Method and apparatus for providing bus-encrypted copy protection key to an unsecured bus

• US 6,934,389 B2
• Filed: 03/02/2001
• Issued: 08/23/2005
• Est. Priority Date: 03/02/2001
• Status: Active Grant

• Current Assignee: ATI Technologies ULC (Advanced Micro Devices, Inc.)
• Original Assignee: ATI International SRL (Advanced Micro Devices, Inc.)
• Inventors: Strasser, David A., Varga, Gabriel Z., Pang, Edwin
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US09/798,538
• Publication Number:
  US 20020164022A1
• Time in Patent Office: 1,635 Days
• Field of Search: 380/200, 380/201, 380/277, 380/29, 380/44, 380/46, 380280-282, 380284-285, 380/212, 380/28, 380/262, 380/257, 380/186, 713/165, 713/171, 713/189, 713/200, 705/50, 705/57
• US Class Current: 380/201
• CPC Class Codes: H04L 2209/605 Copy protection
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04N 21/4181 for conditional access
• CPC Class Codes: H04N 21/4367 Establishing a secure communication between the client and a peripheral device or smart card
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

A copy protection (CP) key used by a sending source, such as a POD, to encrypt content such as audio and/or video information is derived by a first key generator associated with a first processor and is locally encrypted by the first processor using a locally generated bus encryption key to produce a bus encrypted CP key that is sent over a local unsecure bus to a second processor, such as a graphics processor. The second processor decrypts the bus encrypted copy key using a decryption engine to obtain the CP key. The second processor receives the encrypted content and in one embodiment, also uses the same decryption engine to decrypt the encrypted content. The first and second processors locally exchange public keys to each locally derive a bus encryption key used to encrypt the CP key before it is sent over the unsecure bus and decrypt the encrypted CP key after it is sent over the bus. The locally exchanged public keys are shorter in length than those used between the CPU and POD to produce the original CP key.

Claims

1. A method for providing a bus-encrypted copy protection (CP) key to an unsecured bus, the method comprising steps of:

exchanging, between a first processor and a second processor, public keys that are shorter in length than public keys used to originally generate a copy protection (CP) key, over the unsecured bus;

generating a bus encryption key by each of the first and second processors the bus encryption key having a first length;

generating, by the first processor, the CP key;

encrypting, by the first processor, the CP key using the bus encryption key and a symmetric encryption algorithm to produce a bus-encrypted CP key; and

providing the bus-encrypted CP key to the unsecured bus for the second processor.

2. The method of claim 1 including the step of generating the bus encryption key without using a one way function used to generate the CP key.

3. The method of claim 2, further comprising:

repeatedly generating a new CP key;

in response to generating the new CP key, generating a new bus encryption key;

encrypting the new CP key using the new bus encryption key and the Data Encryption Standard (DES) encryption algorithm to produce a new bus-encrypted CP key;

providing the new bus-encrypted CP key to the unsecured bus for the second processor.

4. The method of claim 1, wherein the step of exchanging public keys to develop a bus encryption key includes:

generating a random number;

generating a first public key based upon the random number;

passing, the first public key across the unsecured bus;

receiving a second public key from the unsecured bus; and

generating a bus encryption key based upon the random number and the second public key.

5. The method of claim 4, wherein the length of the bus encryption key matches a length of a DES algorithm key length.

6. The method of claim 5, wherein the bus encryption key is generated using a Diffie Hellman algorithm.

7. An integrated circuit adapted to receive a transport stream having a plurality of encrypted packets that have been encrypted using a copy protection key (CP) and having a port to couple to an unsecure bus, the integrated circuit comprising:

a decryption module including;

a bus encryption key generator operative to produce a bus encryption key based on a secret key shared between a first processor and a second processor; and

a decryptor operatively responsive to a bus-encrypted CP key and having a first selector operative to select between the transport stream and the bus-encrypted copy protection key, and operative to decrypt selected encrypted packets based on a decrypted bus-encrypted CP key.

8. The integrated circuit of claim 7, wherein the decryptor switches selection of the selector in response to the end of a packet, wherein the packet has a header and a payload, and the payload is encrypted using the CP key and a DES algorithm.

9. The integrated circuit of claim 7, wherein the decryption module decrypts the bus encryption CP key based upon the bus encrypted key and includes a memory element that stores the resulting CP key.

10. The integrated circuit of claim 9, wherein the decryption module receives one of the bus encryption key and the stored resulting CP key in response to the end of a packet, such that decryption module receives a derived bus encryption key when an end of packet is detected and when a new bus encrypted CP key is pending, otherwise, the decryption module decrypts an encrypted payload from the transport stream.

11. The integrated circuit of claim 7, wherein the bus encryption key generator comprises:

a random number generator operative to generate a random number;

a public key generator that generates a public key based upon the random number, the public key to be passed across the unsecured bus;

a public key receiver to receive a second public key from the unsecured bus; and

a bus encryption key generator that generates the bus encryption key based upon the random number and the second public key.

12. The integrated circuit of claim 10, wherein the length of the bus encryption key matches a length of the first and second public keys.

13. The integrated circuit of claim 7 wherein the decryptor includes:

a multiple CP key memory element that contains a plurality of decrypted CP keys;

a second selector operatively coupled to select one of the plurality of decrypted CP keys from the multiple CP key memory element; and

a third selector operatively coupled to select between a bus encryption key and the selected decrypted CP key.

14. A system for providing a bus-encrypted copy protection (CP) key to an unsecured bus, the system comprising:

a first processor operatively coupled to a second processor via the unsecure bus, having a first bus encryption key generator and a CP key encryptor operatively responsive to a bus encryption key produced by the first bus encryption key generator to produce the bus encrypted copy protection key;

the second processor having a second bus encryption key generator to also produce the bus encryption key; and

a decryptor operatively responsive to a bus-encrypted CP key and having a first selector operative to select between a transport stream and the bus-encrypted copy protection key, and operative to decrypt selected encrypted packets based on a decrypted bus-encrypted CP key.

15. The system of claim 14 wherein the first and second processor exchange public keys for each of the first and second bus encryption key generators to each independently produce the bus encryption key.

16. The system of claim 14, wherein the decryptor switches selection of the selector in response to the end of a packet, wherein the packet has a header and a payload, and the payload is encrypted using the CP key and a DES algorithm.

17. The system claim 16, wherein the decryptor decrypts the bus encryption CP key based upon the bus encrypted key and includes a memory element that stores the decrypted bus-encrypted CP key.

18. The system of claim 14, wherein the decryptor receives one of the bus encryption key and the stored decrypted bus-encrypted CP key in response to the end of a packet, such that decryptor receives a derived bus encryption key when an end of packet is detected and when a new bus encrypted CP key is pending, otherwise, the decryptor decrypts an encrypted payload from the transport stream.