Data owner restricted secure key distribution

A content distribution system is described herein which enables a data owner of content to set one or more restrictions on a data consumer where the one or more restrictions need to be satisfied by a data consumer device before the data consumer has access to the content. In addition, the content distribution system's components are described herein which include a data owner device, a key server, a data consumer device, a data producer device, and a content server.

TECHNICAL FIELD

The present disclosure relates to a content distribution system which enables a data owner of content to set one or more restrictions on a data consumer where the one or more restrictions need to be satisfied by a data consumer device before the data consumer has access to the content. In addition, the present disclosure relates to the content distribution system's components including a data owner device, a key server, a data consumer device, a data producer device, and a content server.

BACKGROUND

Certain content distribution technologies (e.g., Kerberos, Digital Rights Management (DRM)) utilize a secure key distribution as well as authentication tokens where the data consumers are authenticated based on cryptographic means (i.e., digital signature and certificates) before the data consumers receive encrypted keys which enable the decryption and use of the content. These content distribution technologies can also distribute content keys to data consumers with restrictions related to the use of the content after authenticating the data consumers. More specifically, the data distributor that distributes the content to the data consumers can impose restrictions on those data consumers in which the restrictions need to be satisfied before the data consumers can decrypt and use the content. Although these content distribution technologies work well in most of the cases they can still be improved upon. One such improvement to the content distribution technology is the subject of the present disclosure.

SUMMARY

A content distribution system, a data owner device, a key server, a data consumer device, and various methods for improving the content distribution technology are described in the independent claims. Advantageous embodiments of the content distribution system, the data owner device, the key server, the data consumer device, and the various methods are further described in the dependent claims.

In one aspect, the present disclosure provides a content distribution system comprising: a data owner device, a data producer device, a data consumer device, a content server, and a key server. The data producer device is configured to (1) use at least one key and at least one initialization vector (IV) to encrypt content, wherein the content is owned by a data owner, (2) upload encrypted data associated with the at least one key and the at least one IV to the key server, and (3) upload the encrypted content to the content server. The data owner device, operated by the data owner, is configured to issue an authentication token to the key server, wherein the authentication token includes one or more restrictions for a data consumer. The data consumer device, operated by the data consumer, is configured to download the encrypted content from the content server. The key server is configured to (1) receive a request from the data consumer device for access to key data specific to the content, (2) perform an authentication check with the data consumer device to ensure the one or more restrictions are satisfied, and (3) download the key data to the data consumer device once the one or more restrictions are satisfied. The data consumer device is further configured to use the key data to decrypt the encrypted content. An advantage of the content management system is that the data owner can impose restriction(s) on the data consumer that need to be satisfied before the data consumer can access the data owner's content.

In one aspect, the present disclosure provides a data owner device which is operated by a data owner and configured to restrict distribution of content to a data consumer. The data owner device comprises a processor and a memory that stores processor-executable instructions, wherein the processor interfaces with the memory to execute the processor-executable instructions, whereby the data owner device is operable to perform an issue operation. In the issue operation, the data owner device issues, to a key server, an authentication token which includes one or more restrictions that need to be satisfied before the content is able to be decrypted by a data consumer device, wherein the data consumer device is operated by the data consumer, wherein the content is owned by the data owner, and wherein the one or more restrictions are imposed by the data owner. An advantage of the data owner device performing the issue operation is that the data owner can impose restriction(s) on the data consumer that need to be satisfied before the data consumer can access the data owner's content.

In another aspect, the present disclosure provides a method in a data owner device which is operated by a data owner and configured to restrict distribution of content to a data consumer. The method comprises an issuing step. In the issuing step, the data owner device issues, to a key server, an authentication token which includes one or more restrictions that need to be satisfied before the content is able to be decrypted by a data consumer device, wherein the data consumer device is operated by the data consumer, wherein the content is owned by the data owner, and wherein the one or more restrictions are imposed by the data owner. An advantage of this method is that the data owner can impose restriction(s) on the data consumer that need to be satisfied before the data consumer can access the data owner's content.

In one aspect, the present disclosure provides a key server. The key server comprises a processor and a memory that stores processor-executable instructions, wherein the processor interfaces with the memory to execute the processor-executable instructions, whereby the key server is operable to perform a first receive operation, a second receive operation, a perform operation, and a download operation. In the first receive operation, the key server receives, from a data owner device operated by a data owner, an authentication token which includes one or more restrictions (imposed by the data owner) that need to be satisfied before content (owned by the data owner) is able to be decrypted by a data consumer device. In the second receive operation, the key server receives from the data consumer device operated by a data consumer a request for access to key data specific to the content. In the perform operation, the key server performs an authentication check with the data consumer device to ensure the one or more restrictions are satisfied. In the download operation, the key server downloads the key data to the data consumer device once the one or more restrictions are satisfied during the authentication check, wherein the key data enables decryption of the content by the data consumer device. An advantage of the key server performing these operations is that the data owner can impose restriction(s) on the data consumer that need to be satisfied before the data consumer can access the data owner's content.

In another aspect, the present disclosure provides a method in a key server. The method comprises a first receiving step, a second receiving step, a performing step, and a downloading step. In the first receiving step, the key server receives, from a data owner device operated by a data owner, an authentication token which includes one or more restrictions (imposed by the data owner) that need to be satisfied before content (owned by the data owner) is able to be decrypted by a data consumer device. In the second receiving step, the key server receives from the data consumer device operated by a data consumer a request for access to key data specific to the content. In the perform operation, the key server performs an authentication check with the data consumer device to ensure the one or more restrictions are satisfied. In the downloading step, the key server downloads the key data to the data consumer device once the one or more restrictions are satisfied during the authentication check, wherein the key data enables decryption of the content by the data consumer device. An advantage of this method is that the data owner can impose restriction(s) on the data consumer that need to be satisfied before the data consumer can access the data owner's content.

In yet another aspect, the present disclosure provides a data consumer device operated by a data consumer and configured to satisfy one or more restrictions imposed by a data owner before being allowed to decrypt encrypted content. The data consumer device comprises a processor and a memory that stores processor-executable instructions, wherein the processor interfaces with the memory to execute the processor-executable instructions, whereby the data consumer device is operable to perform a first download operation, a send operation, a perform operation, a second download operation, and a use operation. In the first download operation, the data consumer device downloads, from a content server, encrypted content, wherein the encrypted content is owned by a data owner. In the send operation, the data consumer device sends, to a key server, a request for access to key data specific to the content. In the perform operation, the data consumer device performs, with the key server, an authentication check to ensure the one or more restrictions are satisfied, wherein the one or more restrictions have been set by the data owner. In the second download operation, the data consumer device downloads, from the key server, the key data once the one or more restrictions are satisfied. In the use operation, the data consumer device uses the key data to decrypt the encrypted content. An advantage of the data consumer device performing these operations is that the data owner can impose restriction(s) on the data consumer that need to be satisfied before the data consumer can access the data owner's content.

In still yet another aspect, the present disclosure provides a method in a data consumer device operated by a data consumer and configured to satisfy one or more restrictions imposed by a data owner before being allowed to decrypt encrypted content. The method comprises a first downloading step, a sending step, a performing step, a second downloading step, and a using step. In the first downloading step, the data consumer device downloads, from a content server, encrypted content, wherein the encrypted content is owned by a data owner. In the sending step, the data consumer device sends, to a key server, a request for access to key data specific to the content. In the performing step, the data consumer device performs, with the key server, an authentication check to ensure the one or more restrictions are satisfied, wherein the one or more restrictions have been set by the data owner. In the second downloading step, the data consumer device downloads, from the key server, the key data once the one or more restrictions are satisfied. In the using step, the data consumer device uses the key data to decrypt the encrypted content. An advantage of this method is that the data owner can impose restriction(s) on the data consumer that need to be satisfied before the data consumer can access the data owner's content.

Additional aspects of the present disclosure will be set forth, in part, in the detailed description, figures and any claims which follow, and in part will be derived from the detailed description, or can be learned by practice of the invention. It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure.

DETAILED DESCRIPTION

The new content distribution system100described herein improves upon the existing content distribution technologies because it enables a data owner102of content104to impose one or more restrictions106which need to be satisfied by a data consumer device108before key materials130are distributed to the data consumer device108which enables a data consumer112to access the content104. For example, the one or more restrictions106may include, but not be limited to: attestation requirement(s) (e.g. seeFIG. 2), a geography location requirement, a purpose requirement, a validity period, and/or any other arbitrary requirement. The traditional content distribution technologies do not allow the data owner102to impose such restriction(s)106on the data consumer112. Instead, the traditional content distribution technologies enable the data distributor (e.g., data producer device114) or the company that distributes the content to the data consumer112to impose various restriction(s) on the data consumer112. For example, in the case of protected video, it is the data producer device114not the movie maker or the movie actor (i.e., the data owner102) that can impose restriction(s) on the data consumers112. The new content distribution system100described herein enables the movie maker or the movie actor (i.e., the data owner102) to impose restriction(s)106on the data consumers114.

The new content distribution system100is a marked improved over the traditional content distribution technologies in several ways some of which are as follows:Ability for the data owner102to dictate restriction(s)106for the distribution of key materials130to the data consumer device108. Note: the data owner102's restriction(s)106can be in addition to any restriction(s) that happen to be imposed by the data producer device114on the data consumer112.The restriction(s)106can optionally be based on attestation (for example if data consumer114/data consumer device112fulfills certain trustworthiness criteria's, like a certain geography location, being able to process key material130in a trusted environment, etc. . . . ) (note: these types of restrictions are not the type of traditional restrictions that the data producer could impose on the data consumer).As an example, the use of TEE (Trusted Execution Environment) in the data consumer device108can be one of the trustworthiness criteria's. “Trusted Execution Environment” is an environment whose data and code cannot be manipulated and accessed from outside of its trust boundaries. This “Trusted Execution Environment” also ensures that certain cryptographic operations and key materials130are handled within a trusted environment without leaking them.Another example is “trusted geo location”, which means fetching and handling geo location information in a trusted environment operated by the data consumer device108.Attesting the trustworthiness of the data consumer112before distributing key material130to the data consumer device108.Sending a notification127to the data owner device116in case of authentication failures upon the imposed restriction(s)106of the data consumer112.

Referring toFIG. 1, there is a diagram of the new content distribution system100which includes the data owner device116(used by the data owner102), the key server110, the data consumer device108(used by the data consumer112), the data producer device114, and the content server118configured in accordance with an embodiment of the present disclosure. The content distribution system100is configured to enable the data owner102of content104to impose one or more restrictions106which need to be satisfied by the data consumer device108before key materials130are distributed by the key server110to the data consumer device108which enables the data consumer112to access and utilize the content104. An exemplary step-by-step discussion on how this can be accomplished is as follows:

1. The data producer device114is configured to use at least one key and at least one initialization vector (IV)123to encrypt the content104(note: the key(s) and IV(s)123used to encrypt the content104can be randomly selected and if desired the data owner112can select the algorithm/mode used to encrypt the content104). The content104is owned by the data owner112.

2. The data producer device114is further configured to upload encrypted data124associated with the key(s) and IV(s)123to the key server110.

3. The data producer device114is further configured to upload the encrypted content104to the content server118.

4. The data owner device116(operated by the data owner102) is configured to issue an authentication token126to the key server110. The authentication token126includes the restriction(s)106for the data consumer112.

5. The data consumer device108(operated by the data consumer112) is configured to download the encrypted content104from the content server118.

6. The key server110is configured to receive a request128from the data consumer device108for access to key data130specific to the content104.

7. The key server110is further configured to perform an authentication check with the data consumer device108to ensure that the restriction(s)106are satisfied. For example, the restriction(s)106can include an attestation requirement, a geography location requirement. a purpose requirement, a validity period etc. . . . . In one example, the restriction(s)106may include an attestation requirement where the key server110has to remotely attest (confirm) a trustworthiness of an execution environment of the data consumer device108. For instance, the key server110can remotely attest that the data consumer device108has an execution environment which is in a certain geography location. Alternatively, the key server110can remotely attest that the data consumer device108has a trusted execution environment (TEE) (seeFIG. 2).

8. The key server110is configured to download key data130to the data consumer device108once the restriction(s)106are satisfied.

9. The data consumer device108is further configured to use the key data130to decrypt the encrypted content104. At this point, the data consumer112has access to utilize the content104. Note: steps 8 and 9 only occur if the key server110in step 7 confirmed that the restriction(s)106have been satisfied.

10. The key server110is configured to notify127the data owner device116when the restriction(s)106of the data consumer112are not satisfied during the authentication check in step 7. Note: step 10 only occurs if the key server110in step 7 confirmed that the restriction(s)106have not been satisfied.

11. The key server110is configured to provide a log access132to the data owner device116. The log access132indicates which data consumer(s)112were given access to the key data130and when the access to the key data130was given to those data consumer(s)112.

Note: If desired the various communications described above in steps 1-11 between the data owner device116, the key server110, the data consumer device108, the data producer device114, and the content server118can utilize transport layer security (TLS) as a secure communication protocol.

Referring toFIG. 2, there is a diagram illustrating exemplary attestation signaling that can occur between the key server110and the data consumer device108to remotely attest a TEE134of the data consumer device108before the data consumer device108is given key data130to access the data owner's content104in accordance with an embodiment of the present disclosure (seeFIG. 1's step 7). The step-by-step signaling is a follows:

1. The key server110sends an attest X (i.e., trustworthiness of data consumer device108) to the TEE134of the data consumer device108TEE134(seeFIG. 2's step202). The attest X also has a random nonce value Y (to prevent replay attacks). The key server110knows the digest value of X. Note: the digest value of X is the outcome of a one way hash operation of X.

2. The data consumer device108's TEE134concatenates value X and nonce Y to calculate a digest value as follows: DATA=DIGEST(DIGEST(X)+Y), where DATA is the outcome of one way hash operation of concatenated values of Y and digest of X (seeFIG. 2's step204).

3. The data consumer device108's TEE134electronically signs the calculated digest value by using an attestation private key, which is only available within TEE134as follows: SIGNATURE=SIGN(DATA) (seeFIG. 2's step206).

4. The data consumer device108's TEE134sends the signature, attestation certificate, digest value X and nonce Y back to the key server110(seeFIG. 2's step208). At this point, the data consumer device108has fulfilled the required restriction106(assuming this was the only restriction106) so the key server110will deliver the key data130to the data consumer device108to enable the data consumer112to access and utilize the content104(seeFIG. 1's steps 8 and 9).

Referring toFIG. 3, there is a diagram illustrating exemplary secure and trustworthy key distribution signaling that can occur between the key server110, the data owner device116, and the data consumer device108in accordance with an embodiment of the present disclosure. The exemplary secure and trustworthy key distribution signaling has the following steps:

1. The data owner device116(operated by the data owner102) is configured to issue an authentication token126to the key server110. The authentication token126includes the restriction(s)106for the data consumer112(seeFIG. 1's step 4).

2. The key server110stores the authentication token126in a database302(storage unit302).

3. The data consumer device108sends a request128for access to key data130specific to the content104to the key server110(seeFIG. 1's step 6).

4. The key server110interacts with the database302(storage unit302) to check the authentication token126with respect to the received request128.

5-6. The key server110is further configured to perform an authentication check (e.g., attest check) by interacting with the data consumer device108to ensure that the restriction(s)106are satisfied (seeFIG. 1's step 7).

7. The key server110is configured to download key data130to the data consumer device108once the restriction(s)106are satisfied (seeFIG. 1's step 8).

8. The data consumer device108is further configured to process the key data130to decrypt the encrypted content104(seeFIG. 1's step 9).

The following is a summary of the aforementioned features and some additional features of the data owner device116(used by the data owner102), the key server110, the data consumer device108(used by the data consumer112), the data producer device114, and the content server118.

Data Owner Device116(Used by the Data Owner102):

The data owner102owns the content104and may own the data producer device114.Issues secure key distribution authentication tokens126(e.g., time, key id and consumer user id constrained) for data consumers112to retrieve a specific key130from the key server110.Uploads the secure key distribution authentication tokens126to the key server110(seeFIG. 1's step 4).
Data Producer Device114(e.g., a Device which can Produce Data about the Data Owner102):Selectively encrypts content104(e.g., data104) with unique key(s) and IV(s)123(seeFIG. 1's step 1).Uploads processed content104(e.g., encrypted data104) to the content server118(seeFIG. 1's step 3).Uploads key data124associated with the key ids, IVs etc. . . . to the key server110by encrypting them with a public key of the key server110(seeFIG. 1's step 2). The key data124remains encrypted on the key server110at all times.
Data Consumer Device118(Used by the Data Consumer112):Fetches content104from the content server110(seeFIG. 1's step 5).Fetches key data130from the key server110assuming that a valid secure key distribution authentication token126is available (seeFIG. 1's step 8).Upon receiving the key data130from the key server110, the data consumer device118decrypts the particular content104which was encrypted by the data producer device114based on data owner102imposed restriction(s)106(seeFIG. 1's step 9).
Content Server118Logs requests from data consumer devices118.Receives (partly) encrypted content104from the data producer device114and stores the (partly) encrypted content104(seeFIG. 1's step 3).Deliver the (partly) encrypted content104to the data consumer device(s)118assuming that access policies (i.e., imposes restriction(s)106) are (or will be) fulfilled before the content104can be decrypted by the data consumer device9s)118(seeFIG. 1's step 5).
Key Server110Logs requests from data consumer devices118.Stores key data124submitted by the data producer device114(seeFIG. 1's step 2).Stores authentication token126submitted by data owner device116.Enforces authentication checks when receiving a request128from the data consumer device118(seeFIG. 1's steps 6 and 7).Decrypts key data, finds specific key id and provides associated key and IV data130to data consumer device118assuming that access has been granted (seeFIG. 1's step 8).

Referring toFIG. 4, there is a flowchart of a method400implemented in the data owner device116in accordance with an embodiment of the present disclosure At step402, the data owner device116issues, to the key server110, an authentication token126which includes one or more restrictions106(imposed by the data owner102) that need to be satisfied before the content104(owned by the data owner102) is able to be decrypted by a data consumer device108(seeFIG. 1's step 4). For example, the restriction(s)106can include one or more of the following: an attestation requirement, a geography location requirement, a purpose requirement, and a validity period. At step404, the data owner device116receives, from the key server110, a notification message127indicating that the one or more restrictions106of the data consumer112were not satisfied during an authentication check between the key server110and the data consumer device108(seeFIG. 1's step 10). At step406, the data owner device116receives, from the key server110, a log access132which indicates which data consumers112were given access to the key data130and when the access to the key data130was given to the data consumers112(seeFIG. 1's step 11).

Referring toFIG. 5, there is a block diagram illustrating structures of the data owner device116in accordance with an embodiment of the present disclosure. In one embodiment, the data owner device116comprises an issue module502, a first receive module504, and a second receive module506. The issue module502is configured to issue, to the key server110, an authentication token126which includes one or more restrictions106(imposed by the data owner102) that need to be satisfied before the content104(owned by the data owner102) is able to be decrypted by a data consumer device108(seeFIG. 1's step 4). For example, the restriction(s)106can include one or more of the following: an attestation requirement, a geography location requirement, a purpose requirement, and a validity period. The first receive module504is configured to receive, from the key server110, a notification message127indicating that the one or more restrictions106of the data consumer112were not satisfied during an authentication check between the key server110and the data consumer device108(seeFIG. 1's step 10). The second receive module506is configured to receive, from the key server110, a log access132which indicates which data consumers112were given access to the key data130and when the access to the key data130was given to the data consumers112(seeFIG. 1's step 11). In addition, it should be noted that the data owner device116may also include other components, modules or structures which are well-known (e.g., display, operator interface, speakers, input interface, output interface), but for clarity, only the components, modules or structures needed to describe the features of the present disclosure are described herein.

As those skilled in the art will appreciate, the above-described modules502,504, and506of the data owner device116may be implemented separately as suitable dedicated circuits. Further, the modules502,504, and506can also be implemented using any number of dedicated circuits through functional combination or separation. In some embodiments, the modules502,504, and506may be even combined in a single application specific integrated circuit (ASIC). As an alternative software-based implementation, the data owner device116may comprise a memory508, and a processor510(including but not limited to a microprocessor, a microcontroller or a Digital Signal Processor (DSP), etc.). The memory508stores machine-readable program code executable by the processor510to cause the data owner device116to perform the steps of the above-described method400.

Referring toFIG. 6, there is a flowchart of a method400implemented in the key server110in accordance with an embodiment of the present disclosure At step602, the key server110receives, from a data owner device116, an authentication token126which includes one or more restrictions106(imposed by the data owner102) that need to be satisfied before content104(owned by data owner102) is able to be decrypted by a data consumer device108(seeFIG. 1's step 4). For example, the restriction(s)106can include one or more of the following: an attestation requirement, a geography location requirement, a purpose requirement, and a validity period. At step604, the key server110receives, from the data consumer device108, a request128for access to key data130specific to the content104(seeFIG. 1's step 6). At step606, the key server110performs an authentication check with the data consumer device108to ensure the one or more restrictions106are satisfied (e.g., seeFIG. 1's step 7 andFIG. 2). At step608, the key server110downloads the key data130to the data consumer device108once the one or more restrictions106are satisfied during the authentication check (e.g., seeFIG. 1's step 8). The key data130enables the data consumer device108to decrypt the encrypted content104. At step610, the key server110sends, to the data owner device116, a notification message127when the one or more restrictions106of the data consumer12are not satisfied during the authentication check (seeFIG. 1's step 10). At step612, the key server110provide, to the data owner device116, a log access132which indicates which data consumer(s)112were given access to the key data130and when the access to the key data130was given to the data consumer(s)112(seeFIG. 1's step 11).

Referring toFIG. 7, there is a block diagram illustrating structures of the key server110in accordance with an embodiment of the present disclosure. In one embodiment, the key server110comprises a first receive module702, a second receive module704, a perform module706, a download module708, a first send module710, and a second send module712. The first receive module702is configured to receive, from a data owner device116, an authentication token126which includes one or more restrictions106(imposed by the data owner102) that need to be satisfied before content104(owned by data owner102) is able to be decrypted by a data consumer device108(seeFIG. 1's step 4). For example, the restriction(s)106can include one or more of the following: an attestation requirement, a geography location requirement, a purpose requirement, and a validity period. The second receive module704is configured to receive, from the data consumer device108, a request for access to key data130specific to the content104(seeFIG. 1's step 6). The perform module706is configured to perform an authentication check with the data consumer device108to ensure the one or more restrictions106are satisfied (e.g., seeFIG. 1's step 7 andFIG. 2). The download module708is configured to download the key data130to the data consumer device108once the one or more restrictions106are satisfied during the authentication check (e.g., seeFIG. 1's step 8). The key data130enables the data consumer device108to decrypt the encrypted content104. The first send module710is configured to send, to the data owner device116, a notification message127when the one or more restrictions106of the data consumer12are not satisfied during the authentication check (seeFIG. 1's step 10). The second send module712is configured to send, to the data owner device116, a log access132which indicates which data consumer(s)112were given access to the key data130and when the access to the key data130was given to the data consumer(s)112(seeFIG. 1's step 11). In addition, it should be noted that the key server110may also include other components, modules or structures which are well-known, but for clarity, only the components, modules or structures needed to describe the features of the present disclosure are described herein.

As those skilled in the art will appreciate, the above-described modules702,704,706,708,710, and712of the key server110may be implemented separately as suitable dedicated circuits. Further, the modules702,704,706,708,710, and712can also be implemented using any number of dedicated circuits through functional combination or separation. In some embodiments, the modules702,704,706,708,710, and712may be even combined in a single application specific integrated circuit (ASIC). As an alternative software-based implementation, the key server110may comprise a memory714, and a processor716(including but not limited to a microprocessor, a microcontroller or a Digital Signal Processor (DSP), etc.). The memory714stores machine-readable program code executable by the processor716to cause the key server110to perform the steps of the above-described method600.

Referring toFIG. 8, there is a flowchart of a method800implemented in the data consumer device108in accordance with an embodiment of the present disclosure. At step802, the data consumer device108downloads, from a content server118, encrypted content104(owned by the data owner102) (seeFIG. 1's step 5). At step804, the data consumer device108sends, to a key server110, a request128for access to key data130specific to the content104(seeFIG. 1's step 6). At step806, the data consumer device108performs, with the key server110, an authentication check to ensure one or more restrictions106imposed by the data owner102are satisfied before the data consumer device108is allowed to decrypt encrypted content104(seeFIG. 1's step 7 andFIG. 2). For example, the restriction(s)106can include one or more of the following: an attestation requirement, a geography location requirement, a purpose requirement, and a validity period. At step808, the data consumer device108downloads, from the key server110, the key data130once the one or more restrictions106are satisfied (seeFIG. 1's step 8). At step810, the data consumer device108uses the key data130to decrypt the encrypted content104(seeFIG. 1's step 9).

Referring toFIG. 9, there is a block diagram illustrating structures of the data consumer device108in accordance with an embodiment of the present disclosure. In one embodiment, the data consumer device108comprises a first download module902, a send module904, a perform module906, a second download module908, and a use module910. The first download module902is configured to download, from a content server118, encrypted content104(owned by the data owner102) (seeFIG. 1's step 5). The send module904is configured to send, to a key server110, a request128for access to key data130specific to the content104(seeFIG. 1's step 6). The perform module906is configured to perform, with the key server110, an authentication check to ensure one or more restrictions106imposed by the data owner102are satisfied before the data consumer device108is allowed to decrypt encrypted content104(seeFIG. 1's step 7 andFIG. 2). For example, the restriction(s)106can include one or more of the following: an attestation requirement, a geography location requirement, a purpose requirement, and a validity period. The second download module908is configured to download, from the key server110, the key data130once the one or more restrictions106are satisfied (seeFIG. 1's step 8). The use module910is configured to use the key data130to decrypt the encrypted content104(seeFIG. 1's step 9). In addition, it should be noted that the data consumer device108may also include other components, modules or structures which are well-known (e.g., display, operator interface, speakers, input interface, output interface), but for clarity, only the components, modules or structures needed to describe the features of the present disclosure are described herein.

As those skilled in the art will appreciate, the above-described modules902,904,906,908, and910of the data consumer device108may be implemented separately as suitable dedicated circuits. Further, the modules902,904,906,908, and910can also be implemented using any number of dedicated circuits through functional combination or separation. In some embodiments, the modules902,904,906,908, and910may be even combined in a single application specific integrated circuit (ASIC). As an alternative software-based implementation, the data consumer device108may comprise a memory912, and a processor914(including but not limited to a microprocessor, a microcontroller or a Digital Signal Processor (DSP), etc.). The memory912stores machine-readable program code executable by the processor914to cause the data consumer device108to perform the steps of the above-described method800.

In view of the foregoing, one skilled in the art will appreciate that the content distribution system100enables the data owner102of content104to set one or more restrictions106on the data consumer112where the one or more restrictions106need to be satisfied by the data consumer device108before the data consumer112has access to the content104. To accomplish this the data owner device116issues an authentication token126that indicates which data consumer112can have access to key material130after satisfying one or more imposed restriction(s)106such as date/time, geography location, attestation requirement, etc. . . . . For example, the data owner102can configured the authentication token126to require that the trustworthiness of the data consumer device108be attested and the attestation needs to be verified before the key server110is permitted to provide key material130(enables decryption of content104) to the data consumer device108. The content distribution system100has many advantages some of which are as follows (for example):In regards to data privacy, the content distribution system100offers a significant advantage to allow the data owner102to be able to impose restrictions106upon who can access his/her personal data104, when and from where.Another problem of the traditional content distribution technologies is the inability to attest remotely the trustworthiness of the data consumer device. So, as an example, in the past there was a risk that the access to the key data will be given to a data consumer device whose execution environment is not trusted. This has again a negative impact on data privacy as it may result in a privacy breach. The present disclosure (e.g., seeFIG. 2) addresses this particular problem.Ensures that key data130can only be used in a trusted environment or in specific geography location or in certain conditions, according to the restriction(s)106imposed by the data owner102.A trusted way of handling encryption keys130in a restricted way, putting network operators, Internet of Things (IoT) companies and individuals in control of their data104. For example, a company can utilize the present disclosure and be a data owner102that can enforce restriction(s)106on the use of their data104based on company policies. The company102can also by imposing restriction(s)106determine who (ie., data consumers112) can access data104(internal to company/external to company), where they can access the data104, and when they can access the data104.A secure access control to key data130for enhanced security and privacy protection, which fulfills the privacy expectations of the data owner102.A secure mechanism to distribute selectively the key data130for trustworthy data consumption by data consumer(s)112based on: time, purpose, location or other criteria imposed by the data owner102.Full auditability and improved fraud prevention with enhanced secure logging where even some parts or all of the log entries can be encrypted.The data owner device116described herein can be any type of device including (for example): mobile device (such as phone, tablet), PC (personal computer), etc. . . . .

The data consumer device108described herein can be any type of device including (for example): IoT (Internet of Things) device, mobile device (such as phone tablet), PC, cloud environment, etc. . . . .

Those skilled in the art will appreciate that the use of the term “exemplary” is used herein to mean “illustrative,” or “serving as an example,” and is not intended to imply that a particular embodiment is preferred over another or that a particular feature is essential. Likewise, the terms “first” and “second,” and similar terms, are used simply to distinguish one particular instance of an item or feature from another, and do not indicate a particular order or arrangement, unless the context clearly indicates otherwise. Further, the term “step,” as used herein, is meant to be synonymous with “operation” or “action.” Any description herein of a sequence of steps does not imply that these operations must be carried out in a particular order, or even that these operations are carried out in any order at all, unless the context or the details of the described operation clearly indicates otherwise.

Of course, the present disclosure may be carried out in other specific ways than those herein set forth without departing from the scope and essential characteristics of the invention. One or more of the specific processes discussed above may be carried out in a cellular phone or other communications transceiver comprising one or more appropriately configured processing circuits, which may in some embodiments be embodied in one or more application-specific integrated circuits (ASICs). In some embodiments, these processing circuits may comprise one or more microprocessors, microcontrollers, and/or digital signal processors programmed with appropriate software and/or firmware to carry out one or more of the operations described above, or variants thereof. In some embodiments, these processing circuits may comprise customized hardware to carry out one or more of the functions described above. The present embodiments are, therefore, to be considered in all respects as illustrative and not restrictive.

Although multiple embodiments of the present disclosure have been illustrated in the accompanying Drawings and described in the foregoing Detailed Description, it should be understood that the invention is not limited to the disclosed embodiments, but instead is also capable of numerous rearrangements, modifications and substitutions without departing from the present disclosure that as has been set forth and defined within the following claims.