Secure Processing Zone for Streaming Content Key Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing digital rights management systems face challenges in securely delivering and managing content encryption keys for streaming content, particularly in ensuring the security of premium content over networks, as they often rely on insecure connections and lack robust key management mechanisms.
Innovation Solution
The method employs symmetric encryption of content encryption keys (CEKs) using a key encryption key (KEK) derived from a root key, which is periodically renewed, and securely stored and processed within a client device's secure processing zone, allowing for secure delivery and decryption of streaming content even over non-secure connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If content encryption keys are delivered over network connections, then content streaming is enabled, but security against unauthorized access is compromised
Solution Approach 1:
The patent extracts the key decryption process from the general processing environment and places it within a dedicated secure processing zone (Trusted Execution Environment) on the client device. This separation ensures that even if the network connection is compromised, the actual key material never leaves the secure zone, maintaining security while enabling network-based content delivery
Solution Approach 2:
The patent introduces an intermediary encryption layer where content is encrypted with a content encryption key (CEK) that is itself encrypted with a key encryption key (KEK). The KEK is delivered over the network while the CEK is derived locally in the secure zone, acting as a mediator that allows network transmission without exposing the actual content decryption key
2Device complexity
If key management mechanisms are simplified for ease of use, then system complexity is reduced, but security robustness deteriorates
Solution Approach 1:
The patent segments the key management system into distinct functional zones: a secure processing zone that handles sensitive key operations and a general processing zone for content delivery. This segmentation allows the system to maintain strong security within the secure zone while presenting a simpler interface to users and applications in the general zone
Solution Approach 2:
The patent implements preliminary action by pre-establishing the secure processing zone and pre-loading necessary cryptographic materials before content delivery begins. The secure zone is configured in advance with appropriate security policies and cryptographic primitives, so that when content needs to be delivered, the secure infrastructure is already in place and ready to operate
Data Source
AI summary
A method and a user device are disclosed for securing streaming content decryption. The method includes receiving at the user device a manifest for requested content, the manifest providing a Content Encryption Key (CEK) that is encrypted using a first public Key Encryption Key (KEK), a corresponding first private KEK being stored in secure storage on the user device; decrypting, inside a secure processing zone on the user device, the CEK using the first private KEK to create a decrypted content key; decrypting, inside the secure processing zone, requested content using the decrypted content key to form decrypted content; and providing the decrypted content to a decoder on the mobile user device.