Systems and Methods Using Cryptography to Protect Secure Computing Environments

• US 20070288764A1
• Filed: 08/20/2007
• Published: 12/13/2007
• Est. Priority Date: 08/12/1996
• Status: Active Grant

• Current Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Original Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Inventors: Van Wie, David, Sibert, W., Shear, Victor
• Granted Patent: US 7,904,707 B2
• Time in Patent Office: Days
• US Class Current: 713/190
• CPC Class Codes: G06F 12/1483 using an access-table, e.g. matrix or list
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/085 involving remote charge determination or related payment systems
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/24 Credit schemes, i.e. "pay after"
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/3825 Use of electronic signatures
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G11B 20/00086 Circuits for prevention of unauthorised reproduction or copying, e.g. piracy indicating unauthorised use of record carriers in general G11B23/28; scrambling for television signal recording H04N5/913; network architectures or network protocols for network security H04L63/00; cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
• CPC Class Codes: G11B 20/00159 Parental control systems
• CPC Class Codes: G11B 20/00173 wherein the origin of the content is checked, e.g. determining whether the content has originally been retrieved from a legal disc copy or another trusted source
• CPC Class Codes: G11B 20/00188 involving measures which result in a restriction to authorised devices recording or reproducing contents to/from a record carrier
• CPC Class Codes: G11B 20/00195 using a device identifier associated with the player or recorder, e.g. serial numbers of playback apparatuses or MAC addresses
• CPC Class Codes: G11B 20/0021 involving encryption or decryption of contents recorded on or reproduced from a record carrier
• CPC Class Codes: G11B 20/00543 wherein external data is encrypted, e.g. for secure communication with an external device or for encrypting content on a separate record carrier
• CPC Class Codes: G11B 20/00557 wherein further management data is encrypted, e.g. sector headers, TOC or the lead-in or lead-out areas
• CPC Class Codes: G11B 20/00688 : said measures preventing that a usable copy of recorded data can be made on another medium
• CPC Class Codes: G11B 20/0071 : involving a purchase action
• CPC Class Codes: G11B 20/00768 : wherein copy control information is used, e.g. for indicating whether a content may be copied freely, no more, once, or never, by setting CGMS, SCMS, or CCI flags
• CPC Class Codes: G11B 2220/216 : Rewritable discs
• CPC Class Codes: G11B 2220/218 : Write-once discs
• CPC Class Codes: G11B 2220/2562 : DVDs [digital versatile discs]; Digital video discs; MMCDs; HDCDs
• CPC Class Codes: G11B 2220/2575 : DVD-RAMs
• CPC Class Codes: G11B 27/031 : Electronic editing of digitised analogue information signals, e.g. audio or video signals
• CPC Class Codes: G11B 27/329 : on a disc [VTOC]
• CPC Class Codes: H04L 12/40104 : Security; Encryption; Content protection cryptographic protocols H04L9/00; protocols for network security H04L63/00
• CPC Class Codes: H04L 12/40117 : Interconnection of audio or video/imaging devices home automation networks H04L12/2803; bitstream network arrangements specially adapted for distribution of digital video signals H04N7/24

Abstract

Secure computation environments are protected from bogus or rogue load modules, executables and other data elements through use of digital signatures, seals and certificates issued by a verifying authority. A verifying authority—which may be a trusted independent third party—tests the load modules or other executables to verify that their corresponding specifications are accurate and complete, and then digitally signs the load module or other executable based on tamper resistance work factor classification. Secure computation environments with different tamper resistance work factors use different verification digital signature authentication techniques (e.g., different signature algorithms and/or signature verification keys)—allowing one tamper resistance work factor environment to protect itself against load modules from another, different tamper resistance work factor environment. Several dissimilar digital signature algorithms may be used to reduce vulnerability from algorithm compromise, and subsets of multiple digital signatures may be used to reduce the scope of any specific compromise.

Claims

1. A method comprising the steps of:

digitally signing a load module using a first key to yield a first digital signature;

digitally signing the load module using a second key to yield a second digital signature;

distributing at least the first digital signature to a first remote electronic appliance, wherein the first remote electronic appliance comprises a first protected processing environment operable to authenticate the first digital signature before the first remote electronic appliance executes the load module; and

distributing at least the second digital signature to a second remote electronic appliance, wherein the second remote electronic appliance comprises a second protected processing environment operable to authenticate the second digital signature before the second remote electronic appliance executes the load module.

2. The method of claim 1, further comprising the step of:

testing the load module;

wherein the step of digitally signing the load module using a first key is conditionally performed based, at least in part, on a result of the testing step.

3. The method of claim 2, in which the testing step comprises testing the load module to determine if it does what it is supposed to do.

4. The method of claim 2, in which the testing step comprises determining whether the load module is operable to compromise or harm a system upon which it is executed.

5. The method of claim 2, in which the testing step comprises determining whether the load module performs as specified by a specification.

6. The method of claim 2, in which the testing step comprises determining whether the load module is a virus.

7. The method of claim 1, in which the load module, when executed by the first remote electronic appliance, is configured to cause the first remote electronic appliance to perform at least one action selected from the group consisting of:

record an aspect of usage of a piece of electronic content, prevent a user from making a copy of a piece of electronic content, charge a user a fee for viewing a piece of electronic content, enable the first remote electronic appliance to perform a financial transaction, and enable the first remote electronic appliance to play a piece of electronic content.

8. The method of claim 1, in which the first protected processing environment has an assurance level that is different from an assurance level of the second protected processing environment.

9. The method of claim 8, further comprising:

securely distributing a third key to the first protected processing environment, the third key being configured for use in authenticating the first digital signature; and

securely distributing a fourth key to the second protected processing environment, the fourth key being configured for use in authenticating the second digital signature.

10. The method of claim 1, further comprising:

encrypting the load module.

11. The method of claim 1, further comprising:

distributing the first digital signature to the second remote electronic appliance.

28. The system of claim 1, further comprising:

means for encrypting the load module.

12. A computer-readable medium comprising program code, the program code being operable, when executed by a computer system, to cause the computer system to perform steps comprising:

digitally signing a load module using a first key to yield a first digital signature;

digitally signing the load module using a second key to yield a second digital signature;

distributing at least the first digital signature to a first remote electronic appliance; and

distributing at least the second digital signature to a second remote electronic appliance, the second remote electronic appliance having an assurance level that is greater than an assurance level of the first remote electronic appliance.

13. The computer-readable medium of claim 12, further including program code that is operable, when executed by the computer system, to cause the computer system to perform the step of:

testing the load module;

wherein the program code for performing the step of digitally signing the load module is conditionally executed based, at least in part, on a result of the testing step.

14. The computer-readable medium of claim 13, in which the program code for testing the load module comprises program code that is operable, when executed by the computer system, to cause the computer system to determine if the load module does what it is supposed to do.

15. The computer-readable medium of claim 13, in which the program code for testing the load module comprises program code that is operable, when executed by the computer system, to cause the computer system to determine whether the load module is operable to compromise or harm a system upon which it is executed.

16. The computer-readable medium of claim 13, in which the program code for testing the load module comprises program code that is operable, when executed by the computer system, to cause the computer system to determine whether the load module performs as specified by a specification.

17. The computer-readable medium of claim 13, in which the program code for testing the load module comprises program code that is operable, when executed by the computer system, to cause the computer system to determine whether the load module is a virus.

18. The computer-readable medium of claim 12, further including program code that is operable, when executed by the computer system, to cause the computer system to perform steps comprising:

securely distributing a third key to the first protected processing environment, the third key being configured for use in authenticating the first digital signature; and

securely distributing a fourth key to the second protected processing environment, the fourth key being configured for use in authenticating the second digital signature.

19. The computer-readable medium of claim 12, further including program code that is operable, when executed by the computer system, to cause the computer system to perform the step of:

encrypting the load module.

20. A system comprising:

means for digitally signing a load module using a first key to yield a first digital signature;

means for digitally signing the load module using a second key to yield a second digital signature;

means for distributing at least the first digital signature to a first remote electronic appliance comprising a first protected processing environment operable to authenticate the first digital signature before the first remote electronic appliance executes the load module, and

means for distributing at least the second digital signature to a second remote electronic appliance comprising a second protected processing environment operable to authenticate the second digital signature before the second remote electronic appliance executes the load module.

21. The system of claim 20, further comprising:

means for testing the load module.

22. The system of claim 21, in which the means for testing comprises means for testing the load module to determine if it does what it is supposed to do.

23. The system of claim 21, in which the means for testing comprises means for determining whether the load module is operable to compromise or harm a system upon which it is executed.

24. The system of claim 21, in which the means for testing comprises means for determining whether the load module performs as specified by a specification.

25. The system of claim 21, in which the means for testing comprises means for determining whether the load module is a virus.

26. The system of claim 20, in which the first protected processing environment has an assurance level that is different from an assurance level of the second protected processing environment.

27. The system of claim 20, further comprising:

means for securely distributing a third key to the first protected processing environment, the third key being configured for use in authenticating the first digital signature; and

means for securely distributing a fourth key to the second protected processing environment, the fourth key being configured for use in authenticating the second digital signature.