Method and system for multimedia access control enablement

• US 5,319,705 A
• Filed: 10/21/1992
• Issued: 06/07/1994
• Est. Priority Date: 10/21/1992
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Halter, Bernard J., Bracco, Alphonse M., Prymak, deceased, Rostislaw, Randall, James D., Johnson, Donald B., Matyas, Stephen M., Le, An V., Wilkins, John D.
• Primary Examiner(s): Gregory, Bernarr E.
• Application Number:
  US07/964,324
• Time in Patent Office: 594 Days
• Field of Search: 380/4, 380/21, 380/23, 380/25, 380/29, 380/43, 380/49, 380/50, 340/825.31, 340/825.34
• US Class Current: 705/54
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/605 Copy protection
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A method and system are disclosed for securely distributing a plurality of software files from a software distribution processor to a user processor, while selectively enabling the user processor to only use a subset of a lesser plurality of the software files. This is achieved by employing a customer key which includes a clear customer number and a derived portion derived from the customer number. The customer key is transformed into a second customer key which serves as a key expression for encrypting a file encryption key specifically intended for a respective one of the plurality of files. A plurality of software files can be stored together, for example on a CD-ROM, with each file encrypted under a corresponding file encryption key. The CD-ROM can be distributed to many user processors. When a specific user processor needs to run one of the software files, a request will be transmitted from the user processor to the software distribution processor. In response to that request, an encrypted file encryption key specific for the requested file, will be transmitted to the user processor. This will enable the user processor to decrypt only the requested file from the CD-ROM. All other files on the CD-ROM remain in their encrypted form and cannot be decrypted and used by the file encryption key received from the software distribution processor.

Claims

1. A method for securely distributing a plurality of software files from a software distribution processor to a user processor, and selectively enabling the user processor to use a subset of a lesser plurality of said plurality of software files, comprising the steps of:

storing in said software distribution processor a plurality of software files including an ith software file;

storing in said software distribution processor a plurality of file encryption keys including an ith file encryption key;

encrypting in said software distribution processor said plurality of said software files, using corresponding ones of said plurality of file encryption keys, including encrypting said ith file using said ith file encryption key, producing a plurality of encrypted files which includes an ith encrypted file which is said ith file encrypted under said ith file encryption key;

transmitting from said software distribution processor to a user processor at least a portion of said plurality of encrypted files;

storing in said software distribution processor, a first customer key which includes a clear customer number and a second portion;

transforming in said software distribution center, said first customer key with a transformation function producing a second customer key;

encrypting said ith file encryption key with said second customer key, producing an encrypted ith file encryption key;

transmitting from said software distribution processor to a user processor, said first customer key;

transmitting from said software distribution processor to said user processor, said encrypted ith file encryption key;

transforming at said user processor said first customer key using said transformed function, producing said second customer key;

decrypting said ith file encryption key received at said user processor using said second customer key, recovering said ith file encryption key;

decrypting said ith encrypted file received at said user processor, using said recovered ith file encryption key, producing said ith software file;

whereby the user processor is enabled to use said ith software file.

2. The method of claim 1 which further comprises said first customer key including a customer number and an authentication code.

3. The method of claim 2 wherein said second portion of said first customer key includes an encrypted expression of said customer number.

4. The method of claim 1 wherein said second portion of said first customer key includes an encrypted expression of said customer number.

5. The method of claim 1 wherein said second portion of said first customer key includes an encrypted expression of said customer number, encrypted under a key encrypting key and a counter value.

6. The method of claim 5 wherein said encrypted expression is a 64-bit DES key, and every eighth parity bit has substituted for it a corresponding authorization bit derived from said customer number.

7. The method of claim 1 wherein said plurality of encrypted files are stored on a CD ROM storage device which is transported from said software distribution processor to said user processor.

8. The method of claim 1 wherein said plurality of encrypted files are stored in a bulk storage at said software distribution processor and are distributed to said user processor over a data communications network.

9. Said method of claim 1 wherein said second portion of said first customer key is an encrypted expression derived from said customer number and a counter value encrypted under a key encrypting key;

said counter value representing a sublicensed customer number.

10. The method of claim 1 wherein a request is transmitted from said user processor to said software distribution processor for said ith file, and in response thereto said ith file encryption key is encrypted and transmitted from said software distribution processor to said user processor.

11. A system for securely distributing a plurality of software files from a software distribution processor to a user processor, and selectively enabling the user processor to use a subset of a lesser plurality of said plurality of software files, comprising:

means for storing in said software distribution processor a plurality of software files including an ith software file;

means for storing in said software distribution processor a plurality of file encryption keys including an ith file encryption key;

means for encrypting in said software distribution processor said plurality of said software files, using corresponding ones of said plurality of file encryption keys, including encrypting said ith file using said ith file encryption key, producing a plurality of encrypted files which includes an ith encrypted file which is said ith file encrypted under said ith file encryption key;

means for transmitting from said software distribution processor to a user processor at least a portion of said plurality of encrypted files;

means for storing in said software distribution processor, a first customer key which includes a clear customer number and a second portion;

means for transforming in said software distribution center, said first customer key with a transformation function producing a second customer key;

means for encrypting said ith file encryption key with said second customer key, producing an encrypted ith file encryption key;

means for transmitting from said software distribution processor to a user processor, said first customer key;

means for transmitting from said software distribution processor to said user processor, said encrypted ith file encryption key;

means for transforming at said user processor said first customer key using said transformed function, producing said second customer key;

means for decrypting said ith file encryption key received at said user processor using said second customer key, recovering said ith file encryption key;

means for decrypting said ith encrypted file received at said user processor, using said recovered ith file encryption key, producing said ith software file;

whereby the user processor is enabled to use said ith software file.

12. The system of claim 11 which further comprises said first customer key including a customer number and an authentication code.

13. The system of claim 12 wherein said second portion of said first customer key includes an encrypted expression of said customer number.

14. The system of claim 11 wherein said second portion of said first customer key includes an encrypted expression of said customer number.

15. The system of claim 11 wherein said second portion of said first customer key includes an encrypted expression of said customer number, encrypted under a key encrypting key and a counter value.

16. The system of claim 15 wherein said encrypted expression is a 64-bit DES key, and every eighth parity bit has substituted for it a corresponding authorization bit derived from said customer number.

17. The system of claim 11 wherein said plurality of encrypted files are stored on a CD ROM storage device which is transported from said software distribution processor to said user processor.

18. The system of claim 11 wherein said plurality of encrypted files are stored in a bulk storage at said software distribution processor and are distributed to said user processor over a data communications network.

19. Said system of claim 11 wherein said second portion of said first customer key is an encrypted expression derived from said customer number and a counter value encrypted under a key encrypting key;

said counter value representing a sublicensed customer number.

20. The system of claim 11 wherein a request is transmitted from said user processor to said software distribution processor for said ith file, and in response thereto said ith file encryption key is encrypted and transmitted from said software distribution processor to said user processor.

21. A method for securely distributing a plurality of multimedia files from a multimedia distribution processor to a user processor, and selectively enabling the user processor to use a subset of a lesser plurality of said plurality of multimedia files, comprising the steps of:

storing in said multimedia distribution processor a plurality of multimedia files including an ith multimedia file;

storing in said multimedia distribution processor a plurality of file encryption keys including an ith file encryption key;

encrypting in said multimedia distribution processor said plurality of said multimedia files, using corresponding ones of said plurality of file encryption keys, including encrypting said ith file using said ith file encryption key, producing a plurality of encrypted files which includes an ith encrypted file which is said ith file encrypted under said ith file encryption key;

transmitting from said multimedia distribution processor to a user processor at least a portion of said plurality of encrypted files;

storing in said multimedia distribution processor, a first customer key which includes a clear customer number and a second portion;

transforming in said multimedia distribution center, said first customer key with a transformation function producing a second customer key;

encrypting said ith file encryption key with said second customer key, producing an encrypted ith file encryption key;

transmitting from said multimedia distribution processor to a user processor, said first customer key;

transmitting from said multimedia distribution processor to said user processor, said encrypted ith file encryption key;

transforming at said user processor said first customer key using said transformed function, producing said second customer key;

decrypting said ith file encryption key received at said user processor using said second customer key, recovering said ith file encryption key;

decrypting said ith encrypted file received at said user processor, using said recovered ith file encryption key, producing said ith multimedia file;

whereby the user processor is enabled to use said ith multimedia file.