System, Apparatus And Method For Providing Protected Content In An Internet Of Things (IOT) Network

• US 20160364553A1
• Filed: 03/15/2016
• Published: 12/15/2016
• Est. Priority Date: 06/09/2015
• Status: Abandoned Application

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Smith, Ned M., Poornachandran, Rajesh, Heldt-Sheller, Nathan
• Application Number:
  US15/070,215
• Publication Number:
  US 20160364553A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/1011 to devices
• CPC Class Codes: G06F 21/105 Arrangements for software license management or administration, e.g. for managing licenses at corporate level
• CPC Class Codes: G06F 21/107 License processing; Key processing
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04W 12/037 of the control plane, e.g. signalling traffic
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/0433 Key management protocols
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

In one embodiment, a system comprises: a content provider interface logic to receive a content license from a content provider, the content license to indicate that the system may distribute digital content associated with the content license to one or more devices; an attestation logic to attest a state of a first device; and a key management logic to generate a content key for the first device responsive to a request by the first device for the digital content and attestation of the first device state, and provide the content key to the first device. Other embodiments are described and claimed.

Claims

1. A system comprising:

a content provider interface logic to receive a content license from a content provider, the content license to indicate that the system may distribute digital content associated with the content license to one or more devices;

an attestation logic to attest a state of a first device; and

a key management logic to generate a content key for the first device responsive to a request by the first device for the digital content and attestation of the first device state, and provide the content key to the first device.

2. The system of claim 1, further comprising a content rendering logic to receive the digital content from the content provider and render the digital content for the first device.

3. The system of claim 2, wherein the content rendering logic is to communicate the rendered digital content to the key management logic to enable the key management logic to send the rendered digital content to the first device to enable the first device to consume the digital content.

4. The system of claim 2, wherein the content rendering logic is to render the digital content for the first device responsive to a determination that the first device does not have rendering capability, the first device comprising an Internet of Things (IoT) device.

5. The system of claim 2, wherein the content rendering logic is to render the digital content for the first device based at least in part on device attribute information of the first device.

6. The system of claim 3, further comprising a key manager server comprising the content provider interface logic, the attestation logic and the key management logic.

7. The system of claim 6, wherein the key manager server further comprises an encryption logic to encrypt the rendered digital content received from the content rendering logic and send the encrypted rendered digital content to the first device, wherein the first device is to decrypt the encrypted rendered digital content with the content key.

8. The system of claim 1, wherein the content license indicates that the system is to be a domain controller on behalf of the digital content.

9. The system of claim 1, wherein the state of the first device comprises a security state, including existence of a trusted execution environment of the first device.

10. The system of claim 1, wherein the first device comprises a maker Internet of Things (IoT) device not having an embedded manufacturer license.

11. The system of claim 1, wherein the system comprises one or more servers, at least one of the one or more servers comprising at least one hardware processor, at least one hardware security processor and at least one secure storage, wherein the at least one hardware security processor comprises the attestation logic and the key management logic, the at least one hardware security processor to execute in a trusted execution environment inaccessible to the at least one hardware processor.

12. At least one computer readable storage medium comprising instructions that when executed enable a system to:

receive a content license from a content provider, the content license to enable the system to be a domain controller for one or more devices and indicate that the system may distribute digital content associated with the content license;

attest a state of a first device; and

generate a content key for the first device responsive to a request by the first device for the digital content and attestation of the first device state, and provide the content key to the first device, to enable the first device to decrypt the digital content.

13. The at least one computer readable storage medium of claim 12, further comprising instructions that when executed enable the system to send the digital content, received from the content provider, to a content rendering system to enable the content rendering system to render the digital content for the first device.

14. The at least one computer readable storage medium of claim 13, further comprising instructions that when executed enable the system to receive the rendered digital content from the content rendering system and send the rendered digital content to the first device to enable the first device to consume the digital content.

15. The at least one computer readable storage medium of claim 14, further comprising instructions that when executed enable the system to encrypt the rendered digital content received from the content rendering system and send the encrypted rendered digital content to the first device, the content key to enable the first device to decrypt the encrypted rendered digital content.

16. The at least one computer readable storage medium of claim 13, further comprising instructions that when executed enable the system to determine whether the first device has rendering capability based at least in part on device attribute information received from the first device and send the digital content to the content rendering system responsive to a determination that the first device does not have the rendering capability.

17. A system comprising:

a key management server having a hardware processor and a security engine, the security engine to receive a content license from a content provider, the content license to indicate that the key management server may distribute digital content associated with the content license to a plurality of devices for which the key management server is a domain controller, attest a state of a first device, generate a content key for the first device responsive to a request by the first device for the digital content and attestation of the first device state, and provide the content key to the first device; and

the plurality of devices coupled to the key management server, wherein at least some of the plurality of devices do not include an embedded manufacturer license to handle digital content.

18. The system of claim 17, further comprising a content rendering server coupled to the key management server to receive the digital content and render the digital content for the first device, wherein the content rendering server is to communicate the rendered digital content to the key management server to enable the key management server to send the rendered digital content to the first device to enable the first device to consume the digital content.

19. The system of claim 18, wherein the key management server is to encrypt the rendered digital content received from the content rendering server and send the encrypted rendered digital content to the first device, wherein the first device is to decrypt the encrypted rendered digital content with the content key.

20. The system of claim 17, wherein the key management server is to send a shared key to a first subset of the plurality of devices to enable the first subset of the plurality of devices to decrypt first digital content.

21. The system of claim 20, wherein the key management server is to concurrently send the first digital content to the first subset of the plurality of devices via a multi-cast communication channel.