Patent Grant
8121287
The present invention generally relates to preventing piracy of digital content in a broadcast encryption system. More specifically, the present system relates to identifying devices involved in piracy of digital content and revoking secret keys used to pirate protected digital content.
The entertainment industry is in the midst of a digital revolution. Music, television, and movies are increasingly becoming digital, offering new advantages to the consumer in quality and flexibility. At the same time, since digital data can be perfectly and quickly copied, the digital revolution also comprises a threat. If consumers may freely copy entertainment content and offer that content on the Internet, the market for entertainment content may evaporate.
The widespread transition of data from analog format to digital format has exacerbated problems relating to unauthorized copying and redistribution of protected digital content. Flawless copies of content can be easily produced and distributed via the Internet or on physical media. This piracy is a major concern and expense for content providers; to this end, industry consortia have been formed. These groups are licensing agencies that provide content protection tools based on Content Protection for Recordable Media (CPRM) and Advanced Access Content System (AACS), respectively. CPRM is a technology developed and licensed by the 4C group, comprising IBM, Intel, Matsushita, and Toshiba, to allow consumers to make authorized copies of commercial entertainment content where the copyright holder for such content has decided to protect it from unauthorized copying. AACS is a follow-on technology for the same purpose, under development by a group comprising IBM, Intel, Matsushita, Toshiba, Sony, Microsoft, Warner Brothers, and Disney.
CPRM and AACS protected files are encrypted with a key that is specific to a media identifier on the original storage medium (such as a DVD or CD-ROM etc.) of the protected file. Consequently, simply copying the content to another storage medium does not break the protection. The essential building block for CPRM and AACS is structure called a media key block (MKB) that is distributed together with the content. The MKB is a file containing encryptions of a single media key by a large number of keys known by compliant devices.
Each individual compliant device is assigned a set of unique device keys that allow it to decrypt the MKB and obtain the media key from the MKB. The media key is then combined with the media identifier and other values to derive a title key used to decrypt the protected digital content. If a device is revoked, using its device key to decrypt MKB will get garbage instead of a valid media key. By this method, revocation is performed in a typical content protection system such as CPRM and AACS. Details of the CPRM and AACS technology are provided in the applications incorporated by reference and are also available from 4C and AACS.
The cryptographic keys required to indirectly encrypt and decrypt the content are distributed from a key generation facility to device manufacturers and burn-into devices. Maintaining the secrecy of the cryptographic keys is essential for maintaining the integrity of a secure content protection scheme. For example, the device keys assigned to each device must be kept highly confidential. The consequences of accidental or malicious disclosure of the long-lived secret keys are grave; loss of these secrets can lead total breakdown of the copy protection schemes the secrets support and to potentially huge monetary loss for the participants of the copy protection scheme.
Fundamentally, the AACS protection depends on the interaction between tree-based device keys and the media key block [reference is made to Naor et al., “Revocation and Tracing schemes for stateless receivers”, CRYPTO 2001, and to U.S. Pat. No. 7,039,803], which allows unlimited, precise cryptographic revocation of compromised devices without danger of collateral damage to innocent devices. One possible pirate attack on this system is that attackers reverse-engineer their devices, extract device keys from the devices, and build a clone device using those extracted device keys. To defend against this type of pirate attack and identify which devices are involved in building the clone device, forensic MKBs are carefully crafted. The forensic MKB is a special purpose MKB that is applied to the clone device. The outcome of applying the forensic MKB to the clone device is observed. After a sequence of applied forensic MKBs and observed outcomes, one can deduce which device keys are used in the clone device. Once the device keys are identified, they can be revoked in the newly-produced MKBs. In the art, finding which devices are involved in building the clone device is called “traitor tracing”.
Another type of pirate attack in the above content protection system is an anonymous attack, wherein an attacker or group of attackers tries to hide their secret device keys and operate anonymously. In this attack, the attackers instrument their devices and collude to build a pirate copy of the decrypted plaintext content or the decryption key itself. The attackers can then redistribute the plaintext content or the decryption key. How does one know which devices are involved in constructing the pirate copy when the pirate copy is recovered? One solution is to differently watermark and differently encrypt each movie for each authorized device so that the watermarking and encryption information uniquely identifies the compromised box. Alas, this solution is not feasible because of the excessive computing effort and transmission bandwidth required to prepare and transmit individualized movies. The distribution system is economical only if the movies can be distributed over broadcast channels; i.e., every receiver gets substantially the same data at the same time.
In the art, there is another type of traitor tracing technology that is used to identify which devices are involved in constructing the pirate copy of the content. In one particular instance of this approach, an original version of each movie file is augmented before being broadcast. Specifically, the file that is actually broadcast has had at least one critical file segment replaced by a set of segment variations. Each file segment variation is differently encrypted and also differently watermarked prior to encryption, although the entire file may be watermarked as well. All the variations in one segment are identical for viewing purposes though digitally different. A particular receiver using an assigned secret cryptographic key can decrypt only one of the variations in each segment. All legitimate receivers with valid secret keys can play the content through different segment combinations. If the receiver is compromised and is used to illegally rebroadcast either the keys or the segments themselves, it is possible to deduce which receiver or receivers have been compromised after recovering a sufficient number of pirated content or keys.
After the devices involved in the anonymous attack are identified, the device keys associated with these devices can be revoked in future content releases. To enable revocation, a structure similar to the MKB is used. For example, in AACS, the assigned secret cryptographic keys that enable traitor tracing for anonymous attack are called sequence keys, similar to device keys. The structure that can incorporate revocation information is called a sequence key block (SKB). Any compliant device can use its valid sequence key to process the SKB and obtain a key that can indirectly decrypt the content.
Although conventional traitor tracing technology has proven to be useful, it would be desirable to present additional improvements. Current content protection systems such as AACS utilize two separate systems, the media key block and the sequence key block. The media key block is tree-based and is used to thwart an attack in which a clone device is constructed from a set of pirated device keys. The clone device can be illegally used to copy copyrighted content and can be sold on the black market. The sequence key block is matrix-based, and is used to thwart an attack in which sequence keys, title keys, or an entire decrypted movie is re-distributed. Utilizing two separate systems requires additional storage on media and calculation by the media device, affecting performance of a digital content system.
Furthermore, deploying two separate systems is inefficient and time consuming. Using media key blocks to revoke traitors provides good revocation provided that traitors can be identified when clone devices are recovered. However, this type of tracing based on forensic MKBs may take an excess amount of time and the scheme can be overwhelmed. On the other hand, using sequence key blocks provides good tracing, but revocation is limited. Further, as sequence keys are revoked in the sequence key block, tracing capability is degraded.
What is therefore needed is a system, a service, a computer program product, and an associated method for performing unified broadcast encryption and traitor tracing for digital content that combines sequence key protection with a media key block, providing a more efficient and simpler approach for tracing and revoking traitors. The need for such a solution has heretofore remained unsatisfied.
The present invention satisfies this need, and presents a system, a service, a computer program product, and an associated method (collectively referred to herein as “the system” or “the present system”) for performing unified broadcast encryption and traitor tracing for digital content.
The present system seamlessly combines a unified broadcast encryption system and a traitor tracing system to provide both good tracing and perfect revocation capability. The present system uses one set of keys (device keys) from a broadcast encryption system. The present system further employs additional media keys in a unified media key block (MKBu) instead of a single media key as is used in current broadcast encryption schemes. Those additional media keys replace the sequence keys typically used in a traitor tracing system. The content is prepared in a manner similar to a traitor tracing system, with additional variations of some chosen segments in the content. Processing this new unified media key block can directly obtain different valid media keys for different devices, ultimately enabling devices to play back the content through different variations in the content. In the conventional AACS system, devices have to process both the MKB and the SKB to obtain a media key variant; the device uses the media key variant to process a segment of the content that has more than one variation.
Furthermore, the present system uses one or more variant key tables. Each entry in the variant key table contains a title key encrypted by a valid media key variant for a segment of the content. One title key encrypts a segment that does not have variations. Additional title keys encrypt a segment that has variations. During play back, a device first reads and processes the unified media key block on a medium to obtain a valid media key variant. The device uses the media key variant to look up the variant key table, decrypt from the variant key table a title key, and locate a variant number for each segment. The device uses the variant number to identify which of the variations in the segment may be decrypted by the title key and uses the title key to decrypt the variation for the segment.
When probing a clone device in order to trace which device keys are in the clone, the present system enables anonymous attack traceability of similar quality as that of a sequence key system. In a conventional system, the forensic MKB probing can only determine whether or not the clone plays back the content. In the present system, forensic unified MKB probing can also determine which variations the clone plays. The present system enables gaining more information from each probe than possible with conventional systems.
The present system distributes additional media keys among the devices. For example, in a tree-based system, each node corresponds to a subtree rooted at this node. Each subtree is associated with a key (called subtree key). The present system divides a tree into S subtrees, divides the digital content into a plurality of segments, and converts at least some of the segments into a plurality of variations such that the number of different versions of the content created is equivalent to a quantity q. If an absolute value of S is not greater than q/2, the present system subdivides each of the subtrees into a plurality of subdivided subtrees of a quantity q/|S|. The present system assigns a separate media key variant to each of the subdivided subtrees. The present system generates a unified media key block by encrypting each media key variant with the subtree key associated with the subtree that is assigned that media key variant.
The present system traces a traitor by iteratively identifying a variation used by the traitor to circumvent the encrypted digital content and by identifying the subtree corresponding to that variation. When a subtree is identified, in next iteration the present system subdivides the identified subtree and re-distributes additional media key variants among the subdivided subtrees. This subdivision is repeated, based on the identified results of the previous step in the iteration. The iteration ends when a subdivided subtree is a leaf of the tree; at that time the traitor is identified and can be revoked in newly released content.
The present system may be embodied in a utility program such as a unified broadcast encryption utility program. The present system provides a method for the user to provide content for encryption and then invoke the unified broadcast encryption utility to divide the content into segments, with some of the segments replaced by a number of possible variants, and then encrypt the segments using a unified media key block and variant key table. The unified broadcast encryption utility provides the unified media key block and the variant key table for use by authorized media players in decrypting the encrypted content. The present system further provides a method for the user to provide a clone or recovered pirated encrypted content to the unified broadcast encryption utility. The unified broadcast encryption utility traces the traitor by identifying a variation and a subtree of the unified media key block used in the clone or used to generate the pirated movie. The unified broadcast encryption utility then revokes the subtree in any future unified media key blocks, preventing future piracy by the traced traitor.
The various features of the present invention and the manner of attaining them will be described in greater detail with reference to the following description, claims, and drawings, wherein reference numerals are reused, where appropriate, to indicate a correspondence between the referenced items, and wherein:
The following definitions and explanations provide background information pertaining to the technical field of the present invention, and are intended to facilitate the understanding of the present invention without limiting its scope:
Media Key Variant (Kmv): Any of several valid media keys obtained by processing the unified media key block. In contrast, conventional processing of a conventional media key block obtains one media key.
Unified Media Key Block (MKBu): A structure comprising different media key variants encrypted by different device keys. Compliant devices obtain different valid media key variants after processing the MKBu.
Variant Key Table: A table that allows a device with a media key variant to calculate a list of title keys. Rows of the table are indexed by Kmv. Columns of the table comprise the segments for the content. Each entry ij in the table contains the title key encrypted by Kmvi for segment j.
Title Key (Kt): The key used to encrypt and decrypt the content. In the present system, the content is divided into multiple segments. Some of the segments are chosen to have multiple variations and each variation is encrypted by different title key.
The media player module 30 comprises a device key 35 that is uniquely associated with a media player 40. The media player module 30 further comprises a software programming code or a computer program product that is typically embedded within, or installed on the media player 40.
The media module 25 comprises a unified media key block 45 (interchangeably reference herein as MKBu 45) and a variant key table 50. The unified media key block 45 comprises a subset of available device keys and a data part in which each of the subset of device keys individually encrypts a set of media key variants. For example, the subset of device keys may be organized in a tree structure, such as in the subset-difference broadcast encryption scheme referenced previously, although all broadcast encryption schemes are within the scope of this invention. The media module 25 comprises a software programming code or a computer program product that is saved onto a medium 55.
The unified media key block module 15 generates one or more unified media key blocks for use by a content provider 60 to place on the medium 55 together with an encrypted digital content 65 (interchangeably referenced herein as encrypted content 65). The unified media key block module 15 comprises a software programming code or a computer program product that is typically embedded within, or installed on a server 70 that belongs to a separate facility, for example, a license agency 75. Alternatively, system 10 can be saved on a suitable memory or storage medium such as a diskette, a CD, a DVD, a hard drive, or like devices.
The traitor detection module 20 identifies the device keys that have been compromised by a traitor or have been pirated. The traitor detection module 20 passes the identified device keys to the unified media key block module 15 to revoke those identified device keys from any future unified media key blocks, preventing further piracy by that traitor or attacker. The traitor detection module 20 comprises a software programming code or computer program product that is shown, for illustration purposes only, as embedded within, or installed on server 70 of the license agency 75. Alternatively, the traitor detection module 20 may be installed in a separate facility other than the one that issues unified media key blocks to content providers.
The media player 40 can access a server 80 of the content provider 60 through a network 85 to obtain the encrypted digital content 65 and a title key 90. The title key 90 (interchangeably referenced herein as Kt 90) allows the media player 40 to decrypt and play the encrypted content 65 after the encrypted content 65 has been recorded to a medium 55. The title key 90 is encrypted, and requires the media player 40 to correctly process the unified media key block 45 to decrypt and use the unified media key block 45. The content provider 60 may record the encrypted content 65 and the encrypted title key 90 directly to the medium 55 such as, for example, a CD or DVD. A user may then obtain the encrypted content 65 by, for example, purchasing the CD.
The media player 40 comprises software that allows the media player 40 to interface securely with the content provider 60. The media player 40 comprises any compliant module that can verify the physical presence of a medium 55 such as, for example, a disk. A compliant module is one that follows the usage rules of the media module 25 that are cryptographically bound to medium 55. For example, a compliant recorder does not record content encoded “do not copy”.
System 10 can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment containing both hardware and software elements. In one embodiment, system 10 is implemented in software, which includes but is not limited to firmware, resident software, microcode, etc.
Furthermore, system 10 can take the form of a computer program product accessible from a computer-usable or computer-readable medium providing program code for use by or in connection with a computer or any instruction execution system. The computer program product comprises the instructions that implement a method of system 10. For the purposes of this description, a computer-usable or computer readable medium can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.
The medium can be an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or apparatus or device) or a propagation medium. Examples of a computer-readable medium include a semiconductor or solid-state memory, magnetic tape, a removable computer diskette, a random access memory (RAM), a read-only memory (ROM), a rigid magnetic disk, and an optical disk. Current examples of optical disks include compact disk-read only memory (CD-ROM), compact disk-read/write (CD-R/W) and DVD.
Input/output or I/O devices (including but not limited to keyboards, displays, pointing devices, etc.) can be coupled to the system either directly or through intervening I/O controllers.
Network adapters may also be coupled to the system to enable the data processing system to become coupled to other data processing systems or remote printers or storage devices through intervening private or public networks. Modems, cable modem, and Ethernet cards are just a few of the currently available types of network adapters.
Each file segment variation is a copy of the particular corresponding critical file segment that has been differently watermarked and differently encrypted using a variation encrypting key (called title key for the variation). Each file segment variation is identified by a text designation in this application (e.g. A, B, C . . . etc.) for clarity, but in practice binary numbers are generally employed for this purpose. Furthermore, while four variations are shown for each critical file segment, in operation any number of variations may replace a critical file segment. In one embodiment, approximately 12 to 16 variations are used per critical file segment, with approximately 250 to 1000 variations per augmented file 200.
The number of critical file segments and the number of file segment variations employed depends on the properties of the file and its audience. For movies, one may select a single critical file segment and have several hundred file segment variations; however, attackers may simply choose to omit that single critical file segment in a pirated copy of the file, in hopes that viewers may not find such a glitch to be overly annoying. A pirated movie with, for example, 15 missing critical 5-second scenes is most likely too annoying to any viewer for it to be of any commercial value. Thus, the illegally broadcast movies are either substantially disrupted or the attackers must incorporate some of their file segment variations, which facilitates unified traitor tracing.
Each intended receiver of the broadcast requires variation selection information to choose a particular combination of file segment variations for each file. In terms of a movie rental box scenario, each movie rental box knows, for each movie, which set of variations to plug into the spaces where critical scenes existed in the original movie. The particular arrangement of unmodified file content and file segment variations within the augmented file 200 shown is not critical but is merely intuitive.
The variations facilitate unified traitor tracing in a commercially viable (i.e. low bandwidth overhead) manner. If a pirated version of a file is found, say on the Internet, the identity of the particular movie rental box (or boxes) that was used to create the pirated version is of keen interest to the broadcaster and/or content creator (e.g. copyright owners). The broadcaster and/or content creator may institute legal proceedings against the culprit, and would certainly want to refuse to send new decryption keys to the compromised boxes to prevent future thievery. If different boxes are assigned different combinations of file segment variations to use, an analysis of a pirated file can help determine which boxes were used as part of an anonymous attack.
In the event that all of the file segment variations in a redistributed version of a file match the combination of file segment variations assigned to only a single movie rental box, conventional systems normally identify that box as being the source of the redistributed file. However, attackers are becoming increasingly sophisticated and may choose to employ a number of boxes to produce a pirated version of a file via collusion, wherein each box contributes some information or content used to produce the illicit copy after enough such information or content has been accumulated.
In conventional broadcast encryption technologies, a media key block resides on a physical piece of media such as a DVD. The media player uses a device key uniquely associated with the media player to decrypt the media key block and obtain a media key, Km, and a title key, Kt. In the example of AACS that deploys both a media key block system and a sequence key block (SKB) systems, the media key is used as input for processing a sequence key block to obtain a media key variant, Kmv. The title key is used to decrypt segments in the augmented file 200. The media key variant is used to obtain the title key for each segment.
In contrast, system 10 utilizes the variant key table 50 in which a different title key may be used for each variation in a segment in the augmented file 200. Rather than having a separate sequence key block, system 10 merges indirection concepts used by the sequence key block and the title key into the variant key table.
Entries in the variant key table 50 comprise two values, an encrypted title key and a variant number. These values are denoted as “(Ktx)e(Kmi),x” in
The media player module 30 accesses a row in the variant key table 50 based on the media key variant of the media player module 30. For example, if the media player module 30 has media key variant i, the media player module 30 uses row i, 340, in the variant key table 50. From entries in the accessed row, the media player 40 is able to decrypt title keys for each segment in the encrypted digital content 65 and to identify which variation to use in those segments that have more than one variation. The media player 40 obtains the necessary media key variant number from the unified media key block 15 by, for example, a special field. Alternatively, low-order bits of the media key variant can be used to identify the media key variant number. This approach slightly reduces the strength of the key, but allows compatibility with conventional (non-unified) media key blocks.
If a single value is encrypted by many different keys, as is being done especially in the column 1, 305, of the example variant key table 50, system 10 is susceptible to an attack called the Birthday Paradox Attack. It is a simple matter to avoid this attack by, for example, XORing the title key with the row number before encrypting it with the media key variant. This normal practice is not shown in
The media player module 30 uses the media key variant to find an entry in the variant key table 50 (step 410). The media player module 30 uses the media key variant to decrypt one title key for each segment (step 415). The media player module 30 determines whether a segment has variations (decision step 420). If no, the media player module 30 uses the decrypted title key(s) to decrypt and play segment(s) of the encrypted content 65 (step 425). For a segment with variations, the media player module 30 locates variant numbers corresponding to the variations from the variant key table 50 (step 430). The media player module 30 uses the decrypted title keys to decrypt and play segment(s) and variation(s) of the segments of the encrypted content 65 (step 435).
An attacker wishes to circumvent the system and access the encrypted content 65 without authorization. To circumvent the system, the attacker may distribute a clone with pirated device keys that can play back the encrypted content as if the clone were a legal device. The attacker may also distribute media key variants or title keys to the encrypted content or distribute the encrypted content in an unencrypted format. System 10 enables identification of a media player or set of media players used by the attacker to perpetrate any of these attacks. Having identified the media player or set of media players, system 10 revokes the media player or set of media players, preventing those media players from playing any encrypted content released after revocation of the media player or set of media players. System 10 exhibits good revocation capability and good tracing capability that is sustainable as media players are identified and revoked.
The unified media key block module 15 determines (decision step 520) whether:
If yes, the method exits with an error (step 525). (In the error case, some convention method for tracing media key blocks may be attempted.) If no, the unified media key block module 15 subdivides each subtree into q/|S| subdivided subtrees (step 530). The unified media key block module 15 assigns a separate media key variant to each subdivided subtree (step 535). The unified media key block 15 generates a unified media key block by repeatedly encrypting the media key variants with subtree keys (step 540).
An attacker has generated a clone device or pirated the encrypted content 65. The traitor detection module 20 tests the clone device or recovers the pirated encrypted content (step 545). The traitor detection module 20 identifies a variation qi and subtree Si used in the clone or the recovered pirated encrypted content (step 550). The traitor detection module 20 determines whether the identified Si is a leaf in the unified media key block (decision step 555). If yes, the traitor detection module 20 revokes Si in any future unified media key blocks and removes Si from S (step 560). System 10 returns to decision step 520 to generate any additional unified media key blocks.
If, at decision step 555, the identified Si is not a leaf in the unified media key block, the traitor detection module 20 adds Si into S (step 565). The traitor detection module 20 finds Si′ in S of which Si is a subtree (step 570). The traitor detection module 20 subtracts Si from Si′ (step 575) and returns to decision step 520 to generate any additional unified media key blocks.
In step 565, the traitor detection module 20 adds subtree Si into the set of currently active subtrees (the “frontier”), S. Si must also be a proper subtree of one of the other subtrees in S; the traitor detection module 20 ensures the subtree Si is not double-counted. Thus in step 570 the traitor detection module 20 identifies the other subtree, called Si′. Then in step 575, the traitor detection module 20 subtracts Si from Si′, and replaces the resulting subtree(s) Si′ in the frontier S. It is noted that subtracting one subtree from a larger subtree does not always yield a single subtree: it might generate two or even more subtrees. In this case, those multiple subtrees would be treated exactly as if they were a single subtree in future steps. For clarity of explanation, this detail has been omitted, and the term “subtree” in this invention should be read as “one or more subtrees being treated as a single subtree after subtree subtraction”.
System 10 initially distinguishes between, for example, only manufacturers of devices or models in an initial unified media key block. As the unified media key block is attacked, system 10 introduces additional detail in models and individual media players within the extended leaves to the unified media key block. Eventually, enough information is iteratively gained in step 550 to identify the traitor (a specific media player) on the leaves and revoke a specific media player involved in an attack. Consequently, the unified media key block of system 10 encompasses both traitor tracing and revocation.
It is to be understood that the specific embodiments of the invention that have been described are merely illustrative of certain applications of the principle of the present invention. Numerous modifications may be made to the system, method, and service for performing unified broadcast encryption and traitor tracing for digital content described herein without departing from the spirit and scope of the present invention.
| Number | Name | Date | Kind |
|---|---|---|---|
| 6886098 | Benaloh | Apr 2005 | B1 |
| 7065210 | Tsujii et al. | Jun 2006 | B1 |
| 7526086 | Kihara et al. | Apr 2009 | B2 |
| 20020133701 | Lotspiech et al. | Sep 2002 | A1 |
| 20030142826 | Asano | Jul 2003 | A1 |
| 20030198351 | Foster et al. | Oct 2003 | A1 |
| 20040109569 | Ellison et al. | Jun 2004 | A1 |
| 20060078110 | Kim et al. | Apr 2006 | A1 |
| 20060129490 | Collar et al. | Jun 2006 | A1 |
| 20060153381 | Kim et al. | Jul 2006 | A1 |
| 20060184796 | Fahrny | Aug 2006 | A1 |
| 20080152134 | Asano | Jun 2008 | A1 |
| Number | Date | Country |
|---|---|---|
| 2003273862 | Sep 2003 | JP |
| Number | Date | Country | |
|---|---|---|---|
| 20090323936 A1 | Dec 2009 | US |
| Number | Date | Country | |
|---|---|---|---|
| Parent | 11746491 | May 2007 | US |
| Child | 12133736 | US |
