Efficient routing of streams encrypted using point-to-point authentication protocol
View Patent ↗Embodiments relate to routing encrypted data from a source to a sink via a router without decrypting the data in the router. The source authenticates with the router, the result of which produces a session key and a pseudo-random number. The router authenticates with the sink using the same session key and pseudo-random number. The router passes encrypted data received from the source to the sink without decryption and re-encryption.
1. A method for routing encrypted data, comprising:
authenticating a router with a first device by an authentication protocol for performing a point-to-point authentication by communicating with the first device;
receiving, at a first port of the router, a session key and a pseudo-random number for the session from the first device;
authenticating a router with a second device by the authentication protocol by communicating from a second port of the router with the second device;
sending the same session key and pseudo-random number for the session from the second port to the second device;
receiving, at the first port, a first encrypted stream from the first device, the first encrypted stream encrypted using the session key and the pseudo-random number;
routing the first encrypted stream from the first port to the second port without encrypting or decrypting the first encrypted stream; and
sending the first encrypted stream from the second port to the second device.
2. The method of claim 1 , further comprising:
receiving, at the first port, a second encrypted stream from the first device, the second encrypted stream encrypted by using the session key and the pseudo random number;
routing the second encrypted stream from the first port to a third port of the router; and
sending the second encrypted stream from the third port to a third device.
3. The method of claim 2 , further comprising demultiplexing a multiplexed stream including the first and second encrypted streams into the first encrypted stream for routing to the second port and the second encrypted stream for routing to the third port.
4. The method of claim 1 , wherein the authentication protocol comprises high-bandwidth digital protection (HDCP) 2.2.
5. The method of claim 4 , wherein the authentication with the first device comprises:
receiving an authentication initiation message from the first device, the authentication initiation message containing a first pseudo-random value and transmitter capability parameters;
sending an acknowledgment send certificate message to the first device, the acknowledgment send certificate message containing a receiver certificate, a second pseudo-random number, and receiver capability parameters;
receiving, from the first device, a store acknowledgement that no master key is stored, the store acknowledgment containing a master key encrypted with a receiver public key;
computing a verification value based at least on the first pseudo-random value, the receiver capabilities parameters, the transmitter capabilities parameters and a derived key;
sending a verification value acknowledgement message to the first device; and
sending pairing information to the first device, the pairing information generated by encrypting the master key with an internal secret key.
6. The method of claim 1 , wherein the first encrypted stream, the session key and the pseudo-random number are transmitted over a wired communication network.
7. The method of claim 6 , wherein the communication session is performed using High-Definition Multimedia Interface (HDMI) or Mobile High-Definition Link (MHL) protocol.
8. A router for routing encrypted data, comprising:
a receiver circuit connected to a first port, the receiver circuit configured to:
authenticate with a first device via the first port by an authentication protocol for performing a point-to-point authentication,
receive a session key and pseudo-random number for the session from the first device, and
receive, a first encrypted stream from the first device at the first port, the first encrypted stream encrypted using the session key and the pseudo-random number via the first port;
a first transmitter circuit connected to a second port, the first transmitter circuit configured to:
authenticate with a second device using the authentication protocol via the second port,
send the same session key and pseudo-random number for the session to the second device via the second port, and
send the first encrypted stream to the second device via the second port; and
a link between the receiver circuit and the first transmitter circuit to route the first encrypted stream from the receiver circuit to the first transmitter circuit.
9. The router of claim 8 , further comprising a second transmitter circuit configured to:
authenticate with a third device via a third port of the router using the authentication protocol,
send the same session key and pseudo-random number for the session to the third device via the third port, and
send a second encrypted stream received from the first device via the first port to a third device via the third port.
10. The router of claim 9 , wherein the receiver circuit is further configured to demultiplex a multiplexed stream including the first and second encrypted streams into the first encrypted stream for routing to the first transmitter circuit and the second encrypted stream for routing to the second transmitter circuit.
11. The router of claim 8 , wherein the authentication protocol comprises high-bandwidth digital protection (HDCP).
12. The router of claim 11 , wherein the receiver circuit is further configured to:
receive an authentication initiation message from the first device, the authentication initiation message containing a first pseudo-random value and transmitter capability parameters,
send an acknowledgment send certificate message to the first device, the acknowledgment send certificate message containing a receiver certificate, a second pseudo-random number, and receiver capability parameters,
receive a store acknowledgement that no master key is stored from the first device, the store acknowledgment containing a master key encrypted with a receiver public key,
compute a verification value based at least on the first pseudo-random value, the receiver capabilities parameters, the transmitter capabilities parameters and a derived key,
send a verification value acknowledgement message to the first device, and
send pairing information to the first device, the pairing information generated by encrypting the master key with an internal secret key.
13. The router of claim 8 , wherein the first encrypted stream, the session key and the pseudo-random number are transmitted over a wired communication network.
14. The router of claim 8 , wherein the communication session is performed using High-Definition Multimedia Interface (HDMI) or Mobile High-Definition Link (MHL) protocol.
15. A non-transitory computer-readable storage medium storing digital representation of a router, the router comprising
a receiver circuit connected to a first port, the receiver circuit configured to:
authenticate with a first device via the first port by an authentication protocol for performing a point-to-point authentication,
receive a session key and pseudo-random number for the session from the first device, and
receive, a first encrypted stream from the first device at the first port, the first encrypted stream encrypted using the session key and the pseudo-random number via the first port;
a first transmitter circuit connected to a second port, the first transmitter circuit configured to:
authenticate with the second device using the authentication protocol,
send the same session key and pseudo-random number for the session to the second device via the second port, and
send the first encrypted stream to the second device via the second port; and
a link between the receiver circuit and the first transmitter circuit to route the first encrypted stream from the receiver circuit to the first transmitter circuit.
16. The non-transitory computer readable storage medium of claim 15 , the router further comprising a second transmitter circuit configured to:
authenticate with a third device via a third port of the router using the authentication protocol, and
send the same session key and pseudo-random number for the session to the third device via the third port, and
send a second encrypted stream received from the first device via the first port to a third device via the third port.
17. The non-transitory computer readable storage medium of claim 16 , wherein the receiver circuit is further configured to demultiplex a multiplexed stream including the first and second encrypted streams into the first encrypted stream for routing to the first transmitter circuit and the second encrypted stream for routing to the second transmitter circuit.
18. The non-transitory computer readable storage medium of claim 15 , wherein the authentication protocol comprises high-bandwidth digital protection (HDCP).
19. The non-transitory computer readable storage medium of claim 18 , wherein the receiver circuit is further configured to:
receive an authentication initiation message from the first device, the authentication initiation message containing a first pseudo-random value and transmitter capability parameters;
send an acknowledgment send certificate message to the first device, the acknowledgment send certificate message containing a receiver certificate, a second pseudo-random number, and receiver capability parameters;
receive a store acknowledgement that no master key is stored from the first device, the store acknowledgment containing a master key encrypted with a receiver public key;
compute a verification value based at least on the first pseudo-random value, the receiver capabilities parameters, the transmitter capabilities parameters and a derived key;
send a verification value acknowledgement message to the first device; and
send pairing information to the first device, the pairing information generated by encrypting the master key with an internal secret key.
20. The non-transitory computer readable storage medium of claim 15 , wherein the first encrypted stream, the session key and the pseudo-random number are transmitted over a wired communication network.