Certificate-Based Digital Content Protection via Credential Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing digital content protection schemes are vulnerable to attacks such as forged certificate and bypass attacks, which allow unauthorized access to protected content due to flaws in the authorization processes.
Innovation Solution
A cryptographic method that enciphers protected content using a content key derived from a content encryption algorithm, and further enciphers this key with a user key to create a certificate that does not contain the user credentials or key, ensuring secure access authorization through a content key decryption algorithm, preventing unauthorized access by generating a decryption user key based on matching credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional content protection schemes store credentials in certificates for access authorization, then ease of operation is improved, but reliability deteriorates due to vulnerability to forged certificate attacks
Solution Approach 1:
The patent extracts the credentials from the certificate structure, storing only a cryptographic hash of the credentials in the certificate rather than the credentials themselves. This separation allows the system to maintain ease of operation while improving security, as the certificate no longer contains vulnerable credential data that attackers can forge or extract.
Solution Approach 2:
The patent introduces a security software component that acts as an intermediary between the certificate and the content protection system. This intermediary verifies credentials by comparing them against the hash stored in the certificate, rather than directly trusting the certificate contents. This adds a verification layer that prevents forged certificate attacks while maintaining user-friendly access authorization.
2Adaptability or versatility
If conventional content protection schemes allow certificate replacement for bypass attacks, then adaptability is improved, but reliability deteriorates due to unauthorized access
Solution Approach 1:
The patent applies preliminary anti-action by pre-computing and storing a cryptographic hash of the credentials in the certificate before any access attempt occurs. This pre-established verification mechanism prevents bypass attacks, as any attempt to replace or modify the certificate will result in a hash mismatch, blocking unauthorized access while allowing legitimate certificate updates.
3Ease of operation
If security software is stored on user-controlled systems, then ease of operation is improved, but object-generated harmful factors worsen due to potential security breaches
Solution Approach 1:
The patent introduces a security software intermediary that performs verification locally on user systems. This intermediary contains the verification logic and uses cryptographic hashes to validate credentials, creating a secure local verification mechanism that is resistant to attacks. The intermediary acts as a trusted component that mitigates the security risks of storing security functionality on user-controlled systems.
Solution Approach 2:
The patent uses cryptographic hash copying to verify credentials. Instead of storing or transmitting sensitive credential data, the system computes and compares hash copies of the credentials. This copying mechanism allows local verification security software to function securely without exposing actual credential information, reducing the harmful factors of storing security software on user systems.
Data Source
AI summary
A computer-implemented method and related system controls access to protected content with certificate-based access authorization. Protected content stored in a memory of a computer is enciphered using a content key to produce a quantity of enciphered, protected content, wherein the content key is derived from a content encryption algorithm. A user key is derived from user credentials using a credential encryption algorithm. The content key is enciphered with the user key using a content key encryption algorithm to produce a certificate, wherein the certificate contains the enciphered content key. Access to the protected content is controlled by the user credentials and the certificate containing a second enciphered content key. A decryption user key is generated and access authorization to the protected content is determined based on the decryption user key in response to a match of the decryption user key with the user key.