SOURCE IDENTIFICATION FOR UNAUTHORIZED COPIES OF CONTENT

• US 20140258732A1
• Filed: 05/20/2014
• Published: 09/11/2014
• Est. Priority Date: 03/27/2012
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Roth, Gregory B., Barbour, Marc R., Behm, Bradley Jeffery, Ilac, Cristian M., Brandwine, Eric Jason
• Granted Patent: US 9,305,177 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/1078 Logging; Metering
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees
• CPC Class Codes: H04N 21/44055 by partially decrypting, e.g. decrypting a video stream that has been partially encrypted
• CPC Class Codes: H04N 21/4627 Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08

Abstract

Systems and methods for authentication generate keys from secret credentials shared between authenticating parties and authenticators. Generation of the keys may involve utilizing specialized information in the form of parameters that are used to specialize keys. Keys and/or information derived from keys held by multiple authorities may be used to generate other keys such that signatures requiring such keys and/or information can be verified without access to the keys. Keys may also be derived to form a hierarchy of keys that are distributed such that a key holder'"'"'s ability to decrypt data depends on the key'"'"'s position in the hierarchy relative to the position of a key used to encrypt the data. Key hierarchies may also be used to distribute key sets to content processing devices to enable the devices to decrypt content such that sources or potential sources of unauthorized content are identifiable from the decrypted content.

Claims

1. A computer-implemented method, comprising:

under the control of one or more computer systems configured with executable instructions,

obtaining encrypted data comprising multiple copies of a portion of the encrypted data, each copy of the multiple copies being decryptable using a different key and being distinguishable from at least one other copy of the multiple copies;

deriving, based at least in part on a key selected from a plurality of accessible keys, a second key;

using the derived second key to decrypt the portion; and

provide the decrypted portion.

2. The computer-implemented method of claim 1, wherein the data comprises multimedia content.

3. The computer-implemented method of claim 1, wherein:

the method further comprises obtaining a set of derivation parameters provided with the encrypted data; and

deriving the second key is based at least in part on the obtained set of derivation parameters.

4. The computer-implemented method of claim 3, wherein:

deriving the second key includes using the selected key and at least one derivation parameter from the set of derivation parameters as input to a preimage-resistant function to determine output of the preimage-resistant function; and

the second key is based at least in part on the output of the preimage resistant function.

5. The computer-implemented method of claim 1, further comprising:

deriving, based at least in part on a third key selected from the plurality of accessible keys, a fourth key;

using the derived fourth key to decrypt another portion of the encrypted data; and

providing the decrypted other portion.

6. The computer-implemented method of claim 1, further comprising:

deriving, based at least in part on a key selected from a plurality of accessible keys, a third key different from the second key;

using the derived third key to decrypt another portion of the encrypted data; and

provide the decrypted other portion.

7. An information processing system, comprising:

one or more processors; and

memory including instructions executable by the one or more processors to cause the information processing system to at least;

obtain an encrypted data set that includes multiple copies of a portion of the data set that are decryptable using different keys;

select, from a plurality of keys accessible to the information processing system, a key usable to decrypt a copy of the multiple copies;

generate, based at least in part on the selected key, a different key;

decrypt, using the generated different key, the copy; and

provide the decrypted copy.

8. The information processing system of claim 7, wherein the instructions further cause the information processing system to select, based at least in part on information available to the information processing system, from a plurality of copies of the multiple copies of the portion of the data set when the processing system has access to keys from the plurality of keys that can each be used to decrypt a corresponding copy of the plurality of copies.

9. The information processing system of claim 7, wherein:

the instructions further cause the information processing system to obtain one or more derivation parameters for generating the different key; and

generating the different key is further based at least in part on the obtained derivation parameters.

10. The information processing system of claim 9, wherein:

obtaining the encrypted data set includes obtaining a data set that includes both the encrypted data set and the derivation parameters; and

generating the different key includes accessing the derivation parameters from the obtained data set.

11. The information processing system of claim 7, wherein selecting the key is based at least in part on a set of key derivation parameters available to the information processing system.

12. The information processing system of claim 7, wherein decrypting the copy includes:

decrypting, by the generated different key, another key; and

decrypting, by the decrypted other key, the copy.

13. The information processing system of claim 7, wherein the encrypted data set comprises multimedia content.

14. The information processing system of claim 7, wherein the instructions that cause the information processing system to decrypt the copy cause the information processing system to utilize a symmetric cryptographic algorithm to decrypt the copy.

15. A non-transitory computer-readable storage medium having stored thereon instructions executable by one or more processors of an information processing system to cause the information processing system to at least:

for encrypted data, select, from a plurality of keys accessible to the information processing system, a key usable to decrypt a copy of a subset of the data, the copy being from multiple copies of the subset that are each decryptable using a different key;

derive, based at least in part on the selected key, a different key;

decrypt, using the derived different key, the copy; and

provide the decrypted copy.

16. The non-transitory computer-readable storage medium of claim 15, wherein:

the instructions further cause the information processing system to obtain one or more derivation parameters for generating the different key; and

deriving the different key is further based at least in part on the obtained derivation parameters.

17. The non-transitory computer-readable storage medium of claim 15, wherein the instructions further cause the information processing system to obtain a data stream that encodes at least the one or more derivation parameters and the encrypted data.

18. The non-transitory computer-readable storage medium of claim 15, wherein:

the copy of the subset of the data includes one or more differences from at least one other copy of the multiple copies; and

the instructions that cause the information processing system to provide the decrypted copy cause the information processing system to provide the decrypted copy in a manner that results in the one or more differences being computationally identifiable.

19. The non-transitory computer-readable storage medium of claim 15, wherein at least one of the multiple copies is undecryptable using any key accessible to the information processing system.

20. The non-transitory computer-readable storage medium of claim 15, wherein:

the instructions further cause the information processing system to select from the plurality of keys accessible to the information processing system multiple times when the encrypted data includes multiple subsets of the data having multiple copies; and

the instructions cause the information processing system to select a different key to decrypt a particular subset when the particular subset of the multiple subsets comprises copies undecryptable using the selected key.