Twice-Encrypted Content Key Distribution for Secure DRM
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Digital Rights Management (DRM) systems face challenges in securely distributing and managing content encryption keys, particularly in systems with limited bandwidth, where the risk of key compromise and unauthorized use increases due to the need for pre-distribution of unique keys to multiple devices.
Innovation Solution
A method involving encrypting a content encryption key (CEK) using a device's public key and an issuer's encryption key, resulting in a twice-encrypted CEK, which is then decrypted using the device's private key and an issuer decryption key, minimizing the time the key is present on the device and reducing the risk of unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If content encryption keys are pre-distributed to multiple devices, then content can be accessed by multiple users, but the risk of key compromise and unauthorized use increases
Solution Approach 1:
The encryption key is segmented into multiple parts and distributed to different devices. Each device receives only a portion of the key, and the complete key can only be reconstructed when all parts are combined, preventing any single device from having full key access and reducing the risk of unauthorized use.
Solution Approach 2:
The key segmentation and distribution process is performed in advance before content access is needed. This preliminary action ensures that devices have the necessary key components ready, enabling quick content access while maintaining security through the segmented structure.
2Adaptability or versatility
If unique keys are distributed to multiple devices, then each device can independently access content, but bandwidth requirements increase
Solution Approach 1:
Instead of distributing complete unique keys to each device, the system distributes copies or segments of the key. Each device receives a simplified version or portion of the key that allows independent access when combined with other segments, reducing the overall bandwidth required for key distribution.
Solution Approach 2:
The key segmentation approach creates a universal system where the same key structure can serve multiple devices simultaneously. Each device uses the same key segmentation methodology, allowing the system to scale to multiple users without proportionally increasing bandwidth requirements, as the key structure itself is reused across devices.
Data Source
AI summary
Digital rights management is described involving a device, a content issuer, and a rights issuer. A content encryption key (CEK) is encrypted using a public key associated with the device to produce an encrypted CEK. The encrypted CEK is encrypted using an issuer encryption key to produce a twice encrypted CEK. The twice encrypted CEK is encrypted using the public key to produce a ciphertext included in a rights object. The rights object is available to the device for decrypting digital content associated with the content issuer. The device can then decrypt the rights object ciphertext using its private key to produce a decrypted rights object ciphertext and decrypt the decrypted rights object ciphertext using an issuer decryption key received from the content issuer to produce an encrypted CEK. The encrypted CEK is decrypted using the private key to obtain the CEK, which is then available for decrypting digital content.