Cloud Key Delivery Microservices for White-Box Media Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing content distribution systems (CDS) face challenges in flexibility and virtualization, particularly when migrating to cloud environments, due to rigid architectures and the coupling of key delivery mechanisms with content encryption, making it difficult to secure secret data and maintain privacy.
Innovation Solution
A cloud-based architecture with micro-services that separate CA key control messages from content encryption, using a key server microservice to generate encoded control words and a software encryption microservice for white-box encryption, enabling secure and flexible media content delivery in cloud environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If content protection systems use hardware accelerated services of HSM to maintain security, then security is improved, but device complexity and difficulty of virtualization increase
Solution Approach 1:
The patent replaces hardware security modules (HSM) with software-based security implementations. The conditional access system uses software encryption microservices and white-box cryptography techniques instead of hardware-accelerated security services, eliminating the need for specialized hardware while maintaining security requirements.
Solution Approach 2:
The patent creates virtualized copies of security functions through software microservices. Instead of relying on physical HSM devices, the system implements security functionality as software that can be replicated and distributed across cloud infrastructure, enabling virtualization while preserving security capabilities.
2Adaptability or versatility
If conditional access applications are deployed in cloud to increase flexibility, then adaptability is improved, but security of secret data and code deteriorates
Solution Approach 1:
The patent segments the conditional access system into separate microservices, including key server microservices and software encryption microservices. This segmentation allows different security functions to be independently deployed and managed in cloud environments, improving flexibility while maintaining security through distributed architecture.
Solution Approach 2:
The patent introduces white-box cryptography as an intermediary layer between secret data and processing operations. This technique embeds security protections directly into the software code, creating a mediator that protects secrets during runtime operations in cloud environments without requiring isolated hardware environments.
3Reliability
If key delivery messages are tightly coupled with content encryption to maintain security, then security is improved, but adaptability and ease of distribution deteriorate
Solution Approach 1:
The patent separates key delivery messages from content encryption operations by implementing them as distinct microservices. The key server microservice handles key management and delivery, while software encryption microservices perform content encryption, allowing independent deployment and distribution of each function.
Solution Approach 2:
The patent creates universal microservice components that can perform multiple functions. The software encryption microservice can handle both key processing and content encryption, while the key server microservice can serve multiple clients and content types, improving distribution flexibility while maintaining security through standardized interfaces.
Data Source
AI summary
A cloud-based system and method for encrypting media content is disclosed. The system comprises a key server microservice, for receiving control word requests and for generating encoded control words and a software encryption microservice, communicatively coupled to the key server microservices, the encryption microservice for receiving the media content, for generating the control word requests, for receiving the encoded control words, and for white-box encrypting the media content according to the generated encoded control words.