One-Time-Use Nonce Protocol for Secure Content Protection Key Transfer

Solution Overview

Problem

Existing content protection systems face challenges in securely transferring cryptographic data over potentially insecure communication channels, particularly when using two-factor authentication, as sensitive information like the content protection key may be intercepted by eavesdroppers.

Innovation Solution

A method involving a mobile communication device and a smart card reader uses a one-time-use nonce to generate and manage cryptographic keys, ensuring that the content protection key is never transmitted in its raw form over insecure channels by encrypting and decrypting it within the device, using a derived key and a public key for secure storage and access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If cryptographic data is transferred over communication channels, then authentication and data protection functions are enabled, but security is compromised due to potential eavesdropping on insecure channels

Engineering Contradiction:

ImprovesecurityVSAvoideavesdropping

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary encryption of the content protection key using a derived key before transmission. The derived key is generated from a nonce that is encrypted with the public key. This preliminary protection ensures that even if eavesdropping occurs, the cryptographic data cannot be decrypted without the private key held by the smart card.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary encryption layer using a derived key generated from a nonce. Instead of transmitting the content protection key directly, the system uses this intermediate derived key to encrypt the key, and the nonce to encrypt the derived key. This intermediary mechanism breaks the direct exposure of sensitive cryptographic material over insecure channels.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If the content protection key is transmitted to enable authentication, then access control function is achieved, but the risk of key interception increases

Engineering Contradiction:

ImproveauthenticationVSAvoidkey interception

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary encryption of the content protection key using a derived key before transmission. The derived key is generated from a nonce that is encrypted with the public key. This preliminary protection ensures that even if eavesdropping occurs, the cryptographic data cannot be decrypted without the private key held by the smart card.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent employs a nonce (number used once) that is generated for each authentication session and discarded after use. This disposable cryptographic element ensures that even if one nonce is compromised, previous and future sessions remain secure. The short-living nature of the nonce prevents long-term key interception risks.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

3Reliability

If cryptographic keys are stored in the device, then content protection is enabled, but the device becomes vulnerable to attacks targeting stored keys

Engineering Contradiction:

Improvecontent protectionVSAvoiddevice vulnerability

Core Design Contradiction:

ReliabilityVSObject-generated harmful factors

Solution Approach 1:

The patent segments the cryptographic protection into multiple layers: the content protection key is encrypted with a derived key, and the derived key is generated from a nonce that is encrypted with the public key. This segmentation ensures that no single stored element can compromise the entire protection scheme. The smart card holds only the private key, while the device stores encrypted versions.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary encryption layer using a derived key generated from a nonce. Instead of transmitting the content protection key directly, the system uses this intermediate derived key to encrypt the key, and the nonce to encrypt the derived key. This intermediary mechanism breaks the direct exposure of sensitive cryptographic material over insecure channels.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS8792636B2Protocol for protecting content protection data

Publication Date: 2014.07.29 MALIKIE INNOVATIONS LTD

AI summary

Through the use of a one-time-use nonce, the transfer of cryptographic data over a potentially insecure link in a two-factor content protection system is avoided. The nonce may be stored encrypted with a public key from a smart card. A random key may be used to produce a storage key, which is used to encrypt a content protection key. The random key may be stored, encrypted with a key derived from the nonce. Instead of receiving a raw content protection key over the potentially insecure link, the raw nonce is received and, once used, replaced with a new nonce.