Key management for content protection
View Patent ↗A method for content access control operative to enable authorized devices to access protected content and to prevent unauthorized devices from accessing protected content, the method comprising: providing a plurality of authorized devices; dividing the plurality of authorized devices into a plurality of groups, each of the plurality of authorized devices being comprised in at least one of the plurality of groups, no two devices of the plurality of authorized devices being comprised in exactly the same groups; determining whether at least one device of the plurality of authorized devices is to be prevented from having access to the protected content and, if at least one device is to be prevented, removing all groups comprising the at least one device from the plurality of groups, thus producing a set of remaining groups; and determining an authorized set comprising groups from the set of remaining groups, such that each device of the plurality of authorized devices which was not determined, in the determining whether step, to be prevented from having access is comprised in at least one group of the authorized set.
1. A smart card comprising:
a secret store operative to store a secret s;
a first output path for outputting s; and
a second output path for outputting f(s), where f is a function,
wherein said first output path is functional only during a first period, and the first output path and the second output path are different output paths.
2. The smart card according to claim 1 and wherein f=g(x), where x is an input value.
3. The smart card according to claim 1 and wherein the first period continues until the first output path has been used a predetermined number of times.
4. The smart card according to claim 1 and wherein the first output path is functional for a predefined period of time.
5. The smart card according to claim 1 and wherein the first output path is functional until a first predefined command is received by the smart card.
6. The smart card according to claim 1 and wherein the first period begins upon receipt of a second predefined command by the smart card.
7. The smart card according to claim 5 and also comprising an external communication module, and
wherein the first period begins upon receipt of a second predefined command by the smart card, and at least one of the following is received from a source external to the smart card, via the external communication module: the first predefined command; and the second predefined command.
8. The smart card according to claim 1 and wherein the smart card also comprises:
a secret derivation unit operative to derive the secret s from a supplied input.
9. The smart card according to claim 8 and wherein the secret derivation unit is operative to derive the secret s from the supplied input based, at least in part, on pseudo-random generation.
10. The smart card according to claim 8 and wherein the supplied input is supplied by a key escrow unit external to the smart card.
11. The smart card according to claim 1 and wherein the secret s is supplied by a key escrow unit external to the smart card.
12. The smart card according to claim 1 and wherein the smart card functions as a key escrow component.
13. The smart card according to claim 1 and wherein the smart card comprises a smart card.
14. The smart card according to claim 1 and wherein function f comprises a hash function.
15. A security method comprising:
storing a secret s in a secret store, the secret store being comprised in a smart card;
outputting s to a first output path, the first output path being comprised in the smart card; and
outputting function f(s) to a second output path, the second output path being comprised in the smart card,
wherein said first output path is functional only during a first period, and the first output path and the second output path are different output paths.
16. A smart card comprising:
storage means for storing secret s in a secret storage means;
first outputting means for outputting s to a first output path; and
second outputting means for outputting f(s) to a second output path,
wherein said first output means is functional only during a first period, and the first output path and the second output path are different output paths.