Digital rights management system transfer of content and distribution
View Patent ↗The present invention relates to digital rights management (DRM) for content that may be downloaded and securely transferred from one storage to another storage. The storage may be a disk drive, or network attached storage. The storage performs cryptographic operations and provides a root of trust. The DRM system enables secure copying or transfer of content from one storage device to another storage device. In this embodiment, a trusted server that is authenticated and trusted by both storage devices brokers the transfer of content. The trusted server may be a separate entity of the DRM system or may be a component or function of an existing server of the DRM system. In another embodiment, the storage devices may transfer content in a peer-to-peer fashion. The transfer of content may be authorized and controlled based on a digital certificate associated with the content.
1. A kiosk for provisioning secure media content to a plurality of portable data storage devices, the kiosk comprising:
a first data interface configured to communicate with a portable data storage device;
a second data interface configured to communicate with a verification server; and
a processor configured to:
obtain a binding key from the portable data storage device, wherein the binding key is unique to the portable data storage device and based on a key that was concealed by the portable data storage device;
authenticate the binding key by communicating with the verification server over the second data interface;
generate an access key for accessing the media content based on the binding key and a content key associated with a first media content;
encrypt the first media content using the access key; and
provide the encrypted first media content, the content key but not the access key to the portable data storage device.
2. The kiosk of claim 1 , wherein the portable data storage device is configured to:
provide the encrypted first media content, the content key and the binding key to a playback device;
wherein the playback device is configured to recreate the access key based on the content key and the binding key and then decrypt the encrypted first media content using the recreated access key.
3. The kiosk of claim 1 , wherein the portable device comprises:
a user area for storing the encrypted first media content that is accessible by a playback device; and
a non-user area for storing cryptographic data that is not accessible by the playback device.
4. The kiosk of claim 1 , wherein the first data interface is a USB interface.
5. The kiosk of claim 1 , wherein the second data interface is a network interface.
6. The kiosk of claim 1 , wherein the access key is an ephemeral key that is not stored on the kiosk after being generated.
7. The kiosk of claim 1 , wherein the kiosk is located in a public environment.
8. The kiosk of claim 1 , further comprising a local storage for media content.
9. The kiosk of claim 8 , the kiosk further comprising a user interface for receiving a selection of the first media content from the local storage, wherein the selection causes the kiosk to provide the encrypted first media content to the portable data storage device.
10. A method for provisioning secure media content to a plurality of portable data storage devices from a kiosk, the method comprising:
obtaining a binding key from a portable data storage device connected to a first data interface, wherein the binding key is unique to the portable data storage device and based on a key that was concealed by the portable data storage device;
authenticating the binding key by communicating with a verification server over a second data interface;
generating an access key for accessing the media content based on the binding key and a content key associated with a first media content;
encrypting the first media content using the access key; and
providing the encrypted first media content, the content key but not the access key to the portable data storage device.
11. The method of claim 10 , wherein the portable data storage device is configured to:
provide the encrypted first media content, the content key and the binding key to a playback device;
wherein the playback device is configured to recreate the access key based on the content key and the binding key and then decrypt the encrypted first media content using the recreated access key.
12. The method of claim 10 , wherein the first data interface is a USB interface.
13. The method of claim 10 , wherein the second data interface is a network interface.
14. The method of claim 10 , wherein the access key is an ephemeral key that is not stored on the kiosk after being generated.
15. The method of claim 10 , wherein the binding key is an ephemeral key that is not stored on the portable data storage device after being generated.
16. The method of claim 10 , further comprising receiving a selection of the first media content from content stored on a local storage, wherein the selection causes the kiosk to provide the encrypted first media content to the portable data storage device.
17. The method of claim 10 , authorizing copying of the content based on at least one of a digital certificate or a permission specified in secure metadata of the content.
18. The method of claim 10 , further comprising encrypting a digital certificate and storing the encrypted digital certificate in a secure area of the portable storage device.
19. The method of claim 10 , wherein the kiosk is located in a public environment.