Digital rights management system and methods for provisioning content to an intelligent storage
View Patent ↗The present invention relates to digital rights management (DRM) for content that downloaded and saved to a storage device. The storage may be a disk drive, or network attached storage. In addition, the storage device performs cryptographic operations and provides a root of trust. The DRM employs a binding key, a content key, and an access key. The binding key binds the content to a specific storage and is based on a key that is concealed on the storage. The binding key is not stored on the storage device with the content. The content key is a key that has been assigned to the content. The access key is determined based on a cryptographic combination of the content key and the binding key. In one embodiment, the content is provisioned based on the access key and stored in encrypted form in the storage device.
1. A digital rights management system, said system comprising:
a storage device comprising a storage medium configured to store content and a storage device controller including a hardware cryptographic processor, wherein the hardware cryptographic processor is configured to generate and store a unique number, read defect information from the storage medium and perform cryptographic operations on the defect information to derive a defect number unique to the storage device, store the derived defect number on the storage medium, perform cryptographic operations on the unique number and the unique defect number to generate a binding key, and provide the binding key to a content download server;
a content key server configured to provide content keys to a content download server;
a content download server configured to perform cryptographic operations on at least a binding key received from a storage device and a content cryptographic key received from a content key server to generate an access key, encrypt at least a portion of a content with at least the content cryptographic key, provide the encrypted content to the storage device, provide the content key received from the content key server; and
a media player configured to receive a binding key and a content key from the storage device, perform cryptographic operations on the binding key and content key to generate a content cryptographic key and decrypt the content from the storage device based on the content cryptographic key.
2. The system of claim 1 , wherein the media player and the storage device are configured to perform mutual authentication with each other.
3. The system of claim 1 , wherein the media player is configured to generate a decryption key for accessing the content based on combining the content keys and the binding key.
4. The system of claim 1 , wherein the hardware cryptographic processor is configured to generate a set of binding keys.
5. The system of claim 1 , wherein the hardware cryptographic processor is configured to store a digital certificate for authenticating the media player.
6. The system of claim 5 , wherein the media player is configured to authenticate with the hardware cryptographic processor based on the stored digital certificate.
7. The system of claim 1 , wherein the storage device is configured as a network attached storage.
8. The system of claim 1 , wherein the hardware cryptographic processor is configured to receive a private key and a public key in a secure manufacturing environment.