DRM Device Secure Identity Linking via SIM Key Derivation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing digital rights management (DRM) systems face challenges in securely linking user identities to devices, particularly in scenarios where devices are not initially specified at content purchase, and require cumbersome user updates or insecure token-based solutions.
Innovation Solution
A method involving a DRM device and server that uses a secure bootstrapping procedure with a subscriber identity module (SIM) and a trusted key management server to derive a device-specific key based on a master key, device identifier, and random number, ensuring secure authentication and license acquisition.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a token-based solution is used to link user identity to device, then authentication is simplified, but security deteriorates because tokens can be copied and distributed insecurely
Solution Approach 1:
The patent extracts the security-critical elements (master key and derived keys) from the token-based approach and embeds them directly into the device's SIM module. This eliminates the need for separate token distribution while maintaining authentication simplicity and improving security through cryptographic key derivation.
Solution Approach 2:
The patent introduces a trusted key management server as an intermediary that facilitates secure key derivation between the user's SIM module and the DRM server. This intermediary enables secure authentication without requiring direct token transmission, resolving the security simplicity contradiction.
2Device complexity
If a static database is used to record user-device relationships, then implementation is simple, but adaptability deteriorates because it cannot support temporary device usage
Solution Approach 1:
The patent replaces the static database with a dynamic key derivation mechanism that generates device-specific keys on-demand based on the device identifier and random number. This dynamic approach allows the system to adapt to temporary device usage scenarios while maintaining implementation simplicity through automated key management.
Solution Approach 2:
The patent changes the parameter from static stored keys to dynamically derived keys that incorporate random numbers and device identifiers. This parameter transformation enables the system to support temporary device usage while keeping the implementation simple through automated key derivation processes.
3Reliability
If the user manually updates the service provider database when acquiring new devices, then database accuracy is maintained, but ease of operation deteriorates due to heavy user burden
Solution Approach 1:
The patent implements self-service by enabling the device to automatically derive its own key using the SIM module's master key and the device identifier. This eliminates the need for manual user updates while maintaining database accuracy through automated key generation and transmission to the DRM server.
Solution Approach 2:
The patent performs preliminary action by pre-storing the master key in the SIM module during device initialization. This preliminary setup enables automatic key derivation and transmission to the service provider without requiring manual user intervention, thus maintaining database accuracy while improving ease of operation.
4Ease of operation
If device identifiers are collected at content purchase time, then user identity linking is simplified, but ease of operation deteriorates because users must specify all future devices in advance
Solution Approach 1:
The patent applies dynamics by replacing static pre-specified device lists with dynamic on-demand key derivation. The system can accommodate any device that presents the correct device identifier and random number, providing flexibility for future devices while maintaining simplicity through automated key generation.
Solution Approach 2:
The patent performs preliminary action by establishing the master key in the SIM module during initial setup. This preliminary configuration enables the system to handle future device identification and key derivation automatically, providing adaptability for unspecified future devices while keeping the user experience simple.
Data Source
AI summary
Disclosed is a DRM device and method for providing secure linking to a user identity. A first request is sent to a subscriber identity module. A message is received from the subscriber identity module via a secure authenticated channel. The message comprises at least a master key identifier, a random number, and a derived key. In response to the message, a second request is sent to a DRM server. The second request comprises at least a master key identifier, the device identifier, and a random number. Also disclosed is a DRM server and method for providing secure linking to a user identity. A first request is received from a DRM device. The first request comprises at least master key identifier, a device identifier, and a random number. The DRM device is authenticated. A second request for an application specific key is sent to a trusted key management server. The second request comprises at least a master key identifier. At least a key is received from the trusted key management server. A derived key is determined from the key received from the trusted key management server based at least on the device identifier and the random number. A challenge/response scheme is used to determine whether the derived key of the DRM server matches a derived key of the DRM device.