Content protection for digital transmission systems

Abstract

A method for protecting digital content from copying and/or other misuse as it is transferred between one or more computationally constrained devices over insecure links, includes preliminarily authenticating that both a content source and a content sink are compliant devices, and transferring content between compliant devices. In a further aspect of the invention, in the background, concurrently with the transfer of content, at least a second cryptographic process is performed. In an embodiment, establishing a preliminary control channel includes exchanging random challenges between devices, encrypting, under a shared secret key, and hashing the exchanged random challenges, exchanging the results of the encryption and hash functions and then verifying that the appropriate results have been generated.

Claims

What is claimed is:

1. A method of transferring content from a content source to a content sink, comprising:

a) exchanging random challenges between the content source and the content sink;

b) encrypting the exchanged random challenges with a secret key, then hashing the encrypted random challenges;

c) exchanging the encrypted, hashed random challenges;

d) comparing exchanged encrypted, hashed random challenges to expected values;

e) establishing, if the exchanged encrypted, hashed random challenges match the expected values, a preliminary control channel.

f) establishing a preliminary content channel; and

g) transferring content over the preliminary content channel.

2. The method of claim 1, further comprising:

establishing a full control channel and a full content channel.

3. The method of claim 2, further comprising:

transferring content over the full content channel.

4. The method of claim 1, further comprising:

determining whether at least one of a content sink, and a content source is computationally constrained.

5. A method of transferring information, the method comprising:

a) transmitting a first random challenge from a first device to a second device, and transmitting a second random challenge from the second device to the first device;

b) in the first device, encrypting, then hashing the second random challenge, and in the second device, encrypting, then hashing the first random challenge;

c) transmitting the hashed, encrypted, second random challenge to the second device, and transmitting the hashed, encrypted, first random challenge to the first device;

d) in the first device, comparing the hashed, encrypted first random challenge to a first expected value, and in the second device comparing the hashed, encrypted second random challenge to a second expected value;

e) if both comparisons in (d) result in a match, then establishing a preliminary content channel; and

f) transferring information over the preliminary content channel.

6. The method of claim 5, further comprising terminating information transfer over the preliminary content channel.

7. The method of claim 5, further comprising establishing a full control channel and a full content channel.

8. A method of transferring information, the method comprising:

a) transmitting a first random challenge from a first device to a second device, and transmitting a second random challenge from the second device to the first device;

b) in the first device, encrypting, then hashing the second random challenge, and in the second device, encrypting, then hashing the first random challenge;

c) transmitting the hashed, encrypted, second random challenge to the second device, and transmitting the hashed, encrypted, first random challenge to the first device;

d) in the first device, comparing the hashed, encrypted first challenge to a first expected value, and in the second device comparing the hashed, encrypted second random challenge to a second expected value;

e) if both comparisons in (d) result in a match, then generating a preliminary control channel key to establish a preliminary content channel, the generating of the preliminary control channel key comprises encrypting the first random challenge, encrypting the second random challenge and performing an exclusive OR operation on the encrypted first random challenge and the encrypted second random challenge; and

f) transferring information over the preliminary content channel.

9. The method of claim 8, further comprising determining if the result of the exclusive OR operation is a zero, and if it is, then setting the preliminary control channel key equal to the encrypted first challenge.

10. The method of claim 8, wherein encrypting the first challenge comprises performing a baseline cipher operation with a secret key.

11. A method comprising:

a) conducting a preliminary authentication phase to establish an encrypted control channel between a first device and a second device;

b) temporarily transferring content over the encrypted control channel; and

c) conducting a full authentication phase in a background while transferring the content over the encrypted control channel, the full authentication phase being more robust than the preliminary authentication phase.

12. The method of claim 11, wherein conducting the full authentication phase comprises:

transferring a first message from the first device;

receiving a second message by the first device, the second message including a message signature and a certificate;

determining by the first device that the second message is valid;

verifying by the first device that the certificate is valid; and

calculating a key for maintaining the encrypted control channel.

13. The method of claim 12, further comprising:

selecting an channel encryption function to be used in connection with the encrypted control channel.

a) a first program conde to conduct a preliminary authentication phase to establish an encrypted control channel between the computer and a remote device;

b) a second program code to temporarily transfer content over the encrypted control channed from the computer; and

c) a third program code to conduct a full authentication phase in a background while transferring the content over the encrypted control channel, the full authentication phase being more robust than the preliminary authentication phase.

14. The method of claim 11, wherein the coducting of the preliminary authentication phase includes encrytion and subsequent hashing of random challenges provided by the first device and the second device.

15. A method comprising:

a) conducting a preliminary authentication phase to establish an encrypted control channel between a first device and a second device, the conducting of the preliminary authentication phase comprises (i) exchanging data between the first device and the second device, (ii) encrypting the exchanged data and subsequently hashing the encrypted data, (iii) exchanging the encryted, hashed data, (iv) comparing the exchanged encryted, hashed data to expected values, and (v) establishing the encryted control channel if the exchanged encryted, hashed data matches the expected values;

b) temporarily transferring content over the encryted control channel; and

c) conducting a full authentication phase in a background while transferring the content over the encryted control channel, the full authentication phase being more robust than the preliminary authentication phase.

16. The method of claim 15, wherein the exchanged data is encryted with a preliminary control channel key being a result of a shared secret key and a random challenge of the first device encryted with a cipher.

17. The method of claim 16, wherein the cipher is a Baseline Cipher.

18. The method of claim 15, wherein the exchanged data is encryted with a preliminary control channel key being a result of an Exclusive OR operation on (1) a shared secret key and a random challenge of the first device encryted with a cipher and (2) the shared secret key and a random challenge of the second device encryted with the cipher.

19. The method of claim 15, wherein the conducting of the full authentication phase occurs in the background while the content is being transferred over the encryted control channel.

20. A computer program code stored in a computer-readable storage medium for execution by a comupter, comprising:

a) a first program code to conduct a preliminary authentication phase to establish an encryted control channedl between the computer and a remote device;

b) a second program code to temporarily transfer content over the encryted control channel from the computer; and

c) a third program code to conduct a full authentication phase in the background while transferring the content over the encryted controll channel, the full authentication phase being more robust than the preliminary authentication phase.

21. The computer program code of claim 20, wherein third program code to conduct the full authentication phase comprises:

code to transfer a first message from the computer;

code to receiving a secon message by the computer, the second message including a message signature and a certificate, and to determine that the second message is valid and the certificate is valid; and

code to calculate a key for maintaing the encryted control channel.

22. The computer program code of claim 20, wherein the preliminary anthentication phase conducted by the first program code includes encryption and subsequent hashing operations on a first radom challenge by the first device and on a second random challenge by the second device and comparison of the hashed encrypted random challenges with expected values by both the first device and the second device.

23. A computer program code stored in a computer-readable storage medium for execution by a computer, comprising:

a) a first program code to conduct a preliminary authentication phase to establish an encryted control channel between the computer and a remote device, the first program code comprises

code to exchange data by the computer with the remote device,

code to encrypt the exchanged data and subsequently hash the encrypted data,

code to exchange the encrypted, hashed data with the remote device,

code to compare the exchanged encrypted, hashed data to expected values, and

code to establish the encrypted control channel if the exchanged encrypted, hashed data matches the expected values;

b) a second program code to temporarily transfer content over the encrypted control channel from the computer; and

c) a third program code to conduct a full authentication phase in a background while transferring the content over the encrypted control channel, the full authentication phase being more robust than the preliminary authentication phase.

24. The computer program code of claim 23, wherein the code to encrypt the exchanged data performs encryption using a preliminary control channel key being a result of a shared secret key and a random challenge of the computer encrypted with a cipher.

25. The computer program code of claim 23, wherein the code to encrypt the exchanged data performs encryption using a preliminary control channel key being a result of an Exclusive OR operation on (1) a shared secret key and a random challenge of the computer encrypted with a cipher and (2) the shared secret key and a random challenge of the remote device encrypted with the cipher.

26. The computer program of claim 23, wherein the full authentication phase is conducted by the second program code in the background while the content is being transferred over the encrypted control channel.

27. A device comprising:

a) means for conducting a preliminary authentication phase to establish an encrypted control channel to a remote device;

b) means for temporarily transferring content over the encrypted control channel; and

c) means for conducting a full authentication phase in a background while transferring the content over the encrypted control channel, the full authentication phase being more robust than the preliminary authentication phase.

28. The device of claim 27, wherein the means for conducting the preliminary authentication phase further encrypts and performs subsequeng hashing operations of random challenges provided by the first device and the second device.

29. A device comprising:

a) means for conducting a preliminary authentication phase to establish an encrypted control channel to a remote device, including (i) means for exchanging data with the remote device, (ii) means for encrypting the exchanged data and subsequently hashing the encrypted data, (iii) means for comparing the exchanged encrypted, hashed data to expected values, and (iv) means for establishing the encrypted control channel if the exchanged encrypted, hashed data matches the expected values;

b) means for temporarily transferring content over the encrypted control channel; and

c) means for conducting a full authentication phase in a background while transferring the content over the encrypted control channel, the full authentication phase being more robust than the preliminary authentication phase.

30. The device of claim 29, wherein the exchanged data is encrypted with a preliminary control channel key being a result of a shared secret key and a random challenge of the first device encryptee with a cipher.

31. The device of claim 29, wherein the exchanged data encrypted with a preliminary control channel key being a result of an Exclusive OR operation on (1) a shared secret key and a random challenge of the device encrypted with a cipher and (2) the shared secret key and a random challenge of remote device encrypte with the cipher.

32. The device of claim 29, wherein the means for conducting the full authentication phase operates in the background while the content is being transferred over the encrypted control channel.

33. A method comprising:

a) conducting a preliminary authentication phase to produce an encrypted control channel between a first device and a second device;

b) transferring content over the encrypted control channel; and

c) conducting a full authentication phase in the background while transferring the content over the encrypted control channel, the full authentication phase being more robust than the preliminary authentication phase.

34. The method of claim 33, wherein the conducting of the preliminary authentication phase includes encryption and subsequent hashing of random challenges provided by the first device and the second device.

35. A method comprising:

a) conducting a preliminary authentication phase to produce an encrypted control channel between a first device and a second device by (1) exchanging data between the first device and the second device, (2) encrypting the exchanged data and subsuquently hashing the encrypted data, (3) exchanging the encrypted, hashed data, (4) comparing the exchanged encrypted, hashed data to expected values, and (5) producing the encrypted control channel if the exchanged encrypted, hashed data matches the expected values;

b) transferring content over the encrypted control channel; and

c) conducting a full authentication phase in the background while transferring the content over the encrypted control channel, the full authentication phase being more robust than the preliminary authentication phase.

36. The method of claim 35, wherein conducting the full authentication phase comprises:

transferring a first message from the first device;

receiving a second message by the first device, the second message including a message signature and a certificate

determining by the first device that the second message is valid;

verifying by the first device that the certificate is valid; and

calculating a key for maintaining the encrypted control channel.

37. The method of claim 35, wherein the exchanged data is encrypted with a preliminary control channel key being a result of an Exclusive OR (XOR) operation on (1) a shared secret key and a random challenge of the first device encrypted with a cipher and (2) the shared secret key and a random challenge to the second device encrypted with the cipher.

38. The method of claim 35, wherein the conducting of the full authentication phase operates in the background while the content is being transferred over the encrypted control channel.

39. The method of claim 35, wherein the data includes random challenges.

40. The method of claim 39, wherein the encrypted control channel is supported by a preliminary phase control key being a result produced by an Exclusive OR operation being conducted on an encrypted the random challenges provided by the first device and a second device.

Description

FIELD OF THE INVENTION

The present invention relates generally to digital content protection and more particularly to scaleable methods and apparatus for secure communication between content sources and content sinks when either or both are computationally constrained.

BACKGROUND

Computer capabilities have increased dramatically in recent years. In addition to traditional computer applications such as word processing and spreadsheet calculations, modern personal computers (PCs) are typically capable of producing and playing multimedia presentations.

Multimedia applications may include materials such as audio, video or graphic elements that are subject to copyright or contractual restrictions as to use, distribution or the like. Typically, the multimedia content is provided in digital form for use by computers or other digital consumer electronic (CE) devices.

Many content providers are reluctant to include valuable copyrighted material, e.g., full length motion pictures, for use in multimedia applications because the digital bitstream may be intercepted and copied. Unlike analog materials which degrade in quality from one copy generation to the next, digital copying is capable of producing perfect copies regardless of how many generations of copies are produced.

Recent advances in storage technology, particularly digital video discs (DVD) have created the ability to store full length motion pictures on a single small disc. However, consumers are unlikely to benefit from such advances unless content providers have a mechanism to distribute digitized versions of their valuable copyrighted material in a manner that largely eliminates unauthorized copying.

It is possible to devise strong content protection schemes for securely transferring digital content between various devices. These schemes are often computationally intensive, although modern PCs and customized hardware implementations, typically have sufficient computational resources to perform these content protection schemes in a substantially real-time manner. However, in order to meet manufacturing cost targets, CE devices are often not equipped with the computational resources needed to implement strong content protection schemes in a substantially real-time manner.

What is needed is a method and apparatus for protecting digital content from copying and/or other misuse as it is transferred between one or more computationally constrained devices over insecure communication links.

SUMMARY OF THE INVENTION

Briefly, a method of transferring content between one or more computationally constrained devices over insecure links, includes preliminarily authenticating that both a content source and a content sink are compliant devices, transferring content between compliant devices, then, in the background, concurrently with the transfer of content, perform at least a second cryptographic process.

In an embodiment, establishing a preliminary control channel includes exchanging random challenges between devices, encrypting, under a shared secret key, and hashing the exchanged random challenges, exchanging the results of the encryption and hash functions and then verifying that the appropriate results have been generated.

Other features and advantages of the present invention will be apparent from the drawing figures, and detailed description that follow.

BRIEF DESCRIPTION OF THE DRAWINGS

FIGS. 1(a)-(b) are flow diagrams showing embodiments of an authentication process in accordance with the present invention.

FIG. 2 is a flow diagram showing an embodiment of an authentication process in accordance with the present invention.

FIGS. 3(a)-(b) are flow diagrams showing an authentication and preliminary control channel key generation in accordance with the present invention.

FIGS. 4(a)-(b) are flow diagrams showing an authentication process in accordance with the present invention.

FIG. 5 is a flow diagram showing establishment of a content channel in accordance with the present invention.

FIG. 6 is a block diagram showing a content source in accordance with the present invention.

FIG. 7 is a block diagram showing a content sink in accordance with the present invention.

FIG. 8 is a block diagram showing an embodiment of the present invention implemented with a software authentication proxy.

DETAILED DESCRIPTION

Various aspects of the present invention are described below. However, it will be understood by those skilled in the art that the present invention may be practiced with only some or all aspects of the present invention. For purposes of explanation, specific numbers, materials and configurations are set forth in order to provide a thorough understanding of the present invention. It will also be apparent to those skilled in the art that the present invention may be practiced without these specific details.

Some portions of the detailed descriptions which follow are presented in terms of algorithms and symbolic representations of operations on data bits within a computer or other information processing system. These algorithmic descriptions and representations are the means used by those skilled in the data processing arts to most effectively convey the substance of their work to others skilled in the art. An algorithm is here, and generally, conceived to be a self-consistent sequence of steps leading to a desired result. The steps are those requiring physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, transferred, combined, compared, and otherwise manipulated. It has proven convenient at times, principally for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like. It should be borne in mind, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. Unless specifically stated otherwise as apparent from the following discussions, it is to be appreciated that throughout the present invention, discussions utilizing terms such as "processing" or "computing" or "calculating" or "determining" or "displaying" or the like, refer to the action and processes of a computer system, or similar electronic computing device, that manipulates and transforms data represented as physical (e.g., electrical) quantities within the computer system's registers and memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage, transmission or display devices.

Terminology

Baseline Cipher refers to a cipher algorithm that is common to all compliant devices. Examples of some well-known algorithms that may be used are Blowfish, DES and RC-4.

Blowfish refers to a block cipher that can be implemented very efficiently in software on PCs. It is described in, "Description of a New Variable Length Key, 64-Bit Block Cipher (Blowfish)," by B. Schneier, Fast Software Encryption, Cambridge Security Workshop Proceedings, Springer-Verlag, 1994, pp. 191-204.

Compliant device refers to a device which is capable of securely transferring content in accordance with the present invention. Typically, the compliant device should have a digital certificate signed by a license authority, implement anti-tampering measures to reduce the likelihood that details about the private key and/or authentication and key exchange mechanisms are readily discernible or alterable, and should avoid transferring protected content unless all devices participating in the content transfer have been authenticated.

CGMS refers to Copy Generation Management System, a well-known format for indicating copy protection status.

Computationally constrained, as used herein, refers to devices that do not have sufficient computational resources to perform the processes needed to authenticate compliant devices and establish secure control and content channels rapidly enough such that protected content can be delivered to a user within an acceptable latency period. The acceptable length of the latency period varies between individual users, however, substantially real-time operation is generally considered a desirable goal.

Device, as used herein, refers to both traditional consumer electronics products including but not limited to DVD player/recorders, digital televisions, set top boxes, digital satellite services receivers, and similar products, as well as applications running on one or more computers.

DES refers to the Data Encryption Standard a popular, symmetric key, standard encryption algorithm. It is a product cipher that operates on 64 bit blocks of data, using a 56 bit key. It is defined in FIPS 46-1 (1988) (which supersedes FIPS 46 (1977)). DES is identical to the ANSI standard Data Encryption Algorithm (DEA) defined in ANSI X3.92-1981.

DSA refers to the Digital Signature Algorithm specified in the DSS.

DSS refers to the Digital Signature Standard specified in FIPS 186 Digital Signature Standard, May 19, 1994, and available from NTIS.

FIPS refers to Federal Information Processing Standards, which are United States Government technical standards published by the National Institute of Standards and Technology. Computer-related products bought by the US Government must conform to these standards.

IEEE 1394 refers to IEEE Standard for a High Performance Serial Bus, IEEE Std 1394-1995, Institute of Electrical and Electronic Engineers, August 30, 1995.

ISO refers to the International Organization for Standardization, a voluntary, organization, responsible for creating international standards in many areas, including computers and communications.

MPEG is an acronym for Moving Picture Experts Group, and refers to an ISO committee that generates standards for digital video and audio compression. MPEG also refers to the name of algorithms promulgated by the MPEG committee. MPEG-1 is optimized for CD-ROM, MPEG-2 for broadcast quality video and MPEG-4 for low bandwidth video telephony.

Public key refers to ciphers that use different keys for encrypting and decrypting a particular unit of data.

Symmetric key refer to ciphers that use the same key for encrypting and decrypting a particular unit of data.

Overview

Embodiments of the present invention provide the ability to communicate (that is, transfer, transmit, distribute, or the like), protected content between devices over otherwise insecure communication links, at varying levels of security. In particular, a first level of security is selected that can be established quickly by computationally constrained devices. Protected content can then be transferred between devices while a more secure channel is established in the background. In this way even low cost, computationally constrained devices can begin delivering content to a user with low latency. FIG. 1(a) illustrates a process embodying the present invention where in a step 104, preliminary control and content channels are established, and subsequently, in a step 106, full control and content channels are established.

FIG. 1(b) illustrates an alternative embodiment which includes a step 102, wherein a determination is made as to whether the content source or sink is computationally constrained. If neither of the devices is computationally constrained then the step of establishing preliminary control and content channels is bypassed.

In embodiments of the present invention, when two (or more) compliant devices are to exchange protected content across a communications medium, such as an IEEE 1394 serial bus, the cryptographic protocols described herein are used to protect the content as it traverses the bus.

Before any protected content can be exchanged, the devices that are to exchange the content must first authenticate themselves if they have not previously done so. Authentication is required to ensure that all of the devices that will be handling the protected content are compliant. The device authentication and control channel establishment process has two phases, first a preliminary authentication, followed by a full authentication. The properties of the two authentication phases are summarized in the Table 1.

    TABLE 1
    Authentication             Computation Computation Time (CE
    Phase         Robustness  Time (PC)   Microcontroller)
    Preliminary   Reasonable  less than a milliseconds
                              millisecond
    Full          High        10s of      10s of seconds
                              milliseconds

• Inventors
  Traw, Chandler Brendan Stanton; Aucsmith, David Wayne;
• Assignee
  Intel Corporation (Santa Clara, CA)
• Published
  Apr-1-2003
• Current US Classes:
  380/260
  380/262
  380/264
  713/168
  713/169
• Application #
  909338
• International Classes
  H04L 009/12; H04L 009/16
• Field of Search
  380/4 380/28 380/49 380/201 380/264 380/268 380/271 380/286 380/260 380/262 713/1 713/100 713/150 713/151 713/168 713/169 713/189 713/156
• Examiner
  Hayes; Gail
• Agent
  Blakely, Sokoloff, Taylor & Zafman LLP
• US Patent References:
  4937866
  5241598
  5473692
  5539828
  5568552
  5621798
  5701464
  5712914
  5751809
  5757919
  5796840
  5805700
  5805706
  5805712
  5818939
  5825890
  5828753
  5845116
  5878144
  5892899
  5907619
  5926550
  5949877
  5949881
  5970147
  6021201
  6023509
  6058478
  6088450
  6115816
  6175626
  6175925
  6178509
  6181803
  6185546
  6199053
  6205550
  6209098
  6219423
  6292892