CN101727941A - Method and system for hiding decryption key in distributed way - Google Patents
Method and system for hiding decryption key in distributed way Download PDFInfo
- Publication number
- CN101727941A CN101727941A CN200810149985A CN200810149985A CN101727941A CN 101727941 A CN101727941 A CN 101727941A CN 200810149985 A CN200810149985 A CN 200810149985A CN 200810149985 A CN200810149985 A CN 200810149985A CN 101727941 A CN101727941 A CN 101727941A
- Authority
- CN
- China
- Prior art keywords
- key
- digital content
- deciphering
- deciphering key
- electronic installation
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Landscapes
- Storage Device Security (AREA)
Abstract
The invention discloses a method for hiding a decryption key in distributed way, which is implemented by disassembling the decryption key applied for accessing digital content into at least two parts of decryption key, the first part of decryption key and the second part of decryption key; storing the first part of decryption key in a storage device, and storing the second part of decryption key in a hiding zone in the storage device; when the storage device is installed into an electronic device, starting the application program of the electronic device; utilizing the application program to obtain the first part of decryption key from the storage device and the second part of decryption key from the hiding zone in the storage device; and utilizing the application program to restructure and encode the first part of decryption key and the second part of decryption key to restore the decryption key, and utilizing the application program and the decryption key to decode the digital content to facilitate the electronic device to access the digital content.
Description
Technical field
The invention relates to a kind of data encryption and decryption method, and be particularly to a kind of method and system of hiding decryption key in distributed way.
Background technology
The method of digital content delivery roughly has two kinds, comprises online transmission (On-line Delivery) and off-line transmission (Off-line Delivery).Online transmission is meant that as calculated machine or telephone network give the consumer with digital content delivery.The off-line transmission is meant pre-records digital content in the specific storage medium earlier, for example, CD, digital video video disc (Digital Video Disk, DVD) or flash memory device (for example, storage card or universal serial bus (Universal Serial Bus, USB) carry-on dish).
Fig. 1 shows the data encryption of conventional digital managing entitlement and the method step process flow diagram of deciphering.
As will be in above-mentioned Storage Media digital content stored implement Digital Right Management, at first will be, and judge whether the deciphering of hiding key (step S101) is arranged in Storage Media to encrypt digital content.If in Storage Media, hide the deciphering key, then via network (for example, the Internet) from remote server download decryption key (step S102).If hide the deciphering key in Storage Media, then electronic installation (for example, personal computer or mobile phone) is obtained this deciphering key with combine digital contents decryption (step S103), and when deciphering access digital content (step S104) when finishing.
Owing to be the digital content delivery of off-line, its deciphering key generally is to be hidden among this Storage Media.When the consumer will read these digital contents, must just be used by the mode of legal authorization then and be used digital content earlier to decipher key with decrypted digital content.Because the deciphering key is hidden among the medium, how to protect this deciphering key not obtained by illegal detection, just become the important topic of digital content protection.It is representative with the CPRM (Content Protection forRecordable Media) of DVD and storage card that the typical case in past adopts method, its deciphering key is 64 a key piece (key block), wherein this key piece comprises Storage Media information, for example, product type, manufacturer ... etc. data.The key piece is hidden in the hidden area (hidden area) in the Storage Media, and ordinary consumer can't read.Reading of key must be undertaken by the electronic player tool, and with this key piece digital content is decrypted, and digital content could be play use in the scope that is authorized to.In addition, the manufacturer of electronic player tool then must add industry association, for example, the security disk alliance of storage card (Secured Disk Association, SDA), to obtain the authorization and to can read the key piece of hidden area.
Yet the protected mode of this kind deciphering key has several major defects.
This kind protection system needs to form association jointly by digital content distribution manufacturer and electronic player tool manufacturer; and the industry of formulation agreement; and each participates in the member and must strictly observe under the prerequisite of industry agreement, and deciphering key and digital content just can be subjected to complete preservation.But it is difficult that the industry agreement under this kind system forms, and similarly is that (several years consuming time is just won the victory by Blue Ray for High Definition, HD) DVD battle for blue light of new generation (Blue Ray) DVD specification and high resolving power.Because this protection mechanism also involves the huge interests of whole industry, its protection mechanism is subjected to hacker collective easily and attacks.When specification competition Pu won, its double protection mechanism was cracked by the hacker also immediately as Blue Ray.
The interests of digital content distribution manufacturer and electronic player tool manufacturer are also inconsistent, cause protection mechanism infeasible.From the angle of electronic player tool manufacturer, its product can be play multiple more digital content product, and market is big more, and interests are also maximum, and no matter its for the legal authorization product whether.The maximum benefit of digital content manufacturer then is to stop counterfeit merchandise and anti-system is plagiarized.Therefore, though design the restriction that the distribution district is arranged in the DVD deciphering key originally,, cause whole DVD digital content partition protecting mechanism thus collapse because part DVD player manufacturer is reluctant to act on for individual interests.
The deciphering key is hidden in single hidden area, obtains the deciphering key though ordinary consumer can't enter this hidden area, for the personage of known this inductrial technology flow process or the personage of understanding industry protocol specification, is not to be perfectly safe.In case after being invaded, complete deciphering key data can be removed, thereby and crack the protection system of encrypt digital content.
Therefore, the invention provides a kind of method and system of hiding decryption key in distributed way.
Summary of the invention
Based on above-mentioned purpose, the embodiment of the invention has disclosed a kind of method of hiding decryption key in distributed way.Correspondence disassembled at least two in order to the deciphering key of the digital content of access part is deciphered key, it comprises that first's deciphering key deciphers key with second portion.This first's deciphering key is stored in the storage arrangement, and this second portion deciphering key is stored in the hidden area of this storage arrangement.When this storage arrangement is mounted in the electronic installation, start the application program of this electronic installation.Utilize this application program from this storage arrangement obtain this first deciphering key and certainly this hidden area of this storage arrangement obtain this second portion deciphering key.Utilize this application program that this first and second part deciphering key is recombinated and encoded reducing this decoding key, and utilize this application program and utilize this deciphering key to decipher this digital content, but make this this digital content of electronic installation access.
The embodiment of the invention has also disclosed a kind of system of hiding decryption key in distributed way, comprises storage arrangement and electronic installation.This storage arrangement stores first's deciphering key of the deciphering key of corresponding digital content in order to access, and provides in order to store the hidden area to second portion deciphering key that should the decryption key spoon.It is equipped with application program this electronic installation.When this storage arrangement is installed in the electronic installation, this application program be activated with this storage arrangement certainly obtain first and certainly this hidden area of this storage arrangement obtain this second portion deciphering key, reorganize with this first and second part of coding and decipher key to reduce this deciphering key, and utilize this deciphering key to decipher this digital content, but make this this digital content of electronic installation access.
Description of drawings
Fig. 1 shows the data encryption of conventional digital managing entitlement and the method step process flow diagram of deciphering.
Fig. 2 is the method step process flow diagram that shows the hiding decryption key in distributed way of the embodiment of the invention.
Fig. 3 is the system architecture synoptic diagram that shows the hiding decryption key in distributed way of the embodiment of the invention.
[main element label declaration]
300～storage arrangement
350～hidden area
400～electronic installation
450～application program
500～server
S101..S104～process step
S201..S213～process step
Embodiment
For allow purpose of the present invention, feature, and advantage can become apparent, preferred embodiment cited below particularly, and cooperate appended graphic Fig. 2 to Fig. 3 is described in detail.Instructions of the present invention provides different embodiment that the technical characterictic of the different embodiments of the present invention is described.Wherein, the usefulness that is configured to explanation of each element among the embodiment is not in order to restriction the present invention.And the part of reference numerals repeats among the embodiment, is for the purpose of simplifying the description, is not the relevance that means between the different embodiment.
The embodiment of the invention has disclosed a kind of method and system of hiding decryption key in distributed way.
The method of the hiding decryption key in distributed way of the embodiment of the invention will be deciphered key and be disassembled and be plural data division, and be protected in identical or different mode, and wherein data division is to be stored in the Storage Media, even in another Storage Media.When coming the content of access encryption according to the scope of authority, make up and form complete deciphering key again digital content is decrypted according to ad hoc fashion.
Fig. 2 is the method step process flow diagram that shows the hiding decryption key in distributed way of the embodiment of the invention.
At first, with digital content (for example by first file layout, .mp3) convert digital rights management (the Digital Rights Management of electronic player to, DRM) engine (for example can be accepted second file layout, open mobile communication alliance (Open Mobile Alliance, OMA) .dm of version 1.0) (step S201).Utilize encipheror (for example, advanced encoder system (Advanced Encryption System is designated hereinafter simply as AES)) and encryption key pair to encrypt the digital content of second file layout (for example key A, it is one 128//192/256 a word string).Then, (for example, digital content .dm) is converted to the digital content (for example .aes) (step S202) of the 3rd file layout with second file layout.Because being symmetrical expression, encrypts AES, so encryption key pair also is the deciphering key.
Utilize logical operation (for example, also exclusive disjunction (XOR is expressed as
)) should decipher key and disassemble at least two part is deciphered key (first deciphering key (for example, key B) and second portion deciphering key (for example, key C)), make
(step S203).Therefore, key B and C only comprise the partial data of key A, and have only when obtaining key B and C at the same time and carrying out certain operations, could obtain complete deciphering key A.First's key (key B) is embedded application program (promptly, decrypted program) in, and (for example utilize operating system that should electronic installation, Symbian S60 V3) compiler (Compiler) is converted to this application program the execute file (for example .sis) (step S204) of this electronic installation.The form of this execute file is the machine language of low order, but program wherein and multiple key forms B are through the not multiple identification of this conversion.Machine language in principle can't counter group be translated (Decompile).If can counter group translate, its result also is insignificant dual code usually, so multiple key forms B thereby be subjected to this programmed protection.
This second portion deciphering (key C) is stored in the hidden area of storage arrangement (for example, storage card) (step S205).This hidden area is to produce with the firmware (Firmware) relevant with the microcontroller of this storage card.In this hidden area data read and write the specific software support that all needs this microcontroller to provide, and this software also is wrapped in this application program being converted into machine language, so hidden area and hidden area and key C also can't be by identifications.Because this hidden area is not the hidden area that the industry agreement is produced, and does not have the proprietary software of specific microcontroller.Therefore, even the engineering staff of known as memory clipping technique flow process also is difficult to enter the hidden area and obtains key C, key C thereby be subjected to this mechanism protection of hidden area.Key C also can be stored in the zone outside the storage arrangement, for example, is stored on the remote server.Thus, can prevent that key C is detected obtains.
When storage arrangement is mounted to this electronic playing device (step S206), start the application program (step S207) of the digital content that is used for the access memory device.Judge whether and to download this second portion deciphering key (step S208) via network (for example, the Internet).If need be via this second portion deciphering key of network download, then this application program be deciphered key (step S209) via network from this second portion of this downloaded.If need be via this second portion deciphering key of network download, then this application program obtains this first and second part deciphering key from this storage arrangement, perhaps this application program obtains this first's deciphering key and deciphers key (step S210) via this second portion of network download from this storage arrangement, and this first and second part deciphering key is recombinated and encoded to reduce this original decoded key (for example, key A) (step S211).
This application program is utilized this deciphering key decrypts digital content (step S212), and wherein the .aes form is reduced into the .dm form.Digital rights management engine in this application program launching electronic installation, the .dm format conversion is become can be by the .dcf form of OMA version 1.0 execution, make the digital content of the .dm form in the storage arrangement through after authorizing, can only in specific electronic installation, play (step S213).
Note that above-mentioned part deciphering key also can utilize another encipheror to encrypt.In addition, the present invention focuses on this deciphering key disassembled and is several part encryption key pairs, and is placed on the diverse location of storage arrangement, perhaps is placed on different Storage Medias to obtain better protection.Therefore, key is deciphered by first be stored in storage arrangement, and second portion deciphered that key is stored in the hidden area of this storage arrangement or even be stored in the server that is independent of outside this storage arrangement, can know and describe notion of the present invention completely, but it is not in order to restriction the present invention.
Fig. 3 is the system architecture synoptic diagram that shows the hiding decryption key in distributed way of the embodiment of the invention.
System of the present invention comprises storage arrangement 300, electronic installation 400 and the server 500 that connects electronic installation 400 via network (for example, the Internet).Electronic installation 400 provides application program 450.Storage arrangement 300 stores the first's deciphering key in order to the primitive solution key spoon (being called encryption key pair again) of the digital content of access.This encryption key pair is in order to encrypt pretreated digital content.Storage arrangement 300 also provides hidden area 350 to store second portion deciphering key that should primitive solution key spoon.
In addition, the first's deciphering key that is not stored in the hidden area 350 is to be embedded in application program 450, and the executable file that the compiler that utilizes the operating system (for example, Symbian S60 V3) of corresponding electronic installation 400 is converted to electronic installation 400 with application program 450 (for example .sis).The form of this execute file is the machine language of low order, and it can't counter group be translated or can counter group be translated into insignificant dual code, so application program 450 can't be by identification with the first's deciphering key that is not stored in the hidden area 350.
Note that the first's deciphering key that is embedded in the application program 450 also can be stored in the server 500.Again, note that the second portion deciphering key that is stored in the hidden area 350 also can be stored in the server 500.In addition, can be disassembled be part deciphering key more than two to this primitive solution key spoon.
When storage arrangement 300 is installed in the electronic installation 400, start application program 450 in order to the digital content in the access memory device 300.Application program 450 judges whether need be via network download second portion deciphering key.If need be via this second portion deciphering key of this network download, then application program 450 be downloaded this second portion deciphering key via network from server 500.If need be via this second portion deciphering key of this network download, then application program 450 obtains this first and second part deciphering key from storage arrangement 300, perhaps obtain this first deciphering key and words are if necessary downloaded this second portions deciphering key from server 500, and this first and second part deciphering key is recombinated and encoded to reduce this primitive solution key spoon from storage arrangement 300.Application program 450 is utilized this deciphering key decrypts digital content, but makes electronic installation 400 access digital contents.
In embodiments of the present invention, the data of the deciphering key of encrypted content are distributed data, and are stored in the different addresses of the storage device that stores this encrypted content, and perhaps wherein a part of data are stored in outside Storage Media, for example, be stored in the server.Key data is disperseed to store, and is hidden and protection by identical or different method, and utilizes application-specific to be recombinated when needs are deciphered.If partial data is stored in the outside Storage Media, then can obtain this data via network.Therefore, this deciphering key can reach multiple protection.
Method of the present invention, or specific kenel or its part can exist with the kenel of procedure code.Procedure code can be contained in physical medium, get (as embodied on computer readable) Storage Media as floppy disk, discs, hard disk or any other machine readable, wherein, when procedure code by machine, when loading and carrying out as computing machine, this machine becomes in order to participate in device of the present invention.Procedure code also can pass through some transfer mediums, transmit as electric wire or cable, optical fiber or any transmission kenel, wherein, when procedure code by machine, when receiving, loading and carrying out as computing machine, this machine becomes in order to participate in device of the present invention.When the general service processing unit is done in fact, procedure code provides class of operation to be similar to the unique apparatus of using particular logic circuit in conjunction with processing unit.
Though the present invention discloses as above with preferred embodiment; right its is not in order to limit the present invention; any those skilled in the art; without departing from the spirit and scope of the present invention; when can being used for a variety of modifications and variations, so protection scope of the present invention is as the criterion when looking appended the claim scope person of defining.
Claims (10)
1. the method for a hiding decryption key in distributed way comprises the following steps:
Correspondence disassembled at least two in order to the deciphering key of the digital content of access part is deciphered key, it comprises that first's deciphering key deciphers key with second portion;
This first's deciphering key is stored in the storage arrangement;
This second portion deciphering key is stored in the hidden area of this storage arrangement;
When this storage arrangement is mounted in the electronic installation, start the application program of this electronic installation;
Utilize this application program from this storage arrangement obtain this first deciphering key and certainly this hidden area of this storage arrangement obtain this second portion deciphering key;
Utilize this application program that this first and second part deciphering key is recombinated and encoded to reduce this decoding key; And
Utilize this application program and utilize this deciphering key to decipher this digital content, but make this this digital content of electronic installation access.
2. the method for hiding decryption key in distributed way according to claim 1, wherein, the step of disassembling this deciphering key also comprises the following steps:
The digital rights management engine that this digital content of first file layout is converted to this electronic installation can be accepted this digital content of second file layout; And
This digital content of utilizing encryption key pair and encipheror to encrypt second file layout is converted to this digital content of the 3rd file layout with this digital content with second file layout.
3. the method for hiding decryption key in distributed way according to claim 2, wherein, the step of disassembling this deciphering key also comprises the following steps:
Carrying out computing is that part more than two is deciphered key will decipher that key disassembles, and wherein can carry out this computing to reduce this deciphering key by these parts are deciphered keys.
4. the method for hiding decryption key in distributed way according to claim 1, it also comprises the following steps:
This second portion deciphering key is embedded in the application program of this electronic installation; And
Utilization is converted to this application program to the compiler of operating system that should electronic installation the executable file of this electronic installation.
5. the method for hiding decryption key in distributed way according to claim 1, wherein, this second portion deciphering key is to be stored in the server.Wherein this server is to be connected to this electronic installation via network.
6. the method for hiding decryption key in distributed way according to claim 5, wherein, this application program that starts this electronic installation also comprises the following steps:
Judging whether need be via this second portion deciphering key of this network download; And
If need be, then obtain this first's deciphering key and this second portion deciphering key of this downloaded certainly from this storage arrangement by this application program via this second portion of this network download deciphering key.
7. the system of a hiding decryption key in distributed way comprises:
Storage arrangement, it stores first's deciphering key of the deciphering key of corresponding digital content in order to access, and provides in order to store the hidden area to second portion deciphering key that should the decryption key spoon; And
Electronic installation, it is equipped with application program, wherein when this storage arrangement is installed in the electronic installation, this application program be activated with this storage arrangement certainly obtain first and certainly this hidden area of this storage arrangement obtain this second portion deciphering key, reorganize with this first and second part of coding and decipher key to reduce this deciphering key, and utilize this deciphering key to decipher this digital content, but make this this digital content of electronic installation access.
8. the system of hiding decryption key in distributed way according to claim 7, it also comprises the server that is connected to this electronic installation via network, wherein this second portion deciphering key is stored in this server.
9. the system of hiding decryption key in distributed way according to claim 7, wherein, this application program judges whether need be via this second portion deciphering key of this network download, and, then obtain this first's deciphering key and this second portion deciphering key of this downloaded certainly from this storage arrangement if need be via this second portion of this network download deciphering key.
10. the system of hiding decryption key in distributed way according to claim 7, wherein, the digital rights management engine that this digital content of first file layout is converted to this electronic installation can be accepted this digital content of second file layout; And
This digital content of utilizing encryption key pair and encipheror to encrypt second file layout is converted to this digital content of the 3rd file layout with this digital content with second file layout.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2008101499859A CN101727941B (en) | 2008-10-24 | 2008-10-24 | Method and system for hiding decryption key in distributed way |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2008101499859A CN101727941B (en) | 2008-10-24 | 2008-10-24 | Method and system for hiding decryption key in distributed way |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN101727941A true CN101727941A (en) | 2010-06-09 |
| CN101727941B CN101727941B (en) | 2013-01-16 |
Family
ID=42448704
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN2008101499859A Expired - Fee Related CN101727941B (en) | 2008-10-24 | 2008-10-24 | Method and system for hiding decryption key in distributed way |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN101727941B (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2016199166A1 (en) * | 2015-06-11 | 2016-12-15 | Pradeep Varma | Potentate: a cryptography-obfuscating, self-policing, pervasive distribution system for digital content |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1236133A (en) * | 1998-05-14 | 1999-11-24 | 英属维京群岛盖内蒂克瓦尔有限公司 | Method and system for protecting distributed information from unauthorized access using single encoding/two-stage decoding scheme |
| CN101236532B (en) * | 2007-07-31 | 2011-06-29 | 北京理工大学 | Hard disk encryption method based on USB equipment under Window environment |
| CN101251880B (en) * | 2008-03-25 | 2011-07-20 | 无敌科技(西安)有限公司 | System and method for protecting digital data using electronic key |
-
2008
- 2008-10-24 CN CN2008101499859A patent/CN101727941B/en not_active Expired - Fee Related
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2016199166A1 (en) * | 2015-06-11 | 2016-12-15 | Pradeep Varma | Potentate: a cryptography-obfuscating, self-policing, pervasive distribution system for digital content |
Also Published As
| Publication number | Publication date |
|---|---|
| CN101727941B (en) | 2013-01-16 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US8205083B2 (en) | System and method for providing program information, and recording medium used therefor | |
| JP5648209B2 (en) | Storage system having encryption key selection device and encryption key selection method | |
| EP2267628B1 (en) | Token passing technique for media playback devices | |
| JP4857123B2 (en) | Unauthorized device detection apparatus, unauthorized device detection system, unauthorized device detection method, program, recording medium, and device information update method | |
| CN101281468B (en) | Method and apparatus for generating firmware update file and updating firmware by using the firmware update file | |
| US8660964B2 (en) | Secure device licensing | |
| CN101286340B (en) | Systems and methods for executing encrypted programs | |
| CN101765845A (en) | System and method for digital content distribution | |
| KR20010015037A (en) | Storage media and method for protecting contents using this | |
| KR100859414B1 (en) | Data Recognition Apparatus for Copy Protection and Method Thereof and Recording Medium Thereof | |
| CN101140610B (en) | Contents decryption method using DRM card | |
| US20070260551A1 (en) | Media Burning Terminal and System for Providing Digital Content | |
| US20100205460A1 (en) | Encryption method for digital data memory card and assembly for performing the same | |
| EP1837789A2 (en) | Method and apparatus for temporarily accessing content using temporary license | |
| CN102122336B (en) | Method, equipment and system for encrypting and decrypting game protection | |
| US20100166189A1 (en) | Key Management Apparatus and Key Management Method | |
| CN100364002C (en) | Apparatus and method for reading or writing user data | |
| CN101739531A (en) | Method and system for enhancing data encryption by using multiply key forms | |
| CN101388764B (en) | Data information protecting method, system and ciphering apparatus | |
| US20080267396A1 (en) | Method of sharing bus key and apparatus therefor | |
| US20190044709A1 (en) | Incorporating software date information into a key exchange protocol to reduce software tampering | |
| CN101727941B (en) | Method and system for hiding decryption key in distributed way | |
| CN101251880B (en) | System and method for protecting digital data using electronic key | |
| CN102937907A (en) | Method for utilizing secure digital (SD) card to perform licensed software installation and update | |
| TWI400925B (en) | Method and system for enhancing data encryption using multiple-key lists |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20130116 Termination date: 20141024 |
|
| EXPY | Termination of patent right or utility model |