System and method for decentralized management of keys and policies

• US 8,831,228 B1
• Filed: 08/28/2009
• Issued: 09/09/2014
• Est. Priority Date: 08/28/2009
• Status: Active Grant

• Current Assignee: Adobe Inc.
• Original Assignee: Adobe Systems Incorporated (Adobe Inc.)
• Inventors: Agrawal, Sunil C., Nadell, Katherine K.
• Primary Examiner(s): Kim, Jung
• Assistant Examiner(s): Alata, Ayoub
• Application Number:
  US12/550,264
• Publication Number:
  US 20140289525A1
• Time in Patent Office: 1,838 Days
• Field of Search: 713/171, 713/175, 380/283, 380/277, 380/278, 380/279, 380/286, 726/27, 726/28
• US Class Current: 380/286
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds

Abstract

Various embodiments of a system and method for decentralized management of keys and policies are described. Various embodiments may include a computer system configured to receive a request from a remote computer system associated with a recipient of content. Such request may include an encrypted content encryption key that is encrypted with a packaging key utilized by a packaging entity. The request may also include an identifier identifying the packaging entity. In some embodiments, the request may also include policy information specifying one or more usage rights of the content. The computer system may be configured to, in response to determining the recipient is authorized to access the content, generate the packaging key based on the identifier and a secret root seed, utilize the generated packaging key to decrypt the encrypted content encryption key, and provide the decrypted content encryption key to the remote computer system.

Claims

1. A computer-implemented method, comprising:

receiving, by a licensing system, an encrypted content encryption key from a remote computer system and a packaging entity identifier, wherein the packaging entity identifier identifies a packaging entity providing encrypted content to a content recipient associated with the remote computer system, wherein the encrypted content encryption key is encrypted by the packaging entity using a packaging key;

generating, by the licensing system, the packaging key based on the packaging entity identifier and a secret root seed, wherein the secret root seed is inaccessible to the remote computer system and the packaging entity;

decrypting, by the licensing system, the encrypted content encryption key with the generated packaging key to generate a decrypted content encryption key; and

providing, by the licensing system, the decrypted content encryption key to the remote computer system for decrypting the encrypted content.

2. The method of claim 1, further comprising:

accessing a policy provided by the packaging entity and included in a request received from the remote computer system to decrypt the encrypted content encryption key, wherein the policy is signed by the packaging entity with a digital signature;

verifying, based on the digital signature, an absence of tampering with the policy as provided by the packaging entity; and

determining that the content recipient is authorized to access the encrypted content using the policy.

3. The method of claim 1, further comprising:

receiving a policy from the remote computer system specifying at least one usage right;

generating a content license restricting use of the encrypted content based on the at least one usage right, wherein the at least one usage right comprises at least one of restricting use of the encrypted content to a specified time period and restricting actions that can be performed with respect to the encrypted content; and

providing the content license to the remote computer system.

4. The method of claim 1, further comprising:

receiving a policy from the remote computer system specifying at least one first usage right;

obtaining a policy update from the packaging entity, wherein the policy update replaces the at least one first usage right with at least one second usage right;

modifying the policy using the policy update to reflect the at least one second usage right;

generating a content license restricting use of the encrypted content based on the at least one second usage right specified by the policy as modified; and

providing the content license to the remote computer system.

5. The method of claim 1, wherein providing the encrypted content encryption key to the remote computer system comprises:

encrypting a message including the encrypted content encryption key as decrypted by the packaging key, the message encrypted with an encryption key that corresponds to a decryption key accessible to the remote computer system; and

providing the encrypted message to the remote computer system.

6. The method of claim 1, wherein the method further comprises authenticating the content recipient.

7. The method of claim 1, further comprising:

assigning, by the licensing system, the packaging entity identifier to the packaging entity;

generating, by the licensing system, the packaging key based on the secret root seed and the packaging entity identifier, wherein the secret root seed is unknown to the packaging entity; and

providing, by the licensing system, the packaging entity identifier and the packaging key to the packaging entity.

8. The method of claim 7, further comprising:

assigning, by the licensing system, an additional packaging entity identifier that is different from the packaging entity identifier to an additional packaging entity different from the packaging entity;

generating, by the licensing system, an additional packaging key that is different from the packaging key based on the secret root seed and the additional packaging entity identifier;

providing, by the licensing system, the additional packaging entity identifier and the additional packaging key to the additional packaging entity.

9. The method of claim 7, wherein the packaging entity identifier and the packaging key are provided to the packaging entity prior to receiving a request from the remote computer system to decrypt the encrypted content encryption key.

10. The method of claim 7, wherein the packaging entity identifier and the packaging key are provided to the packaging entity via secure communication using a one-time network connection.

11. The method of claim 7, further comprising deleting, by the licensing system, the packaging key from a memory of the licensing system after providing the packaging entity identifier and the packaging key to the packaging entity, wherein the packaging key is regenerated by the licensing system after receiving a request from the remote computer system to decrypt the encrypted content encryption key.

12. A licensing system comprising:

a memory; and

at least one processor coupled to the memory, wherein the at least one processor is configured to execute program instructions stored in the memory, wherein the program instructions are configured for;

receiving an encrypted content encryption key from a remote computer system and a packaging entity identifier, wherein the packaging entity identifier identifies a packaging entity providing encrypted content to a content recipient associated with the remote computer system, wherein the encrypted content encryption key is encrypted by the packaging entity using a packaging key,

generating the packaging key based on the packaging entity identifier and a secret root seed, wherein the secret root seed is inaccessible to the remote computer system and the packaging entity,

decrypting the encrypted content encryption key with the generated packaging key to generate a decrypted content encryption key, and

providing the decrypted content encryption key to the remote computer system for decrypting the encrypted content.

13. The licensing system of claim 12, wherein the decrypted content encryption key is a symmetric key for decrypting the encrypted content.

14. The licensing system of claim 12, wherein the program instructions are further configured for:

accessing a policy provided by the packaging entity and included in a request received from the remote computer system to decrypt the encrypted content encryption key, wherein the policy is signed by the packaging entity with a digital signature;

verifying, based on the digital signature, an absence of tampering with the policy as provided by the packaging entity; and

determining that the content recipient is authorized to access the encrypted content using the policy.

15. The licensing system of claim 12, wherein the program instructions are further configured for:

receiving a policy from the remote computer system specifying at least one usage right;

generating a content license restricting use of the encrypted content based on the at least one usage right, wherein the at least one usage right comprises at least one of restricting use of the encrypted content to a specified time period and restricting actions that can be performed with respect to the encrypted content; and

providing the content license to the remote computer system.

16. The licensing system of claim 12, wherein the program instructions are further configured for:

receiving a policy from the remote computer system specifying at least one first usage right;

obtaining a policy update from the packaging entity, wherein the policy update replaces the at least one first usage right with at least one second usage right;

modifying the policy using the policy update to reflect the at least one second usage right;

generating a content license restricting use of the encrypted content based on the at least one second usage right specified by the policy as modified; and

providing the content license to the remote computer system.

17. The licensing system of claim 12, wherein generating the packaging key comprises performing a cryptographic hash function on the packaging entity identifier and the secret root seed to generate a result, wherein the generated packaging key is the result of the cryptographic hash function.

18. The licensing system of claim 12, wherein utilizing the generated packaging key to decrypt the encrypted content encryption key comprises utilizing the generated packaging key as a symmetric key to decrypt the encrypted content encryption key according to a symmetric decryption process.

19. The licensing system of claim 12, wherein providing the encrypted content encryption key to the remote computer system comprises:

encrypting a message including the encrypted content encryption key as decrypted by the packaging key, the message encrypted with an encryption key that corresponds to a decryption key accessible to the remote computer system; and

providing the encrypted message to the remote computer system.

20. The licensing system of claim 12, wherein the encrypted content is an encrypted electronic mail message.

21. The licensing system of claim 12, wherein the program instructions are further configured for authenticating the content recipient.

22. The licensing system of claim 12, wherein the program instructions are further configured for:

assigning the packaging entity identifier to the packaging entity;

generating, by the licensing system, the packaging key based on the secret root seed and the packaging entity identifier, wherein the secret root seed is unknown to the packaging entity; and

providing, by the licensing system, the packaging entity identifier and the packaging key to the packaging entity.

23. The licensing system of claim 22, wherein the program instructions are further configured for:

assigning an additional packaging entity identifier that is different from the packaging entity identifier to an additional packaging entity different from the packaging entity;

generating, by the licensing system, an additional packaging key that is different from the packaging key based on the secret root seed and the additional packaging entity identifier;

providing, by the licensing system, the additional packaging entity identifier and the additional packaging key to the additional packaging entity.

24. The licensing system of claim 22, wherein the packaging entity identifier and the packaging key are provided to the packaging entity prior to receiving a request from the remote computer system to decrypt the encrypted content encryption key.

25. The licensing system of claim 22, wherein the packaging entity identifier and the packaging key are provided to the packaging entity via secure communication using a one-time network connection.

26. The licensing system of claim 22, wherein the program instructions are further configured for deleting the packaging key from the memory of the licensing system after providing the packaging entity identifier and the packaging key to the packaging entity, wherein the packaging key is regenerated by the licensing system after receiving a request from the remote computer system to decrypt the encrypted content encryption key.

27. The licensing system of claim 22, wherein the licensing system comprises a trusted group of licensing servers, wherein the secret root seed is accessible to each licensing server of the trusted group of licensing servers, wherein the trusted group includes a licensing server having the memory and the at least one processor in a first geographic area and an additional licensing server having an additional memory and at least one additional processor in a second geographic area, wherein the at least one additional processor is configured to execute program instructions stored in the additional memory, wherein the program instructions are further configured for:

receiving the encrypted content encryption key,

generating the packaging key based on the packaging entity identifier and the secret root seed accessible to the licensing server and the additional licensing server;

decrypting the encrypted content encryption key with the generated packaging key to generate the decrypted content encryption key; and

providing the decrypted content encryption key to the remote computer system for decrypting the encrypted content.

28. A non-transitory computer-readable medium storing program instructions computer-executable on a computer system, the program instructions comprising:

program instructions for receiving an encrypted content encryption key from a remote computer system and a packaging entity identifier, wherein the packaging entity identifier identifies a packaging entity providing encrypted content to a content recipient associated with the remote computer system, wherein the encrypted content encryption key is encrypted by the packaging entity using a packaging key;

program instructions for receiving generating the packaging key based on the packaging entity identifier and a secret root seed, wherein the secret root seed is inaccessible to the remote computer system and the packaging entity;

program instructions for receiving decrypting the encrypted content encryption key with the generated packaging key to generate a decrypted content encryption key; and

program instructions for receiving providing the decrypted content encryption key to the remote computer system for decrypting the encrypted content.

29. The non-transitory computer-readable medium of claim 28, wherein the decrypted content encryption key is a symmetric key for decrypting the encrypted content.

30. The non-transitory computer-readable medium of claim 28, further comprising:

program instructions accessing a policy provided by the packaging entity and included in a request received from the remote computer system to decrypt the encrypted content encryption key, wherein the policy is signed by the packaging entity with a digital signature;

program instructions for verifying, based on the digital signature, an absence of tampering with the policy as provided by the packaging entity; and

program instructions for determining that the content recipient is authorized to access the encrypted content using the policy.

31. The non-transitory computer-readable medium of claim 28, further comprising:

program instructions for receiving a policy from the remote computer system specifying at least one usage right;

program instructions for generating a content license restricting use of the encrypted content based on the at least one usage right, wherein the at least one usage right comprises at least one of restricting use of the encrypted content to a specified time period and restricting actions that can be performed with respect to the encrypted content; and

program instructions for providing the content license to the remote computer system.

32. The non-transitory computer-readable medium of claim 28, further comprising:

program instructions for receiving a policy from the remote computer system specifying at least one first usage right;

program instructions for obtaining a policy update from the packaging entity, wherein the policy update replaces the at least one first usage right with at least one second usage right;

program instructions for modifying the policy using the policy update to reflect the at least one second usage right;

program instructions for generating a content license restricting use of the encrypted content based on the at least one second usage right specified by the policy as modified; and

program instructions for providing the content license to the remote computer system.

33. The non-transitory computer-readable medium of claim 28, wherein generating the packaging key comprises performing a cryptographic hash function on the packaging entity identifier and the secret root seed to generate a result, wherein the generated packaging key is the result of the cryptographic hash function.

34. The non-transitory computer-readable medium of claim 28, wherein utilizing the generated packaging key to decrypt the encrypted content encryption key comprises utilizing the generated packaging key as a symmetric key to decrypt the encrypted content encryption key according to a symmetric decryption process.

35. The non-transitory computer-readable medium of claim 28, wherein providing the encrypted content encryption key to the remote computer system comprises:

encrypting a message including the encrypted content encryption key as decrypted by the packaging key, the message encrypted with an encryption key that corresponds to a decryption key accessible to the remote computer system; and

providing the encrypted message to the remote computer system.

36. The non-transitory computer-readable medium of claim 28, wherein the encrypted content is an encrypted electronic mail message.

37. The non-transitory computer-readable medium of claim 28, further comprising program instructions for authenticating the content recipient.

38. The non-transitory computer-readable medium of claim 28, further comprising:

program instructions for assigning the packaging entity identifier to the packaging entity;

program instructions for generating the packaging key based on the secret root seed and the packaging entity identifier, wherein the secret root seed is unknown to the packaging entity; and

program instructions for providing the packaging entity identifier and the packaging key to the packaging entity.

39. The non-transitory computer-readable medium of claim 28, further comprising:

program instructions for assigning an additional packaging entity identifier that is different from the packaging entity identifier to an additional packaging entity different from the packaging entity;

program instructions for generating an additional packaging key that is different from the packaging key based on the secret root seed and the additional packaging entity identifier;

program instructions for providing the additional packaging entity identifier and the additional packaging key to the additional packaging entity.

40. The non-transitory computer-readable medium of claim 28, wherein the packaging entity identifier and the packaging key are provided to the packaging entity prior to receiving a request from the remote computer system to decrypt the encrypted content encryption key.

41. The non-transitory computer-readable medium of claim 28, wherein the packaging entity identifier and the packaging key are provided to the packaging entity via secure communication using a one-time network connection.

42. The non-transitory computer-readable medium of claim 41, further comprising program instructions for deleting the packaging key from a memory after providing the packaging entity identifier and the packaging key to the packaging entity, wherein the packaging key is regenerated by the licensing server after receiving a request from the remote computer system to decrypt the encrypted content encryption key.