Securely relaying content using key chains
View Patent ↗A system, apparatus, and method are directed towards generating chains of encrypted decryption keys for content in a highly distributed environment. In one embodiment, the key chain may be provided within an Entitlement Control Message (ECM). An access key that enables decryption of a current link within the chain of decryption keys may be provided to a downstream recipient using an out-of-band mechanism. Alternatively, the access key may be provided through an in-band mechanism, such as through the use of Entitlement Management Message (EMM), or the like. In one embodiment, the access key within the EMM may be further encrypted by another encryption key that may be unique to the downstream recipient.
1. An apparatus for use in securely relaying content, comprising:
a processor; and
a memory in communication with the processor and for use in storing data and machine instructions that causes the processor to perform actions, including:
receiving content, the content being selectively encrypted with a content key;
receiving with the selectively encrypted content, a key chain, the key chain comprising the content key, the content key being encrypted with a first access key;
receiving the first access key;
encrypting the first access key using a second access key;
appending the encrypted first access key to the key chain, wherein the key chain comprises the encrypted content key, and the encrypted first access key; and
providing the second access key to another apparatus, wherein the other apparatus if is a trusted system is enabled to perform actions, including:
employing the second access key to decrypt the first access key;
employing the first access key to decrypt the content key; and
employing the content key to decrypt the content.
2. The apparatus of claim 1 , wherein the key chain is provided within an ECM to the other apparatus.
3. The apparatus of claim 1 , wherein providing the second access key to the other apparatus further comprises providing the second access key within an EMM in-band with the selectively encrypted content.
4. The apparatus of claim 1 , wherein providing the second access key to the other apparatus further comprises providing the second access key out-of band from the selectively encrypted content using at least one of a network, a virtual smart card, a portable content device, over a cellular telephone.
5. The apparatus of claim 1 , wherein if the other apparatus is an untrusted system, inhibiting the other apparatus from decrypting the selectively encrypted content.
6. The apparatus of claim 1 , wherein the other apparatus is configured to encrypt the second access key with a third access key, and to append the encrypted second access key to the key chain.
7. A method of securely providing content, comprising:
receiving a key chain multiplexed with selectively encrypted content, the key chain comprising:
a content key encrypted with a first access key;
the first access key encrypted with a second access key; and
the second access key encrypted with a third access key; and
receiving the third access key;
employing the third access key to decrypt the second access key;
employing the second access key to decrypt the first access key; and
employing the first access key to decrypt the content key, the content key enabling decryption of the selectively encrypted content.
8. The method of claim 7 , wherein the key chain is received within an ECM.
9. The method of claim 7 , wherein the third access key is received in-band with the content.
10. The method of claim 7 , wherein the third access key is received out-of band to the content.
11. A modulated data signal configured to include program instructions for performing the method of claim 7 .
12. A computer-readable medium encoded with a data structure for providing secure content over a network, the data structure comprising:
a first data field comprising selectively encrypted content, the content being selectively encrypted using at least one content key, wherein the selectively encrypted content further comprises at least a portion of at least one of a video elementary stream (ES), audio ES, intra-frames (I-frames), forward predicted frames (P-frames), or bi-directional predicted frames (B-frames) being encrypted, while at least another portion of the content is unencrypted;
a second data field comprising a key chain, wherein the key chain comprises:
the at least one content key encrypted using a first access key; and
the first access key encrypted using a second access key.
13. The computer-readable medium of claim 12 , wherein the second access key is provided out-of-band from the data structure.
14. The computer-readable medium of claim 12 , wherein the key chain further comprises n access keys, n being greater than two, each of the n access keys being encrypted using an n+1 access key.
15. The computer-readable medium of claim 12 , wherein the second access key is unique to a recipient device.
16. A system of securely providing content over a network, comprising:
a first component that is operative to perform actions, including:
receiving selectively encrypted content and a key chain, the selectively encrypted content being encrypted with a content key, the key chain comprising the content key being encrypted with a first access key;
receiving the first access key;
encrypting the first access key with a second access key;
modifying the key chain by appending the encrypted first access key to the key chain;
appending the modified key chain to the selectively encrypted content; and
sending the modified key chain and selectively encrypted content over the network;
a second component that is operative to perform actions, including:
receiving the modified key chain and selectively encrypted content;
receiving the second access key;
encrypting the second access key with a distribution key;
further modifying the key chain by appending the encrypted second access key to the key chain; and
sending the selectively encrypted content and further modified key chain over the network; and
a third component that is operative to perform actions, including
receiving the selectively encrypted content and further modified key chain;
employing the distribution key to decrypt the second access key;
employing the second access key to decrypt the first access key;
employing the first access key to decrypt the content key; and
employing the content key to decrypt the content.
17. The system of claim 16 , wherein the second component is an untrusted relay component that is configured to be incapable of employing the second access key to decrypt the first access key.
18. The system of claim 16 , wherein the key chain is provided within an ECM that is multiplexed with the selectively encrypted content.
19. The system of claim 16 , wherein the key chain is provided within a variable sized ECM.
20. The system of claim 16 , the action of the second component further comprising providing the distribution key within an EMM in-band with the selectively encrypted content.
21. An apparatus for use in securely relaying content, comprising:
a transceiver configured to receive content combined with a key chain, the content being selectively encrypted with a content key, the key chain comprising:
the content key, the content key being encrypted with a first access key, and
n additional access keys, where n is an integer value greater than 1, and each n access key is encrypted with an n+1 access key and appended to a prior encrypted access key and the encrypted content key to generate the key chain;
means for receiving the last access key in the n+1 access keys;
means for encrypting the last access key using an last +1 access key;
means for appending the encrypted last access key to the key chain; and
means for providing the last +1 access key to another apparatus.
22. A system for use in securely relaying content, comprising:
a first apparatus, comprising:
a processor; and
a memory in communication with the processor and for use in storing data and machine instructions that causes the processor to perform actions, including:
receiving content, the content being selectively encrypted with a content key;
receiving with the selectively encrypted content, a key chain, the key chain comprising the content key, the content key being encrypted with a first access key;
receiving the first access key;
encrypting the first access key using a second access key;
appending the encrypted first access key to the key chain, wherein the key chain comprises the encrypted content key, and the encrypted first access key; and
providing the second access key to a second apparatus; and
the second apparatus, that is configured to perform actions if the second apparatus is a trusted system, including:
employing the second access key to decrypt the first access key;
employing the first access key to decrypt the content key; and
employing the content key to decrypt the content.