Encryption method for distribution of data
View Patent ↗A method and system for securing a data product for mass distribution. An authorization server may encrypt a portion of a data product. Further, the authorization server may assemble an authorization key that includes information indicative of an entity authorized to store the data product, and the authorization server may encrypt the authorization key. To encrypt the authorization key, the authorization server may apply a symmetric encryption algorithm based on a cryptographic key that is derived as a function of an identification code associated with the authorized entity. The encrypted portion of the data product, the encrypted authentication key, and the remainder of the data product may then be stored on the authorized entity, which may be provided to a machine authorized to access the data product. The machine is preferably programmed to derive the second decryption key, use it to decrypt the authentication key, and then use the authentication key to validate use of the data product. Advantageously, if the data product is copied to an unauthorized entity and that entity is then provided to the machine, the machine may be unable to obtain the necessary identification code and may therefore be unable to derive the cryptographic key, to decrypt the authentication key, or to validate access to the data product.
1. A method of securely communicating a data product, while allowing the data product to be used in connection with at least one authorized computing platform entity, the at least one authorized computing platform entity having an associated identification code, the method comprising:
symmetrically encrypting at least a portion of the data product using a first cryptographic key, thereby producing an encrypted portion of the data product that can be symmetrically decrypted using the first cryptographic key;
establishing an authorization key including verification information;
computing a first value as a first function of input parameters including (i) the identification code and (ii) a second value;
combining the first value with the first cryptographic key to produce a third value;
adding the third value to the authorization key;
thereafter using the first value as a second cryptographic key to symmetrically encrypt the authorization key, so as to produce an encrypted authorization key that can be decrypted using the first value;
encrypting at least the second value to produce an encrypted value that can be decrypted using a third cryptographic key; and
providing to a receiving-end at least (i) the encrypted value, (ii) the encrypted authorization key, and (iii) the encrypted portion of the data product,
whereby, if the receiving end may be able to uncover the first authorization key and the cryptographic key and may therefore be able to access the verification information and decrypt the encrypted portion of the data product.
2. The method of claim 1 , wherein the data product comprises geographical information, the authorized entity comprises a navigation system, and the identification code comprises a navigation system ID.
3. The method of claim 1 , wherein the data product comprises geographical information, the authorized entity comprises a data storage device, and the identification code comprises a storage device ID.
4. The method of claim 1 , wherein the first function comprises a hash function.
5. The method of claim 4 , wherein the input parameters further include a predetermined segment of the encrypted portion of the data product.
6. The method of claim 1 , wherein combining the first value with the first cryptographic key to produce a third value comprises computing an XOR sum of the first value and the first cryptographic key.
7. The method of claim 1 , wherein encrypting at least the second value to produce an encrypted value that can be decrypted with a third cryptographic key comprises:
combining the second value with a checksum of the authorization key; and
using a public key encryption algorithm to encrypt the second value.
8. The method of claim 1 , further comprising the following steps;
receiving at the receiving-end (i) the encrypted value, (ii) the encrypted authorization key, and (iii) the encrypted portion of the data product,
using the third cryptographic key to decrypt the encrypted value,
computing the first value as the first function of the input parameters; using the first value as the second cryptographic key to symmetrically decrypt the encrypted authorization key;
extracting the third value from the authorization key;
using the third value and the first value to generate the first cryptographic key; and
using the first cryptographic key to symmetrically decrypt the encrypted portion of the data product.
9. The method of claim 8 , further comprising, at the receiving-end, verifying the checksum of the authorization key.
10. The method of claim 8 , wherein using the third value and the first value to generate the first cryptographic key comprises computing an XOR sum of the third value and the fist value.
11. The method of claim 8 , further comprising the step of validating use of the data product by reference to the verification information.
12. A method of securing a data product against unauthorized use, while allowing the data product to be used in connection with at least one authorized computing platform entity, the at least one authorized computing platform entity having an associated identification code, the method comprising:
symmetrically encrypting at least a portion of the data product using a first cryptographic key, thereby producing an encrypted portion of the data product that can be symmetrically decrypted using the first cryptographic key;
establishing an authorization key including verification information;
computing a first value as a first function of input parameters including (i) the identification code and (ii) a second value;
combining the first value with the first cryptographic key to produce a third value;
adding the third value to the authorization key;
thereafter using the first value as a second cryptographic key to symmetrically encrypt the authorization key, so as to produce an encrypted authorization key that can be decrypted using the first value; and
encrypting at least the second value to produce an encrypted value that can be decrypted using a third cryptographic key.
13. The method of claim 12 , further comprising randomly generating the first cryptographic key.
14. The method of claim 12 , wherein the portion of the data product comprises the entire database.
15. The method of claim 12 , wherein the portion of the data product comprises information required to understand contents of the data product.
16. The method of claim 15 , wherein the information required to understand contents of the data product is selected from the group consisting of (i) database decompression information and (ii) pointers.
17. The method of claim 12 , wherein the data product comprises geographic information.
18. The method of claim 12 , wherein the data product comprises geographic information, the authorized entity comprises a navigation system, and the identification code comprises a navigation system ID.
19. The method of claim 12 , wherein the data product comprises geographic information, the authorized entity comprises a data storage device, and the identification code comprises a storage device ID.
20. The method of claim 12 , wherein the first function comprises a hash function.
21. The method of claim 12 , wherein the input parameters further include a predetermined segment of the encrypted portion of the data product.
22. The method of claim 12 , wherein combining the first value with the first cryptographic key to produce a third value comprises computing an XOR sum of the first value and the first cryptographic key.
23. The method of claim 12 , wherein encrypting at least the second value to produce an encrypted value that can be decrypted with a third cryptographic key comprises:
combining the second value with a checksum of the authorization key; and
using a public key encryption algorithm to encrypt the second value.
24. A system for securing a data product against unauthorized use, while allowing the data product to be used in connection with at least one authorized entity, the system comprising:
a processor;
a data storage medium; and
a set of machine language instructions stored in the data storage medium and executable by the processor to carry out the method steps of claim 12 .