Abstract:
A method for updating network-enabled devices with new identity data includes generating a plurality of new identity data records and loading the new identity data records onto an update server. A request is received at the update server for new identity data from at least one network-enabled device having a previously assigned identity linked to an identifier. The previously assigned identifier is linked to a new identifier that is linked to one of the new identity data records. One or more new identity data records are securely delivered to the network-enabled device.
Abstract:
A system and method for digital data distribution is disclosed. The system and method provides a set of one or more source streams encoded by an encoder to form a common data stream for distribution to a plurality of destination systems, each authorized to access at least a portion of the common data stream. Encryption comprises obtaining the source stream, identifying some blocks of the source stream as secure blocks, identifying some other blocks of the source stream as unsecured blocks, encrypting the secure blocks for each of a plurality of destination system classes wherein each of the plurality of destination systems is a member of one or more destination system classes, and each of the blocks of an encrypted secure block set is decryptable by destination systems in the class associated with that encrypted secure block set.
Abstract:
An apparatus and method for providing at least one root certificate are disclosed. Specifically, a plurality of root certificates is received and stored. Afterwards, a request is received from a first endpoint device for a desired root certificate, where the desired root certificate is used by the first endpoint device to verify an identity of a second endpoint device. Furthermore, the first endpoint device and the second endpoint device are associated with different certificate hierarchies. The desired root certificate is then sent to at least the first endpoint device.
Abstract:
According to the invention, a content processing unit for protecting interchip content pathways transporting digital content objects is disclosed. The content processing unit includes a first chip package, a second chip package and a content pathway. The first chip package includes a first body, a first plurality of interconnects, an encryption engine, and a first key storage register capable of storing a first key, and the second chip package includes a second body, a second plurality of interconnects, an encryption engine, and a second key storage register capable of storing a second key. The first key is used by the encryption engine to produce ciphertext content and cannot be overwritten after a programmability period. The first and second key storage registers are non-readable from outside the first body. The second key is used by the decryption engine to produce plaintext content from the ciphertext content. The content pathway couples a first subset of the first plurality and a second subset of the second plurality. The content pathway transports the digital content objects as the ciphertext content.
Abstract:
Described herein are embodiments that provide an approach to cryptographic key management for a digital rights management (DRM) architecture that includes multiple levels of key management for minimizing bandwidth usage while maximizing security for the DRM architecture. In one embodiment, there is provided a data structure for cryptographic key management that includes a public/private key pair and three additional layers of symmetric keys for authorizing access to a plurality of contents.
Abstract:
A system for restricting playback of an electronic presentation, such as a digital video or song. The system uses a playback time limit that specifies a duration of allowable playback time. The playback time limit is typically longer than the running time of the presentation so that a user is able to use standard transport controls such as pause, stop, rewind, fast forward, etc., that affect the overall playback time needed to view the presentation in its entirety. One approach uses a secure time base that is provided by a server over a network to a client device that includes a playback device. The secure time base is received and used by secure processing within the playback device. This approach allows rendering of the presentation to an output device to be performed by non-secure processing without unduly compromising the security of the system.
Abstract:
According to the invention, a method for protecting digital television from unauthorized digital receivers within a population of digital receivers is disclosed. Each digital receiver in the population has a unique identifier. In one step, provisioning information is received from a subset of the population of digital receivers indicating that the subset is potentially within range to receive digital television from a broadcaster. First decryption information is distributed to the subset of the population of digital receivers. The first decryption information allows for potentially decrypting a plurality of programs coextensively in time. The unauthorized digital receivers are cryptographically excluded from using the first decryption information. A first program is encrypted using a first method that is cryptographically related to second decryption information. The first program is sent. The second decryption information is distributed and cryptographically secured with the first decryption information.
Abstract:
A system for securely authenticating software Application Program Interfaces (APIs) includes a handshake protocol that is provided to validate whether the parties involved are licensed to use the system which includes rights to Intellectual Property (IP) and corresponding obligations. The handshake is a Challenge-Response protocol that includes several steps. First, a Claimant sends a request to a Verifier requesting access to a function through an API. The Verifier reacts to the request by outputting a Challenge that is sent to the Claimant. The Challenge is also retained by the Verifier for use in its internal calculation to verify the Claimant's response. The Claimant next processes the Challenge using components under the license, known as Hook IP, and issues a Response to the Verifier. The Verifier compares the possibly-correct Candidate Response from the Claimant to the known-correct Target Response and if a match occurs the Verifier allows the Claimant access to the API.
Abstract:
The present invention discloses an apparatus and method for providing a secure move of a content decryption key within or between domains. Namely, the present invention addresses the single copy usage rule by restricting the movement of the decryption key instead of restricting the movement of the encrypted content itself.
Abstract:
A system is described for uniquely mating components of a communication network such as a smartcard and a set-top box. When mated, the smartcard and set-top box are tied together and have a single identity. Further, the smartcard operates properly only when inserted into an authorized set-top box. Exchanges of information between both components are secured by encryption and authentication to guard against piracy of the exchanged information. The system provides the same authentication key to the set-top box and the smartcard. This key is used for authenticating communication between the set-top box and the smartcard. First, the authentication key is encrypted by a set-top box mating key. The set-top box employs this mating key to decrypt the authentication key. After it is derived, the authentication key is stored in the set-top box's memory. Further, the same authentication key is encrypted by a smartcard mating key. Thereafter, the smartcard employs the smartcard mating key to extract the authentication key. The clear authentication key is stored in the smartcard's memory as well. In this manner, the authentication key is used for securing all communication between the set-top box and the smart-card. For example, the set-top box may request control words from the smartcard. Only after authenticating the request, are the control words for decrypting digital content provided to the set-top box. If the smartcard authentication key is different from the set-top box key, the request for control words is denied.