Technique for securely communicating and storing programming material in a trusted domain

• US 9,083,513 B2
• Filed: 09/10/2012
• Issued: 07/14/2015
• Est. Priority Date: 07/20/2004
• Status: Active Grant

• Current Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Original Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Inventors: Helms, William, Hayashi, Michael T., Leddy, Kevin J., Christman, David A.
• Primary Examiner(s): Gergiso, Techane
• Application Number:
  US13/608,969
• Publication Number:
  US 20130070922A1
• Time in Patent Office: 1,037 Days
• Field of Search: 380/200, 713/171
• US Class Current: 1/1
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/26613 for generating or managing keys in general key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/6334 for authorisation, e.g. by transmitting a key wireless communications network key management H04W12/04; wireless communications network access security H04W12/08
• CPC Class Codes: H04N 21/63775 for uploading keys, e.g. for a client to communicate its public key to the server key management H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

A “trusted domain” is established within which content received from a communications network, e.g., a cable TV network, is protected from unauthorized copying thereof, in accordance with the invention. In an illustrative embodiment, the trusted domain includes a device associated with a user which receives content from the cable TV network. The content may be encrypted using a content key in accordance, e.g., with a 3DES encryption algorithm before it is stored in the device. In addition, a first encrypted content key version and a second encrypted content key version are generated by respectively encrypting the content key with a public key associated with the device and another public key associated with the user, in accordance with public key cryptography. The first and second encrypted content key versions are stored in association with the encrypted content in the device storage. The encrypted content can be migrated from a first device to a second device, and can be decrypted in the second device in the second device is associated with the same user, and also provided with the second encrypted content key version.

Claims

1. A method for use in a first client device of a content distribution network for decrypting encrypted content with a cryptographic element, said network comprising at least a network entity and a plurality of client devices, said method comprising:

receiving said encrypted content at said first client device from a second client device;

receiving a first encrypted version of said cryptographic element at said first client device from said second client device, said first encrypted version of said cryptographic element being generated by encrypting said cryptographic element using a second cryptographic element associated with a common user of said first and second devices;

receiving a second encrypted version of said cryptographic element at said first device from said network entity;

deriving said cryptographic element using at least one of said first and second encrypted versions of said cryptographic element; and

decrypting said encrypted content using said cryptographic element.

2. The method of claim 1, wherein said method further comprises providing said first encrypted version of said cryptographic element to said network entity, said network entity adapted to recover said cryptographic element based at least in part on said first encrypted version of said cryptographic element and data representative of said common user, and generate said second encrypted version of said cryptographic element.

3. The method of claim 2, wherein said second encrypted version of said cryptographic element is generated by encrypting said cryptographic element using a third cryptographic element, said third cryptographic element being associated with said first client device, said network entity providing said second encrypted version of said cryptographic element to said first client device.

4. The method of claim 1, wherein said content distribution network comprises a managed network, said second client device comprises a set-top box, and said first client device comprises a digital video recorder (DVR).

5. The method of claim 4, wherein said set-top box comprises at least a portion of a trusted domain.

6. The method of claim 1, wherein said first and said second cryptographic elements comprise encryption keys generated in accordance with a public key encryption algorithm.

7. Network apparatus configured to enable decryption of encrypted content in a client premises device (CPE) remote from said network apparatus, said encrypted content in said device being decrypted using a content key, said network apparatus comprising:

an interface configured to receive a first encrypted content key from said CPE remote from said network apparatus;

a database configured to, upon a query, determine a user of said CPE, and to supply a first cryptographic element associated with said user of said CPE;

an entity configured to recover said content key via decryption of said first encrypted content key using said first cryptographic element;

an apparatus configured to generate a second encrypted content key via encryption of said recovered content key using a second cryptographic element associated with said CPE; and

a server configured to provide at least said second encrypted content key to said CPE, said content key recoverable based at least on said second encrypted content key.

8. The apparatus of claim 7, wherein said first cryptographic element is identified based on at least data representative of said user of said CPE.

9. The apparatus of claim 8, wherein said data includes an identity of said user.

10. The apparatus of claim 7, wherein said content key includes a secret key in accordance with a Data Encryption Standard (DES) technique.

11. The apparatus of claim 7, wherein said first cryptographic element includes an encryption key in accordance with a public key algorithm.

12. The apparatus of claim 7, wherein said second cryptographic element includes an encryption key in accordance with a public key algorithm.

13. The apparatus of claim 7, wherein said content includes entertainment programming content.

14. A client device configured to decrypt encrypted content using a cryptographic element, said client device in communication with a content distribution network, said network comprising at least a network entity and a plurality of second client devices, said client device comprising:

a first interface configured to receive said encrypted content from one of said plurality of second client devices;

a second interface configured to receive a first encrypted version of said cryptographic element from said one of said plurality of second client devices, said first encrypted version of said cryptographic element being generated via encryption of said cryptographic element using a second cryptographic element associated with a common user of said client device and said one of said plurality of second client devices;

a third interface configured to receive a second encrypted version of said cryptographic element from said network entity;

a processor apparatus configured to execute at least computer program, said computer program comprising a plurality of instructions which are configured to, when executed;

derive said cryptographic element using at least one of said first and second encrypted versions of said cryptographic element; and

decrypt said encrypted content using said cryptographic element.

15. The client device of claim 14, wherein said plurality of instructions are further configured to, when executed, provide said first encrypted version of said cryptographic element to said network entity, said network entity configured to recover said cryptographic element based at least in part on said first encrypted version of said cryptographic element and data representative of said common user, and generate said second encrypted version of said cryptographic element.

16. The client device of claim 15, wherein said second encrypted version of said cryptographic element is generated via encryption of said cryptographic element using a third cryptographic element, said third cryptographic element being associated with said client device;

and

wherein said client device further comprises an interface configured to receive said second encrypted version of said cryptographic element from said network entity.

17. The client device of claim 14, wherein said content distribution network comprises a managed network, said one of said plurality of second client devices comprises a set-top box, and said client device comprises a digital video recorder (DVR).

18. The client device of claim 17, wherein said set-top box comprises at least a portion of a trusted domain.

19. The client device of claim 14, wherein at least one of said first and said second cryptographic elements comprises an encryption key generated in accordance with a public key encryption algorithm.