Content Encryption Key Wrapping for Secure CDN Distribution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional content distribution networks (CDNs) face security vulnerabilities due to the use of a single key pair for encryption, with a central repository that can be a focal point for attackers, compromising data security.
Innovation Solution
Encrypt content using a content-encryption key, attach the encrypted key to the content as metadata, and include an identifier for the key-encryption key in the filename, allowing authorized recipients to retrieve and decrypt the content without a central repository for tracking associations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single key pair is used for all encryption needs with a central repository, then ease of operation is improved, but security is worsened due to the central repository becoming a focal point for attackers
Solution Approach 1:
The patent segments the encryption key management into multiple independent key pairs, each associated with specific content or content types. Instead of using a single central key pair for all encryption needs, the system distributes key management across multiple discrete key pairs stored in the content distribution network, eliminating the single point of failure and reducing attractiveness to attackers.
Solution Approach 2:
The patent introduces key-encryption keys as intermediaries between the content-encryption keys and the actual content. These key-encryption keys are used to encrypt the content-encryption keys, which then encrypt the content. This intermediary layer enables secure key distribution without requiring a central repository, as each content item carries its own encrypted key information.
2Ease of operation
If a central repository is used to store and manage key pairs, then ease of operation is improved, but device complexity is worsened due to the central repository becoming a focal point for attackers
Solution Approach 1:
The patent extracts the key management function from a centralized repository and distributes it throughout the content distribution network. Each content item includes embedded information about its encryption key, allowing local decryption without requiring access to a central key storage system. This extraction eliminates the central repository's role in key management.
Solution Approach 2:
The patent creates self-contained copies of encrypted content with embedded key information for each content item. Instead of relying on a central repository for key retrieval, each content copy includes its own encrypted key data, enabling independent decryption at the receiving end without requiring complex central management infrastructure.
3Ease of operation
If all data is encrypted and decrypted using the same key pair, then ease of operation is improved, but security is worsened due to increased exposure of the key pair
Solution Approach 1:
The patent applies different encryption keys to different content items or content types, creating local quality differentiation in the encryption scheme. Each content item uses its own content-encryption key rather than a universal key pair, so that compromise of one key does not expose other content. This localizes the impact of potential key exposure.
Data Source
AI summary
In various examples, a file such as one representing a game build may be encrypted using a (e.g., randomly generated) content-encryption key, and the content-encryption key may be encrypted using a key-encryption key. The encrypted content-encryption key may be included in the encrypted file (e.g., as metadata), and an identifier associated with the key-encryption key may be included in the encrypted file (e.g., as part of an entropy tag appended to the filename). As such, the encrypted file may be securely distributed (e.g., via a content distribution network). Taking an encrypted game build for cloud gaming as an example, a game developer may encrypt a game build (e.g., as an encrypted disk) and distribute the encrypted build through an interface such as a developer portal of a cloud gaming platform, which may distribute the encrypted build to various data centers and/or geographic zones of the cloud gaming platform.