WO2007093925A1

WO2007093925A1 - Improved method of content protection

Info

Publication number: WO2007093925A1
Application number: PCT/IB2007/050303
Authority: WO
Inventors: Johan C. Talstra; Antonius A. M. Staring
Original assignee: Koninklijke Philips Electronics N.V.
Priority date: 2006-02-14
Filing date: 2007-01-30
Publication date: 2007-08-23

Abstract

A method of enabling content origin authentication, comprising deriving an authorization element from at least one section of the content, from a group key associated with a group of devices suitable for accessing the content and from a content key to be used in decrypting the content, the authorization element enabling reconstruction of the content key given the at least one section and the group key. Also a device suitable for accessing content and comprising means for authenticating the content, in which the means for authenticating are configured for reconstructing a content key to be used in decrypting the content given one of a plurality of authorization elements, at least one section of the content and a group key. Also a system comprising a plurality of such devices.

Description

Improved method of content protection

Unauthorized content distribution is a grave concern for content owners. Such distribution may occur in the form of unlicensed replication of content on read-only carriers such as DVD discs, typically in large numbers, which is then sold to the public. Other forms may be e.g. distribution over a peer-to-peer network or from an unauthorized Web site. The source material e.g. might be a movie recorded on a digital camcorder in the back of a movie theater, or a stolen/leaked pre-production screener. To combat this form of piracy, copy protection systems like the Advanced Access Content System (AACS) introduce the process of Content Certificate verification.

Such process typically operates as follows. Legitimately produced content should be accompanied by a digital certificate covering that content. The certificate is digitally signed by the licensing authority of the copy protection system that applies to the content or distribution channel. When the content is played back in a compliant player (i.e. one that complies with the copy protection system in question), this player checks for the presence of a valid content certificate. The content must also be associated with that certificate. A carrier produced by an unauthorized third party or a Web site offering unauthorized downloads would not play in a compliant player, because the third party cannot create a valid content certificate.

Generally there are two steps in the certificate verification process which are computationally intensive. First, the creation and verification of a digital signature involves the computation of a cryptographic hash over the content. Calculation of this hash requires an enormous amount of data processing, as the content consists of multiple gigabytes of information.

Second, verifying the digital signature requires public key cryptography. Typically this consists of a point-multiplication on an elliptic curve cryptosystem (ECC) or a modular exponentiation using e.g. RSA. On today's (embedded) processors this can take many hundreds-of-thousands of 32x32-bit multiplications.

In systems like AACS the problem of hash calculation is reduced with an indirection as follows. The content is divided into many sections and the hashes of these sections are put in a separate file on a carrier. The licensor only signs this file and not the content as a whole. A player selects a limited number of sections of the content and compares the hash of those sections with values stored in the file. Different players may select different sections. This means a carrier with unauthorized content still has to carry hashes for all sections. As the third party does not have the necessary private key, he will be unable to create the file with signed hashes. Still, the burden of doing public key operations remains with the players.

To alleviate this burden, one may replace the public key signature with a Message Authentication Code (MAC) scheme based on symmetric cryptography. The problem with such a MAC scheme is that the key used by the player to verify the MAC is the same key as is used to generate this MAC. Therefore a professional pirate can circumvent such scheme by reverse engineering a single player implementation (e.g. a PC software player), to obtain the key(s) necessary to generate valid MACs independent from the licensor.

It is an object of the present invention to improve on the above.

This object is achieved according to the invention in a method comprising deriving an authorization element from at least one section of the content, from a group key associated with a group of devices suitable for accessing the content and from a content key to be used in decrypting the content, the authorization element enabling reconstruction of the content key given the at least one section and the group key.

The prior art described above provides what is called decision-based security, i.e. at some point the player has to make a decision whether or not access to the content is allowed based on the validity of a digital signature or MAC. This hinges on the proper execution of decision-making code somewhere in the player. Such decision-making code can be tampered with, for example by altering the code to always report that the computed hash or MAC and the hash or MAC accompanying the content are identical, or to allow access regardless of the outcome of the comparison between the two.

The present invention provides the stronger information-based security: a carrier simply does not contain enough information to decrypt the content if it had not been authorized by the licensing authority. The content decryption key is made a function of the content itself.

Preferably respective authorization elements are derived for each respective one of a plurality of sections of the content using the respective section, the group key and the content key. In an embodiment each authorization element is an encrypted version of the content key, using a combination of the applicable section and the group key as an encryption key for encrypting the content key. Preferably in this embodiment the applicable section is first subjected to a one-way function such as a cryptographic hash function to reduce the size of the (potentially large) section to a small, fixed size, e.g. 160 bits.

The invention makes use of the market logistics which apply equally to content owner and professional pirate. Both parties need a kind of sustainable business required to recoup their investment. Such business can only be realized if both their carriers play with a very high probability (>90%) in any given player. If a carrier has a lower probability of working, potential customers will regard it as unreliable and not purchase it.

Although the professional pirate can still reverse engineer an individual player and obtain the group key in such player, this information only allows him to create a carrier which plays in the group of which this player is a member. By choosing the number of groups sufficiently large, each group is only a small fraction of the total market. This means that with a large probability, the pirated discs are unlikely to play in a randomly chosen player. To achieve the desired high probability of working, the pirate has to obtain the group keys for a large number of groups, which means reverse engineering a very large number of players.

Advantageous embodiments are set out in the dependent claims.

The invention will now be discussed in more detail with reference to the figures, in which:

Fig. 1 schematically illustrates the method according to the invention; Fig. 2 schematically illustrates an arrangement for content mastering, distribution and rendering;

Fig. 3 schematically illustrates a scheme for managing revocation of group keys; and

Fig. 4 illustrates a preferred embodiment of the device. Throughout the figures, same reference numerals indicate similar or corresponding features. Some of the features indicated in the drawings are typically implemented in software, and as such represent software entities, such as software modules or objects. Fig. 1 schematically illustrates the method according to the invention. In this method the player must combine (i) a section of the content C₁, (ii) a group key K₁, and (iii) an authorization key G₁₁ to obtain a content decryption key K. This has the advantage that device revocation and content origin authentication are rolled into one single operation, without losing precious space on the carrier.

According to the invention the content is divided into n sections, the/^h one of which is labeled as C₁. The content is encrypted with a symmetric content key denoted as K. Devices are divided into m groups. The devices in each group receive a common group key. The i^th one of the m group keys is denoted as K₁. Furthermore a matrix G with matrix elements G₁₁ is provided.

The matrix G is to be chosen such that for all group keys K₁ and for all content sections C₁ the application of the function F to K₁, C₁ and matrix element G_y always results in the same content key K The skilled person will be able to come up with a great variety of functions F and matrices G that have the desired properties. Two examples will now be given.

In a first embodiment the matrix element G₁₁ is an encrypted version of the content key K, using a combination of the section C₁ and the group key K₁ as the encryption key. For example, the matrix G may be defined by: G_υ ≡ Ε[ W(C_j,K) , K ] In this example, the content key K is reconstructed as K = O[ W(C^ K₁) , G₁₁]

In a second embodiment the matrix element G₁₁ is an encrypted version of a combination of the section C₁ and the content key K, using the group key K₁ as the encryption key. For example, the matrix G may be defined by G,≡ E[ I_M H(Q Θ I ]

In this example, the content key K is reconstructed as K = O[ K₁ , G₁₇] ® H(Q

In both cases i ranges over a set of group keys, andy over (a subset of) the sections of the content. The set of group keys may be fixed or change as per the embodiment described with reference to Fig. 3 below. The notation E[K,A] indicates that item A is encrypted using key K. Similarly, D [K, A] indicates that item A is decrypted using key K.

H'() is some cryptographic one-way function which has the property that from the output of H'() it should not be possible to deduce K₁ nor should it be computationally feasible to find a modified section C₁ such that H'() remains the same. The function H'() combines a section of content with group key K₁, e.g. H\A,B) = H(H(A)\\B), or H\A,B) = E[B, H(A)]. The function H() is a cryptographic one-way function like SHA-I.

In this embodiment, the key K to encrypt the content is chosen and the matrix G is computed. The matrix G is put on the carrier 150 together with the encrypted content. When the number of sections n and/or the number of groups m is large, the matrix G may become very large: n times m. To reduce the amount of data to be stored, only a select subset of the group keys and/or only a subset of all sections should be used in computing G. This results in a matrix G that is only partially filled. Only the computed matrix elements need to be stored in that case. The discussion of Fig. 3 below explains how only using a subset of the group keys can be advantageous.

If devices are programmed to use only certain sections of the content to reconstruct the content key, then only those sections need to be used in computing G. Below, with reference to Fig. 4, an embodiment in which this option is used advantageously is discussed. Fig. 2 schematically illustrates an arrangement for content mastering, distribution and rendering. A content authoring facility 100 creates content such as music, songs, movies, animations, speeches, videoclips for music, TV programs, pictures, games, ringtones, spoken books or interactive services. To make the content available, it is sent to mastering facility 110 where an arrangement 111 for mastering and replication on carriers 150 such as Digital Versatile Discs is available.

The process of mastering and replication involves the application of a copy protection scheme. To this end, a sub-arrangement 112 is provided which interacts with a licensing authority 120 that has access to the abovementioned group keys K₁. The content key K is chosen either by the mastering facility 110 or the licensing authority 120. Following what has been said with reference to Fig. 1 above, the licensing authority 120 then chooses the matrix G such that for all group keys K₁ and for all content sections C₁ the application of the function F to K₁, C₁ and matrix element G_y always results in the same content key K. The matrix G is then supplied to the sub-arrangement 112 for recording on the carrier 150. In a first embodiment the sub-arrangement 112 supplies the sections C₁ to the licensing authority 120. The authority 120 uses matrix computation module 121 to compute the matrix elements G₁₁ as an encrypted version of the content key K, using a combination of the section C₁ and the group key K₁ as the encryption key. Preferably this is done by computing respective values H '(CpK₁) for the n sections C₇ using each of the group keys K₁ available from storage means 122. Each matrix element G₁₁ is then computed by encrypting the content key AT using the value H '(C_pK₁). The resulting matrix G is sent back to the arrangement 112. In a second embodiment the licensing authority 120 computes the matrix element G₁₁ as an encrypted version of a combination of the section C₁ and the content key K, using the group key K₁ as the encryption key.

Preferably now the mastering facility 110 calculates the respective hashes H(C₇) of the n sections C₁ of the content, and sends these hashes H(C₇) to the licensing authority 120. This has the advantage that the hashes of the sections are smaller than the sections themselves, so that the amount of data that must be exchanged is reduced. As an alternative the mastering facility 110 can still send the n sections C₁ of the content, and the authority 120 computes the hashes H(C₇) thereof.

In this embodiment preferably the licensing authority 120 computes the matrix elements G₁₁ by first computing H(C) Θ K and encrypting the result using the group key K₁. The resulting matrix G is sent back to the arrangement 112.

In both embodiments above the group keys K₁ are kept by the licensing authority 120. As an alternative one may make the group keys K₁ available to the mastering facility 110 so that the hashing and encrypting operations take place there. This avoids the need for transmitting sections or hashes thereof, but there is now an increased risk that the group keys may be stolen.

The licensing authority 120 may further comprise key generating means 123 to e.g. provide the content key AT to the mastering facility 110 for encrypting the content. Alternatively the mastering arrangement 111 may generate the content key K. During the mastering and replication process the carrier 150 may be provided with such items as a ROM mark 151, a Media Key Block 152, the matrix G and of course the encrypted content 154.

The licensing authority 120 may be realized as a computer system that is inside the mastering facility connected to the mastering and/or replication equipment. Another option is to have the licensing authority 120 at a separate location, allowing a mastering facility to contact it over a network such as the Internet. Subsequently the carrier 150 is marketed and sold or otherwise disposed of to a consumer, who at some point will insert the carrier 150 in his player 160 to access the content. The player 160 could be e.g. a radio receiver, a tuner/decoder, a CD or DVD player, a television, a VCR, a digital recorder, a mobile phone, a tape deck, a personal computer, a personal digital assistant, a portable display unit, a car entertainment system, and so on.

Alternatively to the distribution of the content on carrier 160, the content may also be made available through different channels. For example, the content may be offered for download on a Web site or through a pay-per-view television scheme.

In accordance with the present invention, the player 160 is provided with an identification i of its group, for example a group number programmed into the device 160 in the factory. A key reconstruction module 168 selects a section C₁ of the content 154 and the applicable matrix element G₁₁ from the carrier 150 and selects the appropriate group key K₁ from a storage medium 162. With this information the module 168 reconstructs the content decryption key K. If the player 160 does not have the appropriate group key K₁, it cannot compute the content decryption key K. Note that a player may have one or more group keys, as a player may be a member of plural groups.

In a first embodiment the matrix element G₁₁ is an encrypted version of the content key K, using a combination of the section C₁ and the group key K₁ as the encryption key. The module 168 reconstructs the content decryption key K by combining the section C₁ and the group key K₁ and using the result as decryption key. For example, the matrix G may be defined by:

G_y ≡ Ε[ W{C_j^ , K ] In this example, the module 168 reconstructs the content decryption key K as

K = O[ W(C₁ , K₁) , G₁₁]

In a second embodiment the matrix element G₁₁ is an encrypted version of a combination of the section C₁ and the content key K, using the group key K₁ as the encryption key. The module 168 now reconstructs the content decryption key K by decrypting the matrix element G₁₁ using the group key K₁. The outcome of this decryption operation is then combined again with the section C₁ to arrive at the content key K. For example, the matrix G may be defined by

G₁₁ ≡ Ε[ K₁ , U(C₁) ® K ]

In this example, the module 168 reconstructs the content decryption key K as K = O[ K₁ , G₁₁] ® H(C₁)

An attacker who tries to pass off content he created as authentic lacks the knowledge of enough group keys K₁ to make his carriers playable in a substantial fraction of the player population. Using the content key K the content is then decrypted by decryption module 164 and can be rendered using rendering module 165. The exact way in which a content item is rendered depends on the type of device and the type of content. For instance, in a radio receiver, rendering comprises generating audio signals and feeding them to loudspeakers. For video content, rendering generally comprises generating audio and video signals and feeding those to a display screen and loudspeakers. For other types of content a similar appropriate action must be taken.

Alternatively to rendering, the content may also be copied onto a different carrier such as a hard disk. The player 160 may be connected to a network and may be configured to provide the content to a different device which performs the actual rendering.

It will be clear to those skilled in the art that the content decryption key K which is obtained in this way does not necessarily decrypt the content directly, but may be an ingredient in a key hierarchy, and/or may be combined with other standard elements of a copy protection system such as a physical ROM mark, or a further revocation key block and/or usage rights. The device 160 may be provided with a content protection system (CPS) 166 that uses one or more device keys available in storage module 167. Note that storage module 167 and storage module 162 may be implemented using a single storage medium.

Fig. 3 schematically illustrates a scheme for managing revocation of group keys. The nodes of the tree 200 have been labeled in the canonical way using numbers with binary digits. At the highest level, there is the root node 201. Below there are two nodes 211, 212 labeled "0" and "1". The next level comprises nodes 221, 222, 223, 224 also with respective labels. Below that there are nodes 231-238, and at the bottom the leaf nodes 240 are provided.

Devices correspond to leaf nodes. Device 0 (indicated in Fig. 3 with decimal number "0") corresponds to the leaf node with label "0000"; device 1 corresponds to the leaf node with label "0001", and so on. In practice there would of course be many more leaf nodes as there may well be hundreds of thousands of devices in the system.

Assigned to every node of the binary tree are randomly chosen group keys. A group key assigned to a node with number n will be referred to as K_n. For example the key of node 212 is K₀, a key assigned to node 222 is K_Oi, the key for node 234 is K_On and a key for the last shown leaf node is Kim. The root node may or may not have been assigned a key.

All keys on the path from the root node 201 to a particular leaf node are available to the device corresponding to that particular leaf node. For example, device 7 holds keys Ko, KQ_I, Ko π and Kom and device 15 has keys Ki, Kn, Km and Kim. In some systems these keys are often referred to as device keys, although it would be better to call them group keys, because such a key is shared by the group of devices contained in the sub-tree rooted at that particular node.

Note that some of the subsets are actually subsets of another subset. For example the subset corresponding to node 232 comprising devices 2 and 3 is a subset of the subset corresponding to node 221 comprising devices 0, 1, 2 and 3 as well as of the subset corresponding to node 211 comprising devices 0 through 7.

This assignment of group keys makes it possible to selectively address subsets of all devices. Suppose that the group keys stored in devices 0, 7, 8 and 9 have been reverse engineered and used by professional pirates. This means that future legitimate content should no longer be accompanied by a matrix G from which the content decryption key may be derived.

To achieve this, the matrix computation module 121 now uses the keys Koooi, K₀Oi, Koio, Koi io, Kioi and Kn to create the matrix elements G_υ for groups 0001, 001, 010, 0110, 101 and 11. Only these matrix elements will accompany the content. As can be seen in Fig. 3, these keys are the group keys available only to the devices in the shaded areas of the tree. This new choice of keys avoids the group keys available to the devices 0, 7, 8 and 9.

In copy protection systems such as Copy Protection for Recordable Media and Copy Protection for Pre-recorded Media, Video Content Protection System and AACS a comparable scheme is used to assign decryption keys. The decryption keys are used to decrypt content keys with which in turn the content can be decrypted. However in these systems only confidentiality of the content key is achieved. In the present invention, the carrier simply does not contain enough information to decrypt the content if it had not been authorized by the licensing authority. The content decryption key is made a function of the content itself.

In a preferred embodiment the group keys initially used are not the root key or keys Ko or Ki. Rather, to make it very hard for the professional hacker, the initial number of group keys is already chosen to be very large, preferably 1,000 groups or more. This means that none of the group keys of the top ten layers of the tree should be used. In an advantageous embodiment, these keys do not even exist.

Fig. 4 schematically illustrates a preferred embodiment of the device 160. Here only selected cells from the matrix G are stored on the carrier, using the media key block structure 152. Preferably only one cell from each column is chosen. This means that each group of devices (preferably selected on the basis of a key block) uses precisely one section of the content to compute the key K on the basis of which the content is then decrypted. In this embodiment the elements G_y are obtained as G_y ≡ S_y E[W(C₁ , K₁) , K ] and the content key K can be obtained as K = O[ W(C K) , G₁₁] where the Kronecker Delta symbol δ_y is equal to 1 if the cell is to be chosen and 0 otherwise.

This embodiment has the advantage that device revocation and content certification are rolled into one single operation, without losing precious space on the carrier. In Fig. 4, the carrier 150 comprises the content 154, the key block 152 and optionally a cryptographic salt 156. In the device 160, a key block processing module 561 reads the key block 152 from the carrier 150 and, using keys available from storage medium 562, obtains the group key K₁. This key K₁ is fed to the hashing module 563, which computes W(C_j , K₁) and feeds the outcome to decryption module 564. The outcome of decryption module 564 is the key K which is then provided to the CPS 166 (not shown here).

The module 561 also supplies an identification^ of the group to which the device 160 belongs to a section locator module 565. With this information, the module 565 obtains the appropriate section C₁ of content from the carrier 150

If a device is in a group with a relatively high group number, that device always has to access a section with a high number as well. As such a section is likely far away from the location on the carrier where the matrix G, key blocks and other related information is stored, such a device has to perform a more time-consuming access operation than a device with a relatively low group number. To ensure that, on average, every player spends an equal amount of time in accessing the carrier for key computation, the optional cryptographic salt 156 is used.

The cryptographic salt 156 is mixed with the group identificationy and the outcome of this mixing operation is used as the section number. The salt 156 is preferably randomly chosen by the mastering facility 110 or the licensing authority 120. This way, every player will effectively access a randomly chosen section which means that, on average, every player spends an equal amount of time in accessing the carrier for key computation.

In international patent application WO2005/008385, technologies are disclosed to transfer responsibility and control over security from player makers to content authors by enabling integration of security logic and content. An exemplary optical disc carries an encrypted digital video title combined with data processing operations that implement the title's security policies and decryption processes. Player devices include a processing environment (e.g., a real-time virtual machine), which plays content by interpreting its processing operations. Players also provide procedure calls to enable content code to load data from media, perform network communications, determine playback environment configurations, access secure nonvolatile storage, submit data to codecs for output, and/or perform cryptographic operations. Content can insert forensic watermarks in decoded output for tracing pirate copies. If pirates compromise a player or title, future content can be mastered with security features that, for example, block the attack, revoke pirated media, or use native code to correct player vulnerabilities. US patent application US20040190868A1 discloses a recording apparatus that comprises a receiving unit operable to receive content, a control unit operable to determine a recording method of the content on a recording media, and a R/W unit operable to write in and read out on the recording media. The control unit includes a recording media identification unit operable to identify a type of the recording media via the R/W unit, a source identification unit operable to judge a type of a source about whether or not the received content is a content subject to a content protection, a recording method selection unit operable to select a recording method of the content on the recording media, and a recording method conversion unit.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design many alternative embodiments without departing from the scope of the appended claims.

In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps other than those listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements.

The invention can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In the device claim enumerating several means, several of these means can be embodied by one and the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

Claims

CLAIMS:

1. A method of enabling content origin authentication, comprising deriving an authorization element from at least one section of the content, from a group key associated with a group of devices suitable for accessing the content and from a content key to be used in decrypting the content, the authorization element enabling reconstruction of the content key given the at least one section and the group key.

2. The method of claim 1, comprising deriving a respective authorization element for each respective one of a plurality of sections of the content using the respective section, the group key and the content key.

3. The method of claim 2, in which each authorization element is an encrypted version of the content key, using a combination of the applicable section and the group key as an encryption key for encrypting the content key.

4. A device suitable for accessing content and comprising means for authenticating the content, in which the means for authenticating are configured for reconstructing a content key to be used in decrypting the content given one of a plurality of authorization elements, at least one section of the content and a group key.

5. The device of claim 4, in which the means for authenticating are configured for determining a group to which the device belongs, the means for authenticating being configured for selecting one authorization element from said plurality of authorization elements based on the determined group.

6. The device of claim 5, comprising storage means for storing a plurality of group keys, the means for authenticating being configured for selecting the group key to be used in reconstructing the content key based on the determined group.

7. A system comprising a plurality of devices as claimed in claim 4, which devices have been grouped into respective groups, and in which the devices of a single group share at least one common group key for reconstructing the content key.

8. The system of claim 7, in which the devices have been assigned a plurality of group keys, each group key of said plurality being shared with a subset of all devices, at least one of the subsets being a subset of another subset.

9. A carrier comprising content encrypted with a content key and an authorization element derived from at least one section of the content, from a group key associated with a group of devices suitable for accessing the content and from a content key to be used in decrypting the content, the authorization element enabling reconstruction of the content key given the at least one section and the group key.