Platform-hardened digital rights management key provisioning

• US 9,009,854 B2
• Filed: 12/19/2012
• Issued: 04/14/2015
• Est. Priority Date: 12/19/2012
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Chhabra, Siddhartha, Lal, Reshma
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): Zarrineh, Shahriar
• Application Number:
  US13/719,907
• Publication Number:
  US 20140173756A1
• Time in Patent Office: 846 Days
• Field of Search: 726/29
• US Class Current: 726/29
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Abstract

Embodiments of an invention for platform-hardened digital rights management key provisioning are disclosed. In one embodiment, a processor includes an execution unit to execute one or more instructions to create a secure enclave in which to run an application to receive digital rights management information from a provisioning server in response to authentication of the application by a verification server.

Claims

1. A method comprising:

initiating a client in a secure enclave;

requesting, by the client, digital rights management (DRM) provisioning information from a provisioning server;

receiving, by the client from the provisioning server, a first key component;

requesting, by the client, authentication by a verification server;

generating, by the client, a second key component;

providing, by the client, proof of authentication to the provisioning server;

sending, by the client to the provisioning server, the second key component;

generating, by the client, a shared secret key;

receiving, by the client, the DRM provisioning information;

decrypting, by the client, the DRM provisioning information using the shared secret key;

sealing the DRM provisioning information to the secure enclave;

storing the sealed DRM provisioning information in a non-volatile memory;

unsealing the DRM provisioning information in the secure enclave; and

using, by the client, content from a content server without repeating the requesting of DRM provisioning information from the provisioning server.

2. The method of claim 1, wherein the digital rights management information includes a Digital Transmission Content Protection key.

3. The method of claim 1, wherein the authentication involves an Enhanced Protection ID algorithm.

4. The method of claim 1, further comprising generating, by the client, an identity report.

5. The method of claim 4, further comprising signing, by the client using an Enhanced Protection ID (EPID) private key, the identity report.

6. The method of claim 5, wherein requesting authentication includes sending the signed identity report to the verification server.

7. The method of claim 6, further comprising receiving, by the client from the verification server, proof of authentication, wherein the authentication involves verifying the signed identity report.

8. The method of claim 7, wherein verifying the signed identity report uses an EPID public key corresponding to the EPID private key.