Centralized Content Encryption Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing multiple cryptographic seeds for content encryption in content delivery services poses challenges due to increased security risks from physical duplication and varying protection schemes, leading to higher expenses and complexities.
Innovation Solution
A content encryption key management system that receives requests for content encryption keys, maps seed identifiers to corresponding seeds and permissions, and determines entitlements to generate and provide the keys, utilizing a hardware security module to securely manage seeds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If cryptographic seeds are physically duplicated across various workflows, then content delivery services can utilize cryptographic keys in multiple content-related workflows, but the risk surface area exposed to potential security breaches and leaks increases
Solution Approach 1:
The patent extracts the cryptographic seeds from the workflows and stores them in a dedicated secure seed storage location, separating the seed management function from the content delivery workflows. This allows workflows to access cryptographic keys without directly handling the seeds themselves, reducing exposure while maintaining versatility.
Solution Approach 2:
The patent introduces a key service as an intermediary component that manages the relationship between workflows and cryptographic seeds. The key service receives requests from workflows, validates permissions, and provides cryptographic keys without exposing the underlying seeds, thus maintaining security while enabling multi-workflow access.
2Reliability
If duplicate security measures are employed for each physical copy location, then cryptographic seeds are secured in separate locations, but system expenses and complexities increase
Solution Approach 1:
The patent merges multiple seed storage locations into a single centralized secure seed storage location. Instead of maintaining separate security infrastructures at multiple locations, the system consolidates seed management while providing key access to multiple workflows through the centralized key service, reducing overall system complexity and expense.
Solution Approach 2:
The patent creates a universal key service that serves multiple workflows from a single seed storage location. This key service performs multiple functions including permission validation, key generation, and key distribution, replacing the need for duplicate security measures at each location while maintaining comprehensive security.
3Adaptability or versatility
If multiple protection schemes with varying levels of robustness are combined, then different content delivery services can utilize their specific protection schemes, but the overall level of system security is reduced
Solution Approach 1:
The patent implements local quality by allowing each workflow to specify its own protection scheme requirements in the key request, while the key service applies the appropriate level of security measures locally to each request. This enables workflows to use their specific protection schemes while the key service maintains overall system security through centralized permission validation and seed protection.
Data Source
AI summary
Systems and methods for managing a content encryption key and a seed to generate the content encryption key are provided. In one example, a method may include receiving a request for a content encryption key at a content encryption key service. The request includes a requesting entity fingerprint that corresponds to a requesting entity and a seed identifier that corresponds to a seed. The seed identifier is mapped to the seed and the requesting entity fingerprint mapped to a corresponding seed permission. If the seed permission entitles the requesting entity to receive the content encryption key, the key is derived using the seed and provided to the requesting entity.