Transmission of secure information in a content distribution network

Inventor: Xin Qiu (San Diego, CA)

Assignee: ARRIS Enterprises LLC

H04L9/083 H04L9/0866 H04L9/321

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 11,979,491
App. No.: 17/984,989
Granted: May 7, 2024
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

A method and apparatus for providing user key material from a server to a client is disclosed. The method comprises receiving a first message from the client in a server, the first message having a user key material request, an access token and an identifier of a transport key (TrK-ID), validating the user key material request according to the access token, generating a response having user key material responsive to the user key material request, encrypting the response according to the transport key (TrK), and transmitting a second message comprising the response from the server to the client. The client decrypts the second message according to the transport key (TrK) and validates the second message using the identifier of the transport key (TrK-ID).

Claims (88)

1. A method of provisioning user key material from a server to a client, comprising:

(a) receiving a first request from the client by the server, the first request made for user key material that contains (i) an access token to authenticate the client and (ii) an identifier of a transport key (TrK-ID);

(b) authenticating the request for the user key material according to the access token;

(d) encrypting the response for the provisioning of the user key material according to a transport key (TrK) identified by the identifier of the transport key (TrK-ID);

(e) provisioning of key material comprising the encrypted response from the server to the client;

(f) wherein the provisioning of key material is configured to be decrypted according to the transport key (TrK) and the provisioning of key material is configured to be validated using the identifier of the transport key (TrK-ID);

(g) wherein the provisioning of key material further comprises the identifier of the transport key (TrK-ID);

(h) wherein said provisioning of key material is further configured to be decrypted according to the transport key (TrK) to recover a decrypted identifier of the transport key (TrK-ID) and said provisioning of key material is further configured to be validated using the decrypted identifier of the transport key (TrK-ID).

2. The method of claim 1 , wherein the provisioning of key material is further configured to be validated by comparing the decrypted identifier of the transport key (TrK-ID) of the provisioning of key material to the identifier of the transport key (TrK-ID) of the decrypted message.

3. A method of provisioning user key material from a server to a client, comprising:

(b) authenticating the request for the user key material according to the access token;

(d) encrypting the response for the provisioning of the user key material according to a transport key (TrK) identified by the identifier of the transport key (TrK-ID);

(e) provisioning of key material comprising the encrypted response from the server to the client;

(g) wherein the provisioning of key material further comprises the identifier of the transport key (TrK-ID);

(h) the first request further comprises an identifier of an integrity key (InK-ID);

the response further comprises the identifier of the integrity key (InK-ID);

the provisioning of key material further comprises the identifier of the integrity key (InK-ID); and

the provisioning of key material configured to be decrypted according to the transport key (TrK) to further recover a decrypted identifier of the integrity key (InK-ID) and the provisioning of key material configured to use the decrypted identifier of the integrity key (InK-ID) to validate the provisioning of key material.

4. The method of claim 3 , wherein the encrypted response is signed by the integrity key or the transport key and is further validated according to the signed encrypted response.

5. A method of provisioning user key material from a server to a client, comprising:

(a) receiving a first request from the client by the server, the first request made for user key material that contains (i) an access token and (ii) an identifier of a transport key (TrK-ID);

(b) authenticating the request for the user key material according to the access token;

(d) encrypting the response for the provisioning of the user key material according to a transport key (TrK) identified by the identifier of the transport key (TrK-ID);

(e) provisioning of key material comprising the encrypted response from the server to the client;

(g) wherein the identifier of the transport key (TrK-ID) forms a part of a digital certificate certified by a trusted entity, and the provisioning of key material is validated via the digital certificate.

6. The method of claim 5 , wherein the identifier of the transport key (TrK-ID) is stored in tamper-resistant storage of the client device.

7. An apparatus for provisioning user key material from a server to a client, comprising:

a processor;

a memory, the memory communicatively coupled to the processor and storing processor instructions comprising processor instructions for:

(a) receiving a first request from the client by the server, the first request made for user key material the contains (i) an access token and (ii) an identifier of a transport key (TrK-ID);

(b) authenticating the request for the user key material according to the access token;

(d) encrypting the response for the provisioning of the user key material according to a transport key (TrK) identified by the identifier of the transport key (TrK-ID);

(e) provisioning of key material comprising the encrypted response from the server to the client;

(g) wherein the provisioning of key material further comprises the identifier of the transport key (TrK-ID);

8. The apparatus of claim 7 , wherein the provisioning of key material is further configured to be validated by comparing a decrypted identifier of the transport key (TrK-ID) of the provisioning of key material to the identifier of the transport key (TrK-ID) of the decrypted message.

9. An apparatus for provisioning user key material from a server to a client, comprising: