Transmission of secure information in a content distribution network
A method and apparatus for providing user key material from a server to a client is disclosed. The method comprises receiving a first message from the client in a server, the first message having a user key material request, an access token and an identifier of a transport key (TrK-ID), validating the user key material request according to the access token, generating a response having user key material responsive to the user key material request, encrypting the response according to the transport key (TrK), and transmitting a second message comprising the response from the server to the client. The client decrypts the second message according to the transport key (TrK) and validates the second message using the identifier of the transport key (TrK-ID).
1. A method of provisioning user key material from a server to a client, comprising:
(a) receiving a request for user key material that contains (i) an access token to authenticate the client and (ii) an identifier of a transport key (TrK-ID) from the client by the server;
(b) authenticating the request for the user key material based upon the access token;
(c) generating a response for the provisioning of user key material responsive to the request for the user key material;
(d) encrypting the response for the provisioning of the user key material based upon a transport key (TrK) identified by the identifier of the transport key (TrK-ID);
(e) provisioning of user key material comprising the encrypted response from the server to the client further comprising the identifier of the transport key (TrK-ID);
(f) wherein the provisioning of user key material is configured to be decrypted according to the transport key (TrK) to recover a decrypted identifier of the transport key (TrK-ID) and validated using the decrypted identifier of the transport key (TrK-ID).
2. The method of claim 1 , wherein the provisioning of user key material is further configured in a manner capable of being validated by comparing the decrypted identifier of the transport key (TrK-ID) of the provisioning of key material to the identifier of the transport key (TrK-ID) of the decrypted message.
3. A method of provisioning user key material from a server to a client, comprising:
(a) receiving a request for user key material that contains (i) an access token to authenticate the request, (ii) an identifier of a transport key (TrK-ID), and (iii) an identifier of an integrity key (InK-ID) from the client by the server;
(b) authenticating the request for the user key material based upon the access token;
(c) generating a response for the provisioning of user key material responsive to the request for the user key material;
(d) encrypting the response for the provisioning of the user key material based upon a transport key (TrK) identified by the identifier of the transport key (TrK-ID);
(e) provisioning of user key material comprising the encrypted response from the server to the client further comprising the identifier of the transport key (TrK-ID) and the identifier of the integrity key (InK-ID);
(f) wherein the provisioning of user key material is configured to be decrypted according to the transport key (TrK) to further recover a decrypted identifier of the integrity key (InK-ID) and validated using a decrypted identifier of the transport key (TrK-ID).
4. The method of claim 3 , wherein the encrypted response is signed by the integrity key or the transport key and is further validated according to the signed encrypted response.
5. An apparatus for provisioning user key material from a server to a client, comprising:
a processor;
a memory, the memory communicatively coupled to the processor and storing processor instructions comprising processor instructions for:
(a) receiving a first request for user key material that contains (i) an access token and (ii) an identifier of a transport key (TrK-ID) from the client by the server;
(b) authenticating the request for the user key material based upon the access token;
(c) generating a response for the provisioning of user key material responsive to the request for the user key material;
(d) encrypting the response for the provisioning of the user key material based upon a transport key (TrK) identified by the identifier of the transport key (TrK-ID);
(e) provisioning of user key material comprising the encrypted response from the server to the client further comprising the identifier of the transport key (TrK-ID);
(f) wherein the provisioning of user key material is configured to be decrypted according to the transport key (TrK) to recover a decrypted identifier of the transport key (TrK-ID) and validated using the decrypted identifier of the transport key (TrK-ID).
6. The apparatus of claim 5 , wherein the provisioning of user key material is further configured to be validated by comparing a decrypted identifier of the transport key (TrK-ID) of the provisioning of key material to the identifier of the transport key (TrK-ID) of the decrypted message.
7. An apparatus for provisioning user key material from a server to a client, comprising:
a processor;
a memory, the memory communicatively coupled to the processor and storing processor instructions comprising processor instructions for:
(a) receiving a request or user key material the contains (i) an access token and (ii) an identifier of a transport key (TrK-ID) from the client by the server;
(b) authenticating the request for the user key material based upon the access token;
(c) generating a response for the provisioning of user key material responsive to the request for the user key material;
(d) encrypting the response for the provisioning of the user key material based upon a transport key (TrK) identified by the identifier of the transport key (TrK-ID);
(e) provisioning of key material comprising the encrypted response from the server to the client further comprising the identifier of the transport key (TrK-ID) and an identifier of an integrity key (InK-ID);
(f) wherein the provisioning of user key material is configured to be decrypted according to the transport key (TrK) to further recover a decrypted identifier of the integrity key (InK-ID) and validated using a decrypted identifier of the transport key (TrK-ID.
8. The apparatus of claim 7 , wherein the encrypted response is signed by the transport key or the integrity key and is further validated according to the signed encrypted response.
9. A method of receiving user key material by a client from a server, comprising:
(a) providing a first request for user key material that contains (i) an access token and (ii) an identifier of a transport key (TrK-ID) by the client to the server;
(b) wherein the first request is configured in a manner such that the user key material request is validated based upon the access token;
(c) receiving a provisioning of the user key material by the client from the server comprising an encrypted response comprising the identifier of the transport key (TrK-ID) that is encrypted according to a transport key (TrK) identified by the identifier of the transport key (TrK-ID) and having user key material responsive to the user key material request;
(d) decrypting the provisioning of the user key material based upon the transport key (TrK);
(e) validating the provisioning of the user key material using the identifier of the transport key (TrK-ID).
10. The method of claim 9 further comprising wherein the identifier of the transport key (TrK-ID) forms a part of a digital certificate certified by a trusted entity, and the provisioning of the user key material is validated via the digital certificate.
11. A method of receiving user key material by a client from a server, comprising:
(a) providing a first request for user key material that contains (i) an access token and (ii) an identifier of a transport key (TrK-ID) by the client to the server;
(b) wherein the first request is configured in a manner such that the user key material request is validated based upon the access token;
(c) receiving a provisioning of the user key material by the client from the server comprising an encrypted response that is encrypted based upon a transport key (TrK) identified by the identifier of the transport key (TrK-ID) and having user key material responsive to the user key material request;
(d) decrypting the provisioning of the user key material according to the transport key (TrK);
(e) validating the provisioning of the user key material using the identifier of the transport key (TrK-ID),
(f) wherein the identifier of the transport key (TrK-ID) is used together with a digital certificate certified by a trusted entity, and the provisioning of the user key material is validated based upon the digital certificate;
(g) wherein the encrypted response further comprises the identifier of the transport key (TrK-ID).
12. An apparatus for provisioning user key material from a server to a client, comprising:
a processor;
a memory, the memory communicatively coupled to the processor and storing processor instructions comprising processor instructions for:
(a) providing a first request for user key material that contains (i) an access token and (ii) an identifier of a transport key (TrK-ID) by the client to the server;
(b) wherein the first request is configured in a manner such that the user key material request is validated based upon the access token;
(c) receiving a provisioning of the user key material by the client from the server comprising an encrypted response comprising the identifier of the transport key (TrK-ID) that is encrypted according to a transport key (TrK) identified by the identifier of the transport key (TrK-ID) and having user key material responsive to the user key material request;
(d) decrypting the provisioning of the user key material based upon the transport key (TrK);
(e) validating the provisioning of the user key material using the identifier of the transport key (TrK-ID).
13. The apparatus of claim 12 further comprising wherein the identifier of the transport key (TrK-ID) forms a part of a digital certificate certified by a trusted entity, and the provisioning of the user key material is validated via the digital certificate.
14. An apparatus for provisioning user key material from a server to a client, comprising:
a processor;
a memory, the memory communicatively coupled to the processor and storing processor instructions comprising processor instructions for:
(a) providing a first request for user key material that contains (i) an access token and (ii) an identifier of a transport key (TrK-ID) by the client to the server;
(b) wherein the first request is configured in a manner such that the user key material request is validated based upon the access token;
(c) receiving a provisioning of the user key material by the client from the server comprising an encrypted response that is encrypted based upon a transport key (TrK) identified by the identifier of the transport key (TrK-ID) and having user key material responsive to the user key material request;
(d) decrypting the provisioning of the user key material according to the transport key (TrK);
(e) validating the provisioning of the user key material using the identifier of the transport key (TrK-ID);
(f) wherein the identifier of the transport key (TrK-ID) is used together with a digital certificate certified by a trusted entity, and the provisioning of the user key material is validated based upon the digital certificate;
(g) wherein the encrypted response further comprises the identifier of the transport key (TrK-ID).