26, 705/57
• US Class Current: 380/201
• CPC Class Codes: G06F 21/1014 to tokens
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G11B 20/00115 wherein the record carrier stores a unique medium identifier
• CPC Class Codes: G11B 20/00123 the record carrier being identified by recognising some of its unique characteristics, e.g. a unique defect pattern serving as a physical signature of the record carrier
• CPC Class Codes: G11B 20/00137 involving measures which result in a restriction to contents recorded on or reproduced from a record carrier to authorised users
• CPC Class Codes: G11B 20/00246 wherein the key is obtained from a local device, e.g. device key initially stored by the player or by the recorder
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority

Abstract

The present invention relates to digital rights management (DRM) for content that downloaded and saved to a storage device. The storage may be a disk drive, or network attached storage. In addition, the storage device performs cryptographic operations and provides a root of trust. The DRM employs a binding key, a content key, and an access key. The binding key binds the content to a specific storage and is based on a key that is concealed on the storage. The binding key is not stored on the storage device with the content. The content key is a key that has been assigned to the content. The access key is determined based on a cryptographic combination of the content key and the binding key. In one embodiment, the content is provisioned based on the access key and stored in encrypted form in the storage device.

Claims

1. A digital rights management system, said system comprising:

a storage device comprising a storage medium configured to store content and a storage device controller including a hardware cryptographic processor, wherein the hardware cryptographic processor is configured to generate and store a unique number, read defect information from the storage medium and perform cryptographic operations on the defect information to derive a defect number unique to the storage device, store the derived defect number on the storage medium, perform cryptographic operations on the unique number and the unique defect number to generate a binding key, and provide the binding key to a content download server;

a content key server configured to provide content keys to a content download server;

a content download server configured to perform cryptographic operations on at least a binding key received from a storage device and a content cryptographic key received from a content key server to generate an access key, encrypt at least a portion of a content with at least the content cryptographic key, provide the encrypted content to the storage device, provide the content key received from the content key server; and

a media player configured to receive a binding key and a content key from the storage device, perform cryptographic operations on the binding key and content key to generate a content cryptographic key and decrypt the content from the storage device based on the content cryptographic key.

2. The system of claim 1, wherein the media player and the storage device are configured to perform mutual authentication with each other.

3. The system of claim 1, wherein the media player is configured to generate a decryption key for accessing the content based on combining the content keys and the binding key.

4. The system of claim 1, wherein the hardware cryptographic processor is configured to generate a set of binding keys.

5. The system of claim 1, wherein the hardware cryptographic processor is configured to store a digital certificate for authenticating the media player.

6. The system of claim 5, wherein the media player is configured to authenticate with the hardware cryptographic processor based on the stored digital certificate.

7. The system of claim 1, wherein the storage device is configured as a network attached storage.

8. The system of claim 1, wherein the hardware cryptographic processor is configured to receive a private key and a public key in a secure manufacturing environment.