Abstract:
In one aspect of the invention is a method for a multi-level, and multi-dimensional scheme of content protection. Content having one or more attributes is encrypted using separate keys for each level of protection, where each level corresponds to an assurance of protection for each attribute. The content may be distributed to a number of environments having different levels fo protection by transmitting a base key commensurate with the environment's subscription level. The base key may then be used generate lower level keys for accessing content at a level of protection less than or equal to that subscribed to.
Abstract:
Delivering a Direct Proof private key to a device installed in a client computer system in the field may be accomplished in a secure manner without requiring significant non-volatile storage in the device. A unique pseudo-random value is generated and stored in the device at manufacturing time. The pseudorandom value is used to generate a symmetric key for encrypting a data structure holding a Direct Proof private key and a private key digest associated with the device. The resulting encrypted data structure is stored on a removable storage medium (such as a CD), and distributed to the owner of the client computer system. When the device is initialized on the client computer system, the system checks if a localized encrypted data structure is present in the system. If not, the system obtains the associated encrypted data structure from the removable storage medium. The device decrypts the encrypted data structure using a symmetric key regenerated from its stored pseudo-random value to obtain the Direct Proof private key. If the private key is valid, it may be used for subsequent authentication processing by the device in the client computer system.
Abstract:
Delivering a Direct Proof private key to a device installed in a client computer system in the field may be accomplished in a secure manner without requiring significant non-volatile storage in the device. A unique pseudo-random value is generated and stored in the device at manufacturing time. The pseudorandom value is used to generate a symmetric key for encrypting a data structure holding a Direct Proof private key and a private key digest associated with the device. The resulting encrypted data structure is stored on a protected on-liner server accessible by the client computer system. When the device is initialized on the client computer system, the system checks if a localized encrypted data structure is present in the system. If not, the system obtains the associated encrypted data structure from the protected on-line server using a secure protocol. The device decrypts the encrypted data structure using a symmetric key regenerated from its stored pseudo-random value to obtain the Direct Proof private key. If the private key is valid, it may be used for subsequent authentication processing by the device in the client computer system.
Abstract:
In some embodiments, a method and apparatus for proving the denial of a direct proof signature are described. In one embodiment, a trusted hardware device convinces a verifier that the trusted hardware device possesses cryptographic information without revealing unique, device identification information of the trusted hardware device or the cryptographic information. Once the verifier is convinced that the hardware device possesses the cryptographic information, the verifier may issue a denial of signature request to the trusted hardware device, including at least one compromised direct proof signature. In response, the trusted hardware device issues a denial of the compromised direct proof signature by proving to the verifier that a cryptographic key held by the trusted hardware device was not used to form the at least one compromised direct proof signature. Other embodiments are described and claims.
Abstract:
Verfahren, das umfaßt: Erzeugen einer verschlüsselten Datenstruktur (514), die einer Vorrichtung (506) zugeordnet ist, wobei die verschlüsselte Datenstruktur (514) einen Privatschlüssel (516) und einen Privatschlüssel-Digest (518) umfaßt; Erzeugen eines Kennzeichners anhand eines pseudozufällig erzeugten Werts (508) für die verschlüsselte Datenstruktur (514); Speichern des Kennzeichners und der verschlüsselten Datenstruktur (514) auf einem entnehmbaren Speichermedium (522) zur Verteilung mit einem System (504), das die Vorrichtung (506) umfasst, wobei das entnehmbare Speichermedium (522) eine Vielzahl von Kennzeichnern und verschlüsselten Datenstrukturen (514) für Vorrichtungen aus einer Klasse von Vorrichtungen umfasst, die die Vorrichtung (506) umfasst; und Speichern des pseudozufälligen Werts (508) in einem nichtflüchtigen Speicher in der Vorrichtung (506), wobei der pseudozufällige Wert (508) zum Erzeugen des Kennzeichners im System (504) verwendet wird, um die verschlüsselte Daten (522) zu extrahieren.
Abstract:
Delivering a Direct Proof private key in a signed group of keys to a device installed in a client computer system in the field may he accomplished in a secure manner without requiring significant non-volatile storage in the device. A unique pseudo-random value is generated and stored along with a group number in the device at manufacturing time. The pseudo-random value is used to generate a symmetric key for encrypting a data structure holding a Direct Proof private key and a private key digest associated with the device. The resulting encrypted data structure is stored in a signed group of keys (e.g., a signed group record) on a removable storage medium (such as a CD or DVD), and distributed to the owner of the client computer system. When the device is initialized on the client computer system, the system checks if a localized encrypted data structure is present in the system. If not, the system obtains the associated signed group record of encrypted data structures from the removable storage medium, and verifies the signed group record. The device decrypts the encrypted data structure using a symmetric key regenerated from its stored pseudo-random value to obtain the Direct Proof private key, when the group record is valid. If the private key is valid, it may be used for subsequent authentication processing by the device in the client computer system.
Abstract:
Delivering a Direct Proof private key to a device installed in a client computer system in the field may be accomplished in a secure manner without requiring significant non-volatile storage in the device. A unique pseudo-random value is generated and stored in the device at manufacturing time. The pseudo-random value is used to generate a symmetric key for encrypting a data structure holding a Direct Proof private key and a private key digest associated with the device. The resulting encrypted data structure is stored on a protected on-line server accessible by the client computer system.
Abstract:
In one aspect of the invention is a method for a multi-level, and multi-dimensional scheme of content protection. Content having one or more attributes is encrypted using separate keys for each level of protection, where each level corresponds to an assurance of protection for each attribute. The content may be distributed to a number of environments having different levels of protection by transmitting a base key commensurate with the environment's subscription level. The base key may then be used generate lower level keys for accessing content at a level of protection less than or equal to that subscribed to.