Secure multimedia transfer system

• US 9,854,289 B2
• Filed: 08/15/2014
• Issued: 12/26/2017
• Est. Priority Date: 03/02/2000
• Status: Expired due to Fees

• Current Assignee: TiVo Solutions Inc. (Adeia Inc.)
• Original Assignee: TiVo Solutions Inc. (Adeia Inc.)
• Inventors: Barton, James M., Platt, David
• Primary Examiner(s): Popham, Jeffrey D
• Application Number:
  US14/460,993
• Publication Number:
  US 20140380353A1
• Time in Patent Office: 1,229 Days
• Field of Search: 713175
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/25816 involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/26613 for generating or managing keys in general key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04
• CPC Class Codes: H04N 21/4405 involving video stream decryption

Abstract

A method and apparatus for secure multimedia transfer provides an encrypted data transfer system that makes transferring multimedia content from a client to any incompatible system or to a system outside the location of the client very difficult.

Claims

1. A method comprising:

receiving, at a first client system, a digital certificate, the digital certificate comprising at least a first identifier of the first client system and a second identifier of a second client system;

receiving, at a first client system, a first request to send a first media content item to the second client system;

sending a first encrypted media content item corresponding to the first media content item from the first client system to the second client system;

based at least partially on the digital certificate identifying the first client system and the second client system, the first client system sending a first recording key for the second client system to decrypt the first encrypted media content item;

subsequent to the first request, receiving, at the first client system, a second request to send a second media content item to the second client system;

separately sending a second encrypted media content item corresponding to the second media content item from the first client system to the second client system; and

based at least partially on the same digital certificate identifying the first client system and the second client system, the first client system sending a second recording key for the second client system to decrypt the second encrypted media content item, the second recording key being different than the first recording key.

2. The method of claim 1,

wherein sending the first recording key and sending the second recording key is further based upon determining that the digital certificate comprises a signature from a registration server;

and

wherein the digital certificate indicates that the first client system and the second client system are registered with the registration server to a common user and are authorized to share media content.

3. The method of claim 1, further comprising:

encrypting the first recording key and the second recording key using a strong key;

sending the strong key from the first client system to the second client system; and

wherein the second client system is configured to decrypt the first recording key and the second recording key using the strong key.

4. The method of claim 1, further comprising:

encrypting a strong key at the first client system using a public key for the second client system, the digital certificate comprising the public key;

encrypting the first recording key and the second recording key using the strong key;

sending the strong key from the first client system to the second client system;

wherein the second client system is configured to decrypt the encrypted strong key using a private key that is associated with the public key; and

wherein the second client system is configured to decrypt the first recording key and the second recording key using the strong key.

5. The method of claim 1, further comprising:

generating first encrypted versions of the first recording key and the second recording key using a first strong key;

sending the first strong key and the first encrypted versions of the first recording key and the second recording key from the first client system to the second client system;

sending at least the first encrypted media content item and the second encrypted media content item from the first client system to a third client system identified by the digital certificate;

generating second encrypted versions of the first recording key and the second recording key using a second strong key that is different than the first strong key; and

the first client system sending second key information to the third client system, the second key information including the second strong key and the second encrypted versions of the first recording key and the second recording key.

6. The method of claim 1, further comprising:

the first client system sending a list of contents accessible at the first client system to the second client system;

wherein sending the first encrypted media content item and the first recording key is responsive to the first request, and sending the second encrypted media content item and the second recording key is responsive to the second request.

7. The method of claim 1, further comprising sending the first recording key responsive to having determined that an expiration date indicated in the digital certificate is later than a current time.

8. The method of claim 1, wherein the second client system is configured to locate the first client system using a peer discovery protocol, the locating being based on the digital certificate.

9. The method as recited in claim 1,

wherein the first client system is a digital video recorder (DVR), personal computer (PC), or a content server;

and

wherein the first encrypted media content item and the second encrypted media content item are separate music files, or any separate photo files, or are separate video files.

10. One or more non-transitory computer-readable media storing instructions configured to, when executed by one or more computing devices, cause performance of:

receiving, at a first client system, a digital certificate, the digital certificate comprising at least a first identifier of the first client system and a second identifier of a second client system;

receiving, at the first client system, a first request to send a first media content item to the second client system;

sending a first encrypted media content item corresponding to the first media content item from the first client system to the second client system;

based at least partially on the digital certificate identifying the first client system and the second client system, the first client system sending a first recording key for the second client system to decrypt the first encrypted media content item;

subsequent to the first request, receiving, at the first client system, a second request to send a second media content item to the second client system;

separately sending a second encrypted media content item corresponding to the second media content item from the first client system to the second client system; and

based at least partially on the same digital certificate identifying the first client system and the second client system, the first client system sending a second recording key for the second client system to decrypt the second encrypted media content item, the second recording key being different than the first recording key.

11. The one or more non-transitory computer-readable media of claim 10, wherein the instructions are further configured to, when executed by the one or more computing devices, cause performance of:

encrypting the first recording key and the second recording key using a strong key;

sending the strong key from the first client system to the second client system; and

wherein the second client system is configured to decrypt the first recording key and the second recording key using the strong key.

12. The one or more non-transitory computer-readable media of claim 10, wherein the instructions are further configured to, when executed by the one or more computing devices, cause performance of:

encrypting a strong key at the first client system using a public key for the second client system, the digital certificate comprising the public key; and

encrypting the first recording key and the second recording key using the strong key;

sending the strong key from the first client system the second client system;

wherein the second client system is configured to decrypt the encrypted strong key using a private key that is associated with the public key; and

wherein the second client system is configured to decrypt the first recording key and the second recording key using the strong key.

13. The one or more non-transitory computer-readable media of claim 10, wherein the instructions are further configured to, when executed by the one or more computing devices, cause performance of:

generating first encrypted versions of the first recording key and the second recording key using a first strong key;

sending the first strong key and the first encrypted versions of the first recording key and the second recording key from the first client system to the second client system;

sending at least the first encrypted media content item and the second encrypted media content item from the first client system to a third client system identified by the digital certificate;

generating second encrypted versions of the first recording key and the second recording key using a second strong key that is different than the first strong key; and

the first client system sending second key information to the third client system, the second key information including the second strong key and the second encrypted versions of the first recording key and the second recording key.

14. The one or more non-transitory computer-readable media of claim 10, wherein the instructions are further configured to, when executed by the one or more computing devices, cause performance of:

the first client system sending a list of contents accessible at the first client system to the second client system;

wherein sending the first encrypted media content item and the first recording key is responsive to the first request, and sending the second encrypted media content item and the second recording key is responsive to the second request.

15. The one or more non-transitory computer-readable media of claim 10, wherein the instructions are further configured to, when executed by the one or more computing devices, cause performance of:

sending the first recording key responsive to having determined that an expiration date indicated in the digital certificate is later than a current time.

16. The one or more non-transitory computer-readable media of claim 10:

wherein the first client system is a digital video recorder (DVR), personal computer (PC), or a content server; and

wherein the first encrypted media content item and the second encrypted media content item are separate music files, or are separate photo files, or are separate video files.

17. A system comprising at least a first client system, the first client system comprising:

a module, implemented at least partially by computing hardware, configured to receive, at the first client system, a digital certificate, the digital certificate comprising at least a first identifier of the first client system and a second identifier of a second client system;

a module, implemented at least partially by computing hardware, configured to receive, at the first client system, a first request to send a first media content item to the second client system, and subsequent to the first request, a second request to send a second media content item to the second client system;

a module, implemented at least partially by computing hardware, configured to send a first encrypted media content item corresponding to the first media content item from the first client system to the second client system and, separately, a second encrypted media content item corresponding to the second media content item from the first client system to the second client system; and

;

a module, implemented at least partially by computer hardware, configured to, based at least partially on the digital certificate identifying the first client system and the second client system, from the first client system a first recording key for the second client system to decrypt the first encrypted media content item, and based at least partially on the same digital certificate identifying the first client system and the second client system, send from the first client system a second recording key for the second client system to decrypt the second encrypted media content item, the second recording key being different than the first recording key.

18. The system of claim 17, the first client system further comprising:

a module, implemented at least partially by computing hardware, configured to encrypt the first recording key and the second recording key using a strong key;

a module, implemented at least partially by computing hardware, configured to send the strong key from the first client system to the second client system; and

wherein the second client system is configured to decrypt the first recording key and the second recording key using the strong key.

19. The system of claim 17, the first client system further comprising:

a module, implemented at least partially by computing hardware, configured to encrypt a strong key at the first client system using a public key for the second client system, the digital certificate comprising the public key;

a module, implemented at least partially by computing hardware, configured to encrypt the first recording key and the second recording key using the strong key;

a module, implemented at least partially by computing hardware, configured to send the encrypted strong key from the first client system to the second client system;

wherein the second client system is configured to decrypt the encrypted strong key using a private key that is associated with the public key; and

wherein the second client system is configured to decrypt the first recording key and the second recording key using the strong key.

20. The system of claim 17, the first client system further comprising:

a module, implemented at least partially by computing hardware, configured to generate first encrypted versions of the first recording key and the second recording key using a first strong key;

a module, implemented at least partially by computing hardware, configured to send the first strong key and the first encrypted versions of the first recording key and the second recording key from the first client system to the second client system;

a module, implemented at least partially by computing hardware, configured to send at least the first encrypted media content and the second encrypted media content to a third client system identified by the digital certificate;

a module, implemented at least partially by computing hardware, configured to generate second encrypted versions of the first recording key and the second recording key using a second strong key that is different than the first strong key; and

a module, implemented at least partially by computing hardware, configured to send the second key information to the third client system, the second key information including the second strong key and the second encrypted versions of the first recording key and the second recording key.

21. The system of claim 17, the first client system further comprising:

a module, implemented at least partially by computing hardware, configured to send a list of contents accessible at the first client system to the second client system;

wherein sending the first encrypted media content item and the first recording key is responsive to the first request, and sending the second encrypted media content item and the second recording key is responsive to the second request.

22. The system of claim 17, the first client system further comprising a module, implemented at least partially by computing hardware, configured to send the first recording key responsive to having determined that an expiration date indicated in the digital certificate is later than a current time.

23. The system of claim 17, further comprising the second client system, the second client system configured to locate the first client system using a peer discovery protocol, based on the digital certificate.

24. The system of claim 17,

wherein the first client system is a digital video recorder (DVR), personal computer (PC), or a content server;

and

wherein the first encrypted media content item and the second encrypted media content item are separate music files, or are separate photo files, or are separate video files.