Controller Unique Key Encryption for Secure Content Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing content data distribution systems face challenges in protecting digital content from unauthorized activities, as encrypted content keys can be compromised, leading to the creation of clone storage media and unauthorized use of content data.
Innovation Solution
A data recording device and system that employs a dual encryption scheme using a controller unique key and medium device key, where the medium device key is encrypted and stored with a certificate, enabling secure authentication and key exchange processes to prevent unauthorized access and duplication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encrypted content keys are stored in storage medium, then content data can be securely distributed and accessed, but the encrypted content keys can be compromised leading to unauthorized activities and clone storage media creation
Solution Approach 1:
The patent segments the security system into multiple components: a secret area in the storage medium that stores only a unique identifier (not the encryption key), and a controller that generates and holds the encryption key. This segmentation ensures that even if the storage medium is compromised, the encryption key remains secure because it never resides in the storage medium itself.
Solution Approach 2:
The patent introduces a controller as an intermediary between the storage medium and the content data. The controller generates the encryption key, encrypts content data using this key, and manages the secret area. This intermediary architecture prevents direct access to encryption keys while maintaining secure content distribution.
2Reliability
If encryption keys are stored in the storage medium to enable content protection, then content security is improved, but the system becomes vulnerable to key extraction and unauthorized duplication
Solution Approach 1:
The patent extracts the encryption key from the storage medium and places it solely in the controller. The storage medium retains only a secret area containing a unique identifier that can verify the controller's authenticity but cannot by itself decrypt content. This extraction eliminates the vulnerability of key storage in the medium.
Solution Approach 2:
The patent performs preliminary authentication by verifying the unique identifier in the secret area before allowing any content access or key generation. This preliminary verification ensures that only authorized controllers can access or manipulate encryption keys, preventing unauthorized duplication.
3Ease of operation
If a simple encryption scheme is used for content data, then the system is easier to implement and operate, but it becomes vulnerable to unauthorized decryption and clone media creation
Solution Approach 1:
The patent implements a nested security structure where the secret area containing the unique identifier is embedded within the storage medium, which in turn is controlled by the controller that holds the encryption key. This nested architecture provides layered security while maintaining a relatively simple operational interface for authorized users.
Solution Approach 2:
The patent changes the fundamental parameter of what is stored in the secret area from encryption keys to unique identifiers. This parameter change maintains operational simplicity for authorized users while dramatically improving security against unauthorized decryption and clone media creation.
Data Source
AI summary
A data storage unit may store an encrypted medium device key Enc (Kcu, Kmd_i), and a medium device key certificate (Certmedia).A controller further includes: an information recording unit configured to store a controller key (Kc) and first controller identification information (IDcu). A key generation unit executes a one-way function calculation based on the controller key and the first controller identification information to generate a controller unique key (Kcu). An identification information generating unit executes a one-way function calculation based on on the controller key and the first controller identification information to generate second controller identification information (IDcntr). A key encryption unit encrypts the medium device key (Kmd_i) by the controller unique key (Kcu) to generate encrypted medium device key Enc (Kcu, Kmd_i). A key exchange unit executes an authentication key exchange process with a host device using the medium device key (Kmd_i) and the medium device key certificate (Certmedia).