DRM Content Key Protection via Proxy Reencryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing digital rights management (DRM) protocols expose content keys in the clear, creating a potential attack surface and reducing the willingness of content creators and providers to distribute keys, and they introduce high latency due to multiple message exchanges.
Innovation Solution
Implementing proxy reencryption techniques using indistinguishability obfuscation, puncturable public-key encryption, and functional encryption to transform ciphertexts under one public key to another, ensuring end-to-end protection of content keys and reducing message exchanges.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If content keys are revealed in the clear to DRM service, then DRM service can manage content distribution, but content keys are exposed creating attack surface and reducing willingness of content creators to distribute keys
Solution Approach 1:
A proxy reencryption mechanism is introduced as an intermediary between the content owner and DRM service. The proxy holds a reencryption key that allows it to transform ciphertexts from one encryption scheme to another without ever revealing the plaintext content key. This intermediary enables the DRM service to obtain encrypted content keys suitable for device distribution while the content owner never exposes their content key in the clear to the DRM service.
Solution Approach 2:
The encryption system is segmented into multiple cryptographic schemes working together: the content owner uses their own encryption scheme to encrypt content keys, the proxy uses a reencryption key to transform these ciphertexts, and the DRM service receives transformed ciphertexts that it can then distribute to devices. This segmentation allows each party to operate with their own cryptographic materials without exposing sensitive keys to others.
2Reliability
If multiple message exchanges are used in DRM license request process, then proper authentication and key distribution can be achieved, but latency is increased
Solution Approach 1:
The proxy pre-computes and stores reencryption keys for multiple devices before actual content distribution occurs. When a device requests content, the DRM service can immediately use the pre-computed reencryption key to transform the content key ciphertext without requiring iterative authentication messages. This preliminary preparation of cryptographic materials eliminates the need for multiple back-and-forth message exchanges during the actual license request.
Data Source
AI summary
This disclosure relates to systems and methods for managing protected electronic content using proxy reencryption techniques. Rights management architectures are described that may, among other things, provide end-to-end protection of content keys from their point of origination at a content creator and/or content service to end user devices. Proxy reencryption techniques consistent with aspects of the disclosed embodiments may enable transformation of a ciphertext under one public key to a ciphertext containing the same plaintext under another public key. Consistent with embodiments disclosed herein, proxy reencryption processes may be implemented using indistinguishability obfuscation and puncturable public-key encryption schemes, functional encryption, and/or white box obfuscation techniques.