Technique for securely communicating and storing programming material in a trusted domain

• US 20060020786A1
• Filed: 07/20/2004
• Published: 01/26/2006
• Est. Priority Date: 07/20/2004
• Status: Active Grant

• Current Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Original Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Inventors: Hayashi, Michael T., Leddy, Kevin J., Helms, William, Christman, David A.
• Granted Patent: US 8,266,429 B2
• Time in Patent Office: Days
• US Class Current: 713/165
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/26613 for generating or managing keys in general key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/6334 for authorisation, e.g. by transmitting a key wireless communications network key management H04W12/04; wireless communications network access security H04W12/08
• CPC Class Codes: H04N 21/63775 for uploading keys, e.g. for a client to communicate its public key to the server key management H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

A “trusted domain” is established within which content received from a communications network, e.g., a cable TV network, is protected from unauthorized copying thereof, in accordance with the invention. In an illustrative embodiment, the trusted domain includes a device associated with a user which receives content from the cable TV network. The content may be encrypted using a content key in accordance, e.g., with a 3DES encryption algorithm before it is stored in the device. In addition, a first encrypted content key version and a second encrypted content key version are generated by respectively encrypting the content key with a public key associated with the device and another public key associated with the user, in accordance with public key cryptography. The first and second encrypted content key versions are stored in association with the encrypted content in the device storage. The encrypted content can be migrated from a first device to a second device, and can be decrypted in the second device if the second device is associated with the same user, and also provided with the second encrypted content key version.

Claims

1. A device for receiving encrypted content from a storage unit, the device and the storage unit both being associated with a user, the encrypted content being decrypted in the device using a first cryptographic element, the device comprising:

a first interface for receiving a first encrypted version of the first cryptographic element from the storage unit, the first encrypted version of the first cryptographic element being generated by encrypting the first cryptographic element using a second cryptographic element which is associated with the user, the first encrypted version of the first cryptographic element being provided to an apparatus remote from the device, the apparatus recovering the first cryptographic element based on at least the first encrypted version of the first cryptographic element and data representative of the user;

a second interface for receiving from the apparatus a second encrypted version of the first cryptographic element, the second encrypted version of the first cryptographic element being generated by encrypting the recovered first cryptographic element using a third cryptographic element which is associated with the device; and

a module for recovering the first cryptographic element to decrypt the encrypted content based on at least the second encrypted version of the first cryptographic element.

2. The device of claim 1 wherein the first interface includes the second interface.

3. The device of claim 1 wherein the content includes entertainment programming content.

4. The device of claim 1 wherein the first cryptographic element includes a secret key in accordance with a data encryption standard (DES) technique.

5. The device of claim 1 wherein the second cryptographic element includes an encryption key in accordance with a public key algorithm.

6. The device of claim 1 wherein the third cryptographic element includes an encryption key in accordance with a public key algorithm.

7. The device of claim 1 comprising a terminal having storage.

8. The device of claim 1 comprising a terminal having digital video recorder functions.

9. A system for securing, in a device, content which is encrypted using a content key, the system comprising:

a server for generating a first encrypted content key by encrypting the content key using a first cryptographic element; and

an interface for providing the first encrypted content key to the device where the encrypted content is stored in association with the first encrypted content key and a second encrypted content key which is generated by encrypting the content key using a second cryptographic element, which is associated with the device.

10. The system of claim 9 wherein the first encrypted content key is provided to the device through a communications network.

11. The system of claim 10 wherein the communications network includes a multi-channel delivery network.

12. The system of claim 10 wherein the communications network includes a hybrid fiber coaxial (HFC) cable network.

13. The system of claim 9 wherein the content includes entertainment programming content.

14. The system of claim 9 wherein the content key includes a secret key in accordance with a DES technique.

15. The system of claim 9 wherein the content key is generated in the device.

16. The system of claim 9 wherein the first cryptographic element includes an encryption key in accordance with a public key algorithm.

17. The system of claim 9 wherein the second cryptographic element includes an encryption key in accordance with a public key algorithm.

18. The system of claim 9 wherein the first cryptographic element is associated with a user of the device.

19. The system of claim 9 wherein the first cryptographic element is associated with the system.

20. Apparatus for decrypting encrypted content in a device remote from the apparatus, the encrypted content in the device being decrypted using a content key, the apparatus comprising:

an interface for receiving from the device a first encrypted content key;

a database for searching for a first cryptographic element which is associated with a user of the device, the content key being recovered by decrypting the first encrypted content key using the first cryptographic element, a second encrypted content key being generated by encrypting the recovered content key using a second cryptographic element which is associated with the device; and

a server for providing at least the second encrypted content key to the device where the content key is recoverable based on at least the second encrypted content key.

21. The apparatus of claim 20 wherein the first cryptographic element is identified based on data representative of the user of the device.

22. The apparatus of claim 21 wherein the data includes an identity of the user.

23. The apparatus of claim 20 wherein the content key includes a secret key in accordance with a DES technique.

24. The apparatus of claim 20 wherein the first cryptographic element includes an encryption key in accordance with a public key algorithm.

25. The apparatus of claim 20 wherein the second cryptographic element includes an encryption key in accordance with a public key algorithm.

26. The apparatus of claim 20 wherein the content includes entertainment programming content.

27. A method for use in a first device to which encrypted content is transported from a second device, the first device and the second device both being associated with a user, the encrypted content being decrypted in the first device using a first cryptographic element, the method comprising:

receiving a first encrypted version of the first cryptographic element from the second device, the first encrypted version of the first cryptographic element being generated by encrypting the first cryptographic element using a second cryptographic element which is associated with the user;

providing the first encrypted version of the first cryptographic element to an apparatus remote from the first device, the apparatus recovering the first cryptographic element based on at least the first encrypted version of the first cryptographic element and data representative of the user;

receiving from the apparatus a second encrypted version of the first cryptographic element, the second encrypted version of the first cryptographic element being generated by encrypting the recovered first cryptographic element using a third cryptographic element which is associated with the first device; and

recovering the first cryptographic element to decrypt the encrypted content based on at least the second encrypted version of the first cryptographic element.

28. The method of claim 27 wherein the content includes entertainment programming content.

29. The method of claim 27 wherein the first cryptographic element includes a secret key in accordance with a DES technique.

30. The method of claim 27 wherein the second cryptographic element includes an encryption key in accordance with a public key algorithm.

31. The method of claim 27 wherein the third cryptographic element includes an encryption key in accordance with a public key algorithm.

32. A method for use in a system for securing, in a device, content which is encrypted using a content key, the method comprising:

generating a first encrypted content key by encrypting the content key using a first cryptographic element; and

providing the first encrypted content key to the device where the encrypted content is stored in association with the first encrypted content key and a second encrypted content key which is generated by encrypting the content key using a second cryptographic element, which is associated with the device.

33. The method of claim 32 wherein the first encrypted content key is provided to the device through a communications network.

34. The method of claim 33 wherein the communications network includes a multi-channel delivery network.

35. The method of claim 33 wherein the communications network includes an HFC cable network.

36. The method of claim 32 wherein the content includes entertainment programming content.

37. The method of claim 32 wherein the content key includes a secret key in accordance with a DES technique.

38. The method of claim 32 wherein the content key is generated in the device.

39. The method of claim 32 wherein the first cryptographic element includes an encryption key in accordance with a public key algorithm.

40. The method of claim 32 wherein the second cryptographic element includes an encryption key in accordance with a public key algorithm.

41. The method of claim 32 wherein the first cryptographic element is associated with a user of the device.

42. The method of claim 32 wherein the first cryptographic element is associated with the system.

43. A method for use in an apparatus for decrypting encrypted content in a device remote from the apparatus, the encrypted content in the device being decrypted using a content key, the method comprising:

receiving from the device a first encrypted content key;

searching a database for a first cryptographic element which is associated with a user of the device;

using the first cryptographic element to decrypt the first encrypted content key, thereby recovering the content key;

using a second cryptographic element which is associated with the device to encrypt the recovered content key, thereby generating a second encrypted content key; and

providing the second encrypted content key to the device where the content key is recoverable based on at least the second encrypted content key.

44. The method of claim 43 wherein the first cryptographic element is identified based on data representative of the user of the device.

45. The method of claim 44 wherein the data includes an identity of the user.

46. The method of claim 43 wherein the content key includes a secret key in accordance with a DES technique.

47. The method of claim 43 wherein the first cryptographic element includes an encryption key in accordance with a public key algorithm.

48. The method of claim 43 wherein the second cryptographic element includes an encryption key in accordance with a public key algorithm.

49. The method of claim 43 wherein the content includes entertainment programming content.