Source identification for unauthorized copies of content

• US 9,872,067 B2
• Filed: 03/07/2016
• Issued: 01/16/2018
• Est. Priority Date: 03/27/2012
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Roth, Gregory B., Barbour, Marc R., Behm, Bradley Jeffery, Ilac, Cristian M., Brandwine, Eric Jason
• Primary Examiner(s): Zee, Edward
• Application Number:
  US15/063,331
• Publication Number:
  US 20160191993A1
• Time in Patent Office: 680 Days
• CPC Class Codes: G06F 21/1078 Logging; Metering
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees
• CPC Class Codes: H04N 21/44055 by partially decrypting, e.g. decrypting a video stream that has been partially encrypted
• CPC Class Codes: H04N 21/4627 Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08

Abstract

Systems and methods for authentication generate keys from secret credentials shared between authenticating parties and authenticators. Generation of the keys may involve utilizing specialized information in the form of parameters that are used to specialize keys. Keys and/or information derived from keys held by multiple authorities may be used to generate other keys such that signatures requiring such keys and/or information can be verified without access to the keys. Keys may also be derived to form a hierarchy of keys that are distributed such that a key holder'"'"'s ability to decrypt data depends on the key'"'"'s position in the hierarchy relative to the position of a key used to encrypt the data. Key hierarchies may also be used to distribute key sets to content processing devices to enable the devices to decrypt content such that sources or potential sources of unauthorized content are identifiable from the decrypted content.

Claims

1. A computer-implemented method, comprising:

obtaining license information that specifies a set of key derivation parameters;

obtaining encrypted data that comprise multiple copies of a portion of the encrypted data, each copy of the multiple copies being decryptable using a different key and being distinguishable from at least one other copy of the multiple copies;

using a one-way function to derive, based at least in part on the set of key derivation parameters and a first key, a second key to result in a derived second key, the set of key derivation parameters comprises multiple key derivation parameters and specifies an order in which to use the multiple key derivation parameters to obtain the derived second key;

using the derived second key to decrypt the portion to result in a decrypted portion; and

providing the decrypted portion.

2. The computer-implemented method of claim 1, wherein the data comprises video content.

3. The computer-implemented method of claim 1, wherein the license information is obtained with the encrypted data.

4. The computer-implemented method of claim 1, further comprising selecting, based at least in part on the key derivation parameters, the first key from a plurality of keys accessible to the computer system.

5. The computer-implemented method of claim 1, further comprising:

deriving, based at least in part on the set of key derivation parameters and a third key selected from a plurality of keys accessible to the computer system, a fourth key to result in a derived fourth key;

using the derived fourth key to decrypt another portion of the encrypted data to result in a decrypted other portion; and

providing the decrypted other portion.

6. A system, comprising:

memory to store instructions that, if executed by one or more processors of the system, cause the system to;

obtain an encrypted data set that includes multiple copies of a portion of the data set that are decryptable using different keys;

use a one-way function to generate, based at least in part on a first key and a set of key derivation parameters for the encrypted data set, a different key to result in a generated different key, the set of key derivation parameters comprises multiple key derivation parameters and specifies an order in which to use the multiple key derivation parameters to obtain the generated different key;

decrypt, using the generated different key, a copy of the multiple copies to result in a decrypted copy; and

provide the decrypted copy.

7. The system of claim 6, wherein the instructions further cause the system to select the first key from a plurality of keys based at least in part on license information that encodes the key derivation parameters.

8. The system of claim 6, wherein the encrypted data set comprises a set of video frames and the portion of the data set comprises a video frame.

9. The system of claim 6, wherein:

obtaining the encrypted data set includes obtaining a data set that includes both the encrypted data set and the derivation parameters; and

generating the different key includes accessing the derivation parameters from the obtained data set.

10. The system of claim 6, wherein the instructions further cause the system to select the first key is based at least in part on a set of key derivation parameters available to the information processing system.

11. The system of claim 6, wherein decrypting the copy includes:

decrypting, by the generated different key, another key to result in a decrypted other key; and

decrypting, by the decrypted other key, the copy.

12. The system of claim 6, wherein:

the multiple copies of the portion of the data set comprise a first frame of multimedia content and a second frame of multimedia content, the first frame of multimedia content being visually indistinguishable from the second frame of multimedia content but different from the second frame of multimedia content.

13. The system of claim 6, wherein the instructions that cause the system to decrypt the copy cause the system to utilize a symmetric cryptographic algorithm to decrypt the copy.

14. A non-transitory computer-readable storage medium having stored thereon instructions executable by one or more processors of an information processing system to cause the information processing system to at least:

use a one-way function to derive, based at least in part on a key and a set of key derivation parameters obtained from license information for a set of data, a different key to result in a derived different key, the license information orders the set of key derivation parameters and an ordering of a subset of the key derivation parameters indicates an order in which the parameters are to be used to derive the different key;

decrypt, using the derived different key, a copy selected from multiple copies of a portion of a subset of the set of data; and

provide the decrypted copy.

15. The non-transitory computer-readable storage medium of claim 14, wherein the license information is obtained from the set of data.

16. The non-transitory computer-readable storage medium of claim 14, wherein:

the copy of the subset of the data includes one or more differences from at least one other copy of the multiple copies; and

the instructions that cause the information processing system to provide the decrypted copy cause the information processing system to provide the decrypted copy in a manner that results in the one or more differences being computationally identifiable.

17. The non-transitory computer-readable storage medium of claim 14, wherein at least one of the multiple copies is undecryptable using any key accessible to the information processing system.

18. The non-transitory computer-readable storage medium of claim 14, wherein:

the instructions further cause the information processing system to select from a plurality of keys accessible to the information processing system multiple times when the set of data includes multiple subsets of the data each having respective multiple copies; and

the instructions cause the information processing system to select a different key to decrypt a particular subset when the particular subset of the multiple subsets comprises copies undecryptable using the key.