Protected return path from digital rights management dongle

A method, apparatus, and system for providing secure communication between a tamper resistant device (404) and a sink device (406) is disclosed. Encrypted content is received from a source device (402) at the tamper resistant device (404), wherein the content has been encrypted using a first key. The content is decrypted using the decrypted first key. A second key is received at the tamper resistant device (404) from the sink device (406), wherein the second key is encrypted using the public key of the tamper resistant device (404). The second key is decrypted using the private key of the tamper resistant device (404). The content is re-encrypted using the second key. The re-encrypted content is transmitted to the sink device (406).

The invention relates to securing the transmission of data, and more particularly to a method, apparatus, and system for securing the transmission of data between a tamper resistant device and a sink device.

The explosion in the use of computers and networks such as the Internet has lead to problems with respect to the protection of intellectual property rights to data and information transmitted over the Internet. These problems are a result of the ease at which digital information can be transmitted and copied. In digital form, information such as video, music, games, software, etc., can be copied with such high quality that it can be hard to distinguish between the original and copied versions of the information. As a result, information in digital form is a very tempting target for hackers.

In order to combat the illegal copying of digital information, various forms of protection have been developed. For example, when a source device sends digital multimedia content to a sink device, the content can be encrypted in some manner before the content is transmitted from the source device to the sink device so as to protect the digital content from being stolen or improperly copied. As illustrated inFIG. 1, the multimedia content106is transmitted from the source device102to the sink device104for display. The multimedia content106is first encoded by an encoder108. The encoded content is then encrypted by an encryption device110using an encryption key. The encrypted data is then transmitted to the sink device. The sink device104uses the encryption key to decrypt the encrypted content using the decryption device114. The decrypted content is then decoded by a decoder116. The decoded content is then rendered by a rendering device120and displayed on an output device122. One problem with this solution is that the sink device needs to know the encryption key before the encrypted content can be decrypted. Thus, a distributor of content would have to make sure that each legitimate customer has the encryption key. This could be a logistical problem for large distributors of content. Furthermore, an attacker would have many sources to target in an attempt to discover the encryption key.

One system that has been developed to combat this problem is the use of asymmetric keys. The source device102and the sink device104can each have asymmetric keys which comprise a public and private key. Information encrypted with a public key can only be decrypted by the private key and vice versa.

The encryption of the content on the vulnerable link between the source device102and the sink device104prevents unwanted digital copying of the content However, an attacker can still try and hack the sink device104to obtain the decryption key and thereby gain access to the content. To combat such attacks, the decryption of the content can be performed by a tamper resistant device such as a smart card or dongle which is either attached to or part of the sink device104as illustrated inFIG. 2. In this scenario, the content is encrypted using an encryption key and the encryption key itself is encrypted using the public key of the tamper resistant device. When the tamper resistant device receives the encrypted content and key, the encrypted encryption key is decrypted using the private key of the tamper resistant device. The private key is stored securely inside the tamper resistant device201, so that the attacker can not gain access to the private key. The received encrypted content is decrypted by the decryption device203using the stored decrypted encryption key. The decrypted content is sent to the decoder116and is processed as described above with reference toFIG. 1. One disadvantage of this system is that the content is sent in an unprotected format from the tamper resistant device to the sink device104. As a result, an unauthorized digital copy of the content can still be obtained by interposing a sniffer device between the sink device104and the tamper resistant device201. As a result, there is a need for a method and system for protecting the link between the sink device and the tamper resistant device.

It is an object of the invention to overcome the above-described deficiency by encrypting the content sent between the tamper resistant device and the sink device.

According to one embodiment of the invention, a method, apparatus, and system for providing secure communication between a tamper resistant device and a sink device is disclosed. Encrypted content is received from a source device at the tamper resistant device, wherein the content has been encrypted using a first key. The content is decrypted using the decrypted first key. A second key is received at the tamper resistant device from the sink device, wherein the second key is encrypted using the public key of the tamper resistant device. The second key is decrypted using the private key of the tamper resistant device. The content is re-encrypted using the second key. The re-encrypted content is transmitted to the sink device.

According to one embodiment of the invention, a source device, a tamper resistant device and a sink device are each assigned an asymmetric public-private key pair that can be used to authenticate each device to the other devices and the key pairs are also used to perform protected information exchanges between the various devices. Unlike the known systems described above, the present invention uses the public-private key pairs to encrypt the encryption keys used to encrypt the content on both the link between the source device and the tamper resistant device and the link between the tamper resistant device and the sink device. Briefly, the first encryption key which is used by the source device to encrypt the content is sent by the source device to the tamper resistant device encrypted with the public key of the tamper resistant device (the encrypted key transparently transmits through the sink device). This key is permanent and is attached to the content. The sink device does not know the key. In addition, a second encryption key which is used by the tamper resistant device to encrypt the content sent between the tamper resistant device and the sink device is itself encrypted using the public key of the tamper resistant device and is sent from the sink device to the tamper resistant device. In the alternative, a scrambling key instead of the second encryption key can be sent to the tamper resistant device from the sink device as will be described below in more detail.

The flow of data and encryption keys which was briefly described above will now be explained in more detail with reference toFIG. 3. As shown, a source device301is connected to a tamper resistant device303via a transmission link302and the tamper resistant device303is connected to a sink device305via a transmission link304. It will be under stood by those skilled in the art that the transmission links can be any kind of communication link, both wireless or wired, which is capable of transmitting digital information. The source device301has a public key1322and a private key1321. The tamper resistant device303has a public key2332and a private key2331. The sink device305has a public key3342and a private key3341. The devices use the public and private keys322,321,332,331,342,341in a known manner to authenticate themselves to one another. While the devices illustrated inFIG. 3each have a public/private key pair, it will be understood by one skilled in the art that all of the devices, e.g., the sink device, do not need a public/private key pail to practice the invention.

As will be explained in more detail below, the source device301encrypts the multimedia content using a first encryption key306and transmits the encrypted content to the tamper resistant device303via the transmission link302. In addition, the source device301encrypts the encryption key306using the public key2of the tamper resistant device303and transmits the encrypted encryption key to the tamper resistant device303via the transmission link302. Briefly, the tamper resistant device303then decrypts the encrypted encryption key306using the private key2. The tamper resistant device303then decrypts the encrypted content using the decrypted encryption key306. In the alternative, the source device301and the tamper resistant device303can exchange key material during the authentication phase of the protocol. The key material exchanged on both sides of the link is then grouped and used in a mathematical process to produce a key generator that delivers the same key on both sides of the link or the same stream of keys if the encryption key is to be updated, modified at intervals. In this scenario, the tamper resistant device would generate the key and decode the received content from the source device301.

The sink device305selects a second encryption or scrambling key307. The sink device then encrypts the second encryption or scrambling key307using the public key2of the tamper resistant device303. The encrypted second encryption or scrambling key307is then sent to the tamper resistant device303via the transmission link304. The tamper resistant device303decrypts the second encryption or scrambling key307using the private key2. The tamper resistant device303then encrypts the decrypted content from the source device301using the second encryption or scrambling key307and transmits the re-encrypted content to the sink device305via the transmission link304.

The present invention will now be described in more detail with reference toFIG. 4. As shown, multimedia content is transmitted from a source device402to a sink device406for display. The source device402comprises, among other elements, a memory device408, a bus410, an encoder412, an encryption device414, and a processor416for controlling the operation of the source device402. It will be understood that the source device may contain other elements and some of the listed elements may be combined in a single element. The stored multimedia content is first optionally encoded by the encoder412. The (encoded) content is then encrypted by the encryption device414using a first encryption key. The first encryption key is then encrypted by the encryption device414using the public key of the tamper resistant device404. The encrypted content and the encrypted first encryption key are then transmitted to the tamper resistant device404via the transmission link418. As described above with respect toFIG. 3, the source device301and the tamper resistant device303, in the alternative, can exchange key material during the authentication phase to enable each other to generate the same first encryption key. In this scenario, the source device402would generate the first encryption code and encrypt the content, wherein the content is sent to the tamper resistant device404.

The tamper resistant device404comprises, among other elements, a decryption device420, an encryption device422, a memory device424, a bus428and a processor426for controlling the operation of the tamper resistant device. The tamper resistant device first decrypts the first encryption key using its private key which is stored in memory424. Once the encryption key has been decrypted by the decryption device420, the decryption device420now uses the decrypted encryption key to decrypt the encrypted content received from the source device402. In the alternative, the tamper resistant device404could generate the first encryption key and decrypt the encrypted content.

The sink device406comprises, among other elements, a bus432, an encryption/decryption device434, a decoder436, a rendering device438, an output device440, a memory442and a processing unit444for controlling the operation of the sink device406. The sink device406selects the second encryption key which will be used to protect the content transmitted over the transmission link430between the tamper resistant device404and the sink device406. The encryption/decryption device434encrypts the second encryption key using the public key of the tamper resistant device404and transmits the encrypted encryption key to the tamper resistant device over the transmission link430.

The decryption device420decrypts the encrypted second encryption key using the private key of the tamper resistant device404. The encryption device can now encrypt the decrypted content from the source device402using the second encryption key. The re-encrypted content is then sent to the sink device406over the transmission link430.

The sink device406uses the second encryption key to decrypt the encrypted content received from the tamper resistant device404using the encryption/decryption device434. The decrypted content is then optionally decoded by the decoder436. The decoded content is then handled further, for example it is rendered by the rendering device120and displayed on the output device440.

The second encryption key may take many forms. For example, the second encryption key can be a scrambling key which is used to prime a pseudo-random number generator, for example in the encryption device422, wherein the output of the pseudo-random generator is XOR'ed with the content in the clear in the tamper resistant device. The sink device406would then have to XOR the received data with the output of it's own pseudo-random number generator, for example in the encryption/decryption device434, primed by the same second encryption key. It will be understood by one skilled in the art that any safe, stream cipher technique is also suitable for this operation and the invention is not limited thereto.

The second encryption key is ephemeral and is used only during the content transfer between the tamper resistant device404and the sink device406. The tamper resistant device404enforces an application layer protection while the cryptographic facility added to the sink device406enforces a link layer protection. The method is designed such that the cryptographic capabilities expected from the sink device406are kept to a minimum.

It will be understood that the different embodiments of the invention are not limited to the exact order of the above-described steps as the timing of some steps can be interchanged without affecting the overall operation of the invention. Furthermore, the term “comprising” does not exclude other elements or steps, the terms “a” and “an” do not exclude a plurality and a single processor or other unit may fulfill the functions of several of the units or circuits recited in the claims.