Key Refresh Between Trusted Units in Media Gateways
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
As computing systems become more complex, ensuring secure and efficient communication of multimedia content between components while protecting copyrighted material is challenging due to increased complexity in interconnect architectures and the need for high performance with power savings.
Innovation Solution
A media gateway system with a system-on-chip (SOC) architecture that employs a security encryption controller to manage encryption keys and session keys for secure data transmission between the SOC and transcoder, using AES encryption and frequent key refreshes to protect content from unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If frequent key refreshes are implemented to enhance security, then security is improved, but processing overhead and complexity increase
Solution Approach 1:
The key management system is segmented into distinct components: a key generation module that creates refresh keys, a key distribution module that delivers keys to trusted units, and a key storage module that manages key lifecycles. This segmentation allows frequent key refreshes to be handled in a structured manner, reducing processing overhead while maintaining security.
Solution Approach 2:
Keys are generated and distributed to trusted units in advance before they are needed for content protection. The system pre-establishes a hierarchy of keys (parent keys, refresh keys, content keys) and distributes them to trusted units beforehand, so that when content needs to be protected, the key material is already in place and ready for use, reducing real-time processing overhead.
2Reliability
If multiple session keys are maintained for different content segments, then security is improved, but memory usage and management complexity increase
Solution Approach 1:
The key hierarchy is structured in a nested manner where parent keys contain and protect refresh keys, which in turn protect multiple content keys. Each level of the hierarchy nests within the previous level, creating a compact representation where a single parent key can represent and control multiple nested content keys, reducing the total memory footprint while maintaining the ability to protect multiple content segments.
Solution Approach 2:
Parent keys are designed to be universal and can be used to protect multiple different refresh keys and content keys across different trusted units and content segments. A single parent key serves multiple functions: generating refresh keys for different time periods, protecting content keys for different trusted units, and enabling key rotation across the entire system, thereby reducing the number of keys that need to be stored individually.
3Reliability
If AES encryption with frequent key changes is used, then content protection is improved, but processing time and power consumption increase
Solution Approach 1:
Key refreshes are implemented periodically rather than continuously, with content keys being generated and applied at regular intervals defined by the refresh keys. This periodic action allows the system to maintain strong content protection through frequent key changes while reducing power consumption by avoiding continuous key generation and encryption operations. The system enters lower-power states between key refresh cycles.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Encryption logic to identify a particular session key, where the particular session key is one of a plurality of session keys for use in encrypting content to be sent from a first device. The encryption logic is to encrypt particular content with the particular session key to obtain encrypted particular content. I/O logic is provided that can cause the particular content to be sent with a key refresh structure, where the key refresh structure is to identify that the particular session key was used to encrypt the particular content.