WO2016146013A1 - 在数字内容设备中在线写入应用密钥的方法、装置及系统 - Google Patents

在数字内容设备中在线写入应用密钥的方法、装置及系统 Download PDF

Info

Publication number
WO2016146013A1
WO2016146013A1 PCT/CN2016/076028 CN2016076028W WO2016146013A1 WO 2016146013 A1 WO2016146013 A1 WO 2016146013A1 CN 2016076028 W CN2016076028 W CN 2016076028W WO 2016146013 A1 WO2016146013 A1 WO 2016146013A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
application
app
encrypted
pub
Prior art date
Application number
PCT/CN2016/076028
Other languages
English (en)
French (fr)
Inventor
罗金华
Original Assignee
阿里巴巴集团控股有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司 filed Critical 阿里巴巴集团控股有限公司
Publication of WO2016146013A1 publication Critical patent/WO2016146013A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • G06F21/445—Program or device authentication by mutual authentication, e.g. between devices or programs
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements

Definitions

  • the present application relates to digital content device security technologies, and in particular, to a method, device and system for writing an application key online in a digital content device.
  • DRM Digital Rights Management
  • Digital content protection technology has also become a trend and has become a digital content device, especially one of the core technologies that must be considered, for example, by pay-per-view content providers.
  • DRM technology includes software DRM technology and hardware DRM technology.
  • each DRM solution vendor has its own software DRM solution.
  • the more common is to put the key Key in a place in the binary code that is not easy to obtain.
  • a hacker can run a specific program to intercept a secret by various means, those skilled in the art generally believe that the location accessible by an application running on a CPU (Central Processing Unit) is insecure, so the software DRM is considered to be easy to crack.
  • CPU Central Processing Unit
  • Hardware DRM saves the key in a hardware storage area called Key store, which is usually located in non-volatile storage medium such as eMMC (Embedded MultiMediaCard), non-linear macrocell mode flash NAND flash. on.
  • eMMC embedded MultiMediaCard
  • NAND flash non-linear macrocell mode flash NAND flash.
  • Hardware DRM usually consists of one-time programmable hardware storage area OTP (one time program), key store, trusted video link Trust Video Path (in video DRM protection technology, usually refers to the video playback link, in each buffer The data can only be accessed by trusted components).
  • OTP one time program
  • key store key store
  • trusted video link Trust Video Path in video DRM protection technology, usually refers to the video playback link, in each buffer The data can only be accessed by trusted components).
  • OTP usually burns (ie, writes) a "Root key", which is also called the device key Device key (D_K).
  • D_K device key
  • the root key is unique to each device. That is, the root key of each device is different. This Root key is used to encrypt the keys stored in the Key store.
  • the OTP feature can only be “written” once, which guarantees that the root key will not be tampered with, and the "read” permission for the OTP is usually limited to "trusted” hard. Parts.
  • app_key such as HDCP (High-Bandwidth Digital Content Protection) key
  • HDCP High-Bandwidth Digital Content Protection
  • Marlin TM one kind of DRM technology
  • a method, an apparatus, and a system for writing an application key in a digital content device are provided, which are used to solve the problem that the hardware DRM cannot be implemented on the application when the application key is not written in the factory stage in the prior art.
  • a method for writing an application key online in a digital content device comprising: receiving an application key D_pub (app_key) encrypted by a device public key from a server, and forwarding Giving the trusted component; triggering the trusted component to read the OTP, obtaining the pre-stored root key D_K, wherein the root key is unique to each device; triggering the trusted component to use the pre-stored device private key C_pri to apply the encrypted secret
  • the key D_pub(app_key) is decrypted to obtain the application key app_key; the trigger trusted component encrypts the application key app_key with the root key D_K to obtain D_K(app_key); and writes D_K(app_key) into the key storage area.
  • a method for writing an application key online in a digital content device includes: performing identity authentication on the device; and obtaining the device public key D_pub corresponding to the device after the authentication is passed;
  • the application key app_key to be written is encrypted using D_pub;
  • the trigger server sends the encrypted application key D_pub (app_key) to the device.
  • an apparatus for writing an application key online in a digital content device comprising: a first receiving module, configured to receive an application key encrypted by a device public key from a server D_pub(app_key), and forwarded to the trusted component; the first triggering module is configured to trigger the trusted component to read the OTP, and obtain a pre-stored root key D_K, wherein the root key is unique to each device; Module for triggering The letter component decrypts the encrypted application key D_pub(app_key) by using the pre-stored device private key C_pri to obtain the application key app_key; and the third triggering module is configured to trigger the trusted component to encrypt the application key app_key by using the root key D_K. , get D_K (app_key); write module for writing D_K (app_key) to the key storage area.
  • an apparatus for writing an application key online in a digital content device comprising: an authentication module, configured to perform identity authentication on the device; and a public key acquisition module, configured to After the device is authenticated, the device public key D_pub is obtained.
  • the encryption module is used to encrypt the application key app_key to be written by using D_pub.
  • the fifth trigger module is used to trigger the server to encrypt the application key D_pub (app_key). ) is sent to the device.
  • a digital content device comprising: the device for writing an application key online as described above; a trusted component for triggering the OTP by the device to obtain pre-storage Root key D_K, wherein the root key is unique to each device; the encrypted application key D_pub(app_key) is decrypted using the pre-stored device private key C_pri to obtain the application key app_key; and the root key D_K is utilized
  • the application key app_key is encrypted to obtain D_K (app_key); the OTP is used to store the root key D_K; the key storage area is used to store the device private key C_pri and the root key encrypted application key D_K (app_key).
  • a server comprising: the device for writing an application key online as described above; a storage module for storing an application key app_key to be written; and a sending module,
  • the encrypted application key D_pub(app_key) is sent to the device by the trigger of the device.
  • a system for writing an application key online in a digital content device comprising: a digital content device as described above; and a server as described above.
  • the encrypted application key D_pub (app_key) received from the server is decrypted by triggering the trusted component, and then the device is used.
  • the key is encrypted, and the application key D_K (app_key) encrypted by the device key is written into the key store Key store, so that the device can write the application key online to the key storage area, thereby enabling hardware to be implemented for the application.
  • DRM protection avoids the problem that the application in the prior art that the application key is not written in the factory stage cannot implement the hardware DRM, and the security level is lowered, thereby improving the security performance of the device.
  • the solution for writing an application key in the digital content device is performed on the server side, and the device is authenticated by performing an ID card on the server side. After the authentication is passed, the encrypted application is encrypted. The key is sent to the device to ensure the security of online writing.
  • FIG. 1 is a flowchart of a method for writing an application key online in a digital content device according to Embodiment 1 of the present application;
  • FIG. 2 is a flowchart of a method for writing an application key online in a digital content device according to Embodiment 2 of the present application;
  • FIG. 3 is a schematic structural diagram of an apparatus for writing an application key online in a digital content device according to Embodiment 3 of the present application;
  • FIG. 4 is a schematic structural diagram of an apparatus for writing an application key online in a digital content device according to Embodiment 4 of the present application;
  • FIG. 5 is a schematic structural diagram of a digital content device according to Embodiment 5 of the present application.
  • FIG. 6 is a schematic structural diagram of a server according to Embodiment 6 of the present application.
  • FIG. 7 is a schematic structural diagram of a system for writing an application key online in a digital content device according to Embodiment 7 of the present application;
  • FIG. 8 is a flow chart of a method of writing an application key online in a digital content device in accordance with an eighth embodiment of the present application.
  • the embodiment of the present application is directed to providing an online upgrade manner, in which a key of a DRM application is sent to a device, so that the device has the capability of hardware DRM protection.
  • the embodiment of the present application provides a method, device, and system for writing an application key online in a digital content device, by triggering a trusted component to receive an encrypted application key D_pub (app_key) from a server. Decrypting, then encrypting with the device key, and then writing the application key D_K (app_key) encrypted by the device key into the key store Key store, so that the device can write the application key online to the key storage area, thereby
  • the hardware DRM protection can be implemented for the application, and the problem that the application cannot be implemented by the application of the application key in the factory stage in the prior art cannot be realized, and the security level is lowered, and the security performance of the device is improved.
  • This application applies to all operating systems and hardware platforms that support the Secure OS/Secure Processor and OTP.
  • FIG. 1 is a flowchart of a method for writing an application key online in a digital content device according to Embodiment 1 of the present application.
  • the method for writing an application key online in a digital content device includes the following steps:
  • the trigger trusted component reads the one-time programmable hardware storage area OTP, and obtains a pre-stored root key D_K, wherein the root key is unique to each device;
  • the trigger trusted component decrypts the encrypted application key D_pub(app_key) by using the pre-stored device private key C_pri to obtain an application key app_key;
  • the trigger trusted component encrypts the application key app_key by using the root key D_K to obtain D_K(app_key);
  • the encryption and decryption algorithms in the embodiments of the present application may be commonly used in various encryption and decryption algorithms, such as public key encryption algorithms RSA, ElGamal, Fiat-Shamir, Guillou-Quisquarter, Schnorr, Ong-Schnorr-Shamir digital signature algorithm, Des/ DSA, elliptic curve digital signature algorithm and finite automaton digital signature algorithm, etc., the present application does not limit the specific encryption and decryption algorithm in the specific implementation.
  • the key of the determined other application can also be encrypted with the Device key in the factory production stage, and stored in the key store in advance.
  • the application key can be stored in a variety of storage formats and methods, or the application key can be stored in different storage formats and methods for different applications, such as a simple Key-value method or XML (ExerMarkuLaguage, Extended markup language) file format, which is not limited in this application.
  • the pre-stored root key D_K may be an AES (Advanced Encryption Standard) key in the present application, and has a length of 256 bits, but may be other lengths such as 128 bits and 512 bits. Degree, etc., the longer the length, the higher the security; when the root key is AESkey, the trusted component uses the root key D_K to encrypt the application key app_key also needs to adopt the AES algorithm.
  • the root key D_K can also be other types of keys, and the trusted component can also use the root encryption key D_K to encrypt the application key app_key by using other encryption and decryption algorithms, which is not limited in the application.
  • the device needs to establish a connection with the background server.
  • the connection may be performed by a method such as HTTPS (HyperText Transfer Protocol) or other connection modes.
  • HTTPS HyperText Transfer Protocol
  • the manner in which the device can communicate with the server is included within the scope of this application.
  • the device may first initiate a request for writing a key online, and then receive an application key D_pub (app_key) encrypted by the device public key from the server, or may be directly sent by the server to be sent by the device.
  • the key encryption application key D_pub(app_key) is not limited in this application.
  • the encrypted application key D_pub(app_key) received from the server is decrypted by triggering the trusted component, and then encrypted by using the device key, and then the application key D_K encrypted by the device key is used.
  • (app_key) is written into the key store Key store, enabling the device to write the application key online to the key storage area, thereby enabling hardware DRM protection for the application, avoiding the prior art not writing the application at the factory stage.
  • the application caused by the key cannot implement hardware DRM, and the security level is reduced, which improves the security performance of the device.
  • the application key transmitted between the server and the device is the encrypted application key, and the process of decrypting and encrypting the application key is completed by the trusted component, it is guaranteed The security of online writing.
  • the method further includes: Reading the pre-stored device private key D_K (C_pri) encrypted by the root key D_K in the key storage area, and forwarding the encrypted device private key D_K (C_pri) to the trusted component; triggering the trusted component to utilize the root key D_K decrypts the encrypted device private key D_K (C_pri) to obtain the device private key C_pri.
  • the device private key is usually encrypted by using the root key and stored in the key store key store, then the trusted component is triggered to read the OTP, and the pre-stored root key D_K is obtained. Thereafter, and before the trigger trusted component decrypts the encrypted application key D_pub(app_key) by using the device private key C_pri, the root key D_K encrypted device private key D_K (C_pri) needs to be further read from the key storage area, And encrypting the encrypted device private key D_K (C_pri) to the trusted component; triggering the trusted component to decrypt the encrypted device private key D_K (C_pri) by using the root key D_K to obtain the device private key C_pri.
  • the trusted component is a secure processor or a device processor in a secure mode.
  • the access control of the trusted component to the OTP can be controlled by using a common trusted computing technology. For example, only the CPU without the third-party code can access the OTP, and only the CPU in the secure mode can access the OTP, etc. .
  • FIG. 2 is a flow chart of a method for writing an application key online in a digital content device according to a second embodiment of the present application.
  • the method for writing an application key online in a digital content device includes the following steps:
  • the encryption and decryption algorithms in the embodiments of the present application may be commonly used in various encryption and decryption algorithms, such as public key encryption algorithms RSA, ElGamal, Fiat-Shamir, Guillou-Quisquarter, Schnorr, Ong-Schnorr-Shamir digital signature algorithm, Des/ DSA, elliptic curve digital signature algorithm and finite automaton digital signature algorithm, etc., the present application does not limit the specific encryption and decryption algorithm in the specific implementation.
  • the method in the embodiment of the present application determines whether the device is trusted by performing an ID card on the device. After the authentication is passed, the encrypted application key is sent to the device to ensure the security of online writing.
  • performing identity authentication on the device specifically includes: receiving a device certificate from the device, where the device certificate is pre-stored in the device, and is unique to each device; authenticating the device certificate; acquiring the device corresponding to the device
  • the public key D_pub specifically includes: extracting the device public key D_pub corresponding to the device from the device certificate.
  • the device reports the device ID, the MAC address, and the like to the server, performs identity authentication on the device according to the unique identifier, and after the authentication is passed, searches the server for the public key corresponding to the device, and then uses the public key pair application.
  • the key is encrypted and sent to the device; those skilled in the art should understand that the manner in which the device identity can be authenticated in the art is included in the scope of the present application.
  • the device certificate is used to determine whether the device is trusted. After the authentication is passed, the encrypted application key is sent to the device to ensure the security of online writing.
  • an embodiment of the present application further provides an apparatus for writing an application key in a digital content device.
  • the principle of solving the problem by the device is written online in the digital content device in the first embodiment of the present application.
  • the method of applying the key is similar, so the implementation of the device can be referred to the implementation of the method, and the repeated description will not be repeated.
  • FIG. 3 is a schematic structural diagram of an apparatus for writing an application key online in a digital content device according to Embodiment 3 of the present application.
  • the apparatus 300 for writing an application key in a digital content device includes: a first receiving module 302, configured to receive an application key D_pub encrypted by a device public key from a server. (app_key), and forwarded to the trusted component; the first triggering module 304 is configured to trigger the trusted component to read the one-time programmable hardware storage area OTP, and obtain a pre-stored root key D_K, wherein the root key is each
  • the second trigger module 306 is configured to trigger the trusted component to decrypt the encrypted application key D_pub (app_key) by using the pre-stored device private key C_pri to obtain the application key app_key;
  • the third trigger module 308 The triggering trusted component uses the root key D_K to encrypt the application key app_key to obtain D_K (app_key); and the writing module 310 is configured to write D_K (app_key) into the key storage area.
  • the embodiment of the present application can be implemented by a computer language such as c, c++ or the like.
  • the device in the embodiment of the present application may be an online upgrade process located on the CPU.
  • the encrypted application key D_pub (app_key) received from the server is decrypted by triggering the trusted component, and then encrypted by using the device key, and then the application key D_K encrypted by the device key is used.
  • (app_key) is written into the key store Key store, enabling the device to write the application key online to the key storage area, thereby enabling hardware DRM protection for the application, avoiding the prior art not writing the application at the factory stage.
  • the application caused by the key cannot implement hardware DRM, and the security level is reduced, which improves the security performance of the device.
  • the application key transmitted between the server and the device is the encrypted application key, and the process of decrypting and encrypting the application key is completed by the trusted component, it is guaranteed The security of online writing.
  • the apparatus in the embodiment of the present application further includes: a reading module, configured to read a pre-stored device private key D_K (C_pri) encrypted by the root key D_K from the key storage area, and encrypt the device
  • the private key D_K (C_pri) is forwarded to the trusted component
  • the fourth triggering module is configured to trigger the trusted component to decrypt the encrypted device private key D_K (C_pri) by using the root key D_K to obtain the device private key C_pri .
  • the device private key is usually encrypted by using the root key and stored in the key store key store. Therefore, it is necessary to first read the pre-stored root from the key storage area.
  • the device private key D_K (C_pri) encrypted by the key D_K is given to the trusted device for decryption to obtain the device private key.
  • the trusted component is a secure processor or a device processor in a secure mode.
  • the security level of the online write application key is improved.
  • an embodiment of the present application further provides an apparatus for writing an application key in a digital content device.
  • the principle of solving the problem by the device and the online writing in the digital content device in the second embodiment of the present application are provided.
  • the method of applying the key is similar, so the implementation of the device can be referred to the implementation of the method, and the repeated description will not be repeated.
  • FIG. 4 is a schematic structural diagram of an apparatus for writing an application key online in a digital content device according to Embodiment 4 of the present application.
  • the device 400 for writing an application key in a digital content device includes: an authentication module 402 for performing identity authentication on the device; and a public key obtaining module 404 for After the device is authenticated, the device public key D_pub corresponding to the device is obtained; the encryption module 406 is configured to encrypt the application key app_key to be written by using D_pub; and the fifth triggering module 408 is configured to trigger the server to encrypt the application key D_pub. (app_key) is sent to the device.
  • the device is authenticated in advance to determine whether the device is trusted. After the authentication is passed, the encrypted application key is sent to the device to ensure the security of the online write. .
  • the authentication module specifically includes: a receiving submodule, configured to receive a device certificate from the device, where the device certificate is pre-stored in the device and is unique to each device; and the authentication submodule is used for the device The certificate is authenticated.
  • the public key obtaining module is specifically configured to extract the device public key D_pub corresponding to the device from the device certificate.
  • the device in the embodiment of the present application determines whether the device is trusted by using the device certificate. After the authentication is passed, the encrypted application key is sent to the device to ensure the security of online writing.
  • FIG. 5 is a schematic structural diagram of a digital content device according to Embodiment 5 of the present application.
  • the digital content device 50 includes: an apparatus 300 for writing an application key online; a trusted component 502, configured to be triggered by the device 300 to read the OTP 504, and obtain pre-stored information.
  • the root key D_K wherein the root key is unique to each device; the encrypted application key D_pub(app_key) is decrypted using the pre-stored device private key C_pri to obtain the application key app_key; and the root key D_K is used for encryption
  • the application key app_key is used to obtain D_K (app_key); the OTP 504 is used to store the root key D_K; and the key storage area 506 is used to store the device private key C_pri and the root key encrypted application key D_K (app_key).
  • the encrypted application key D_pub (app_key) received from the server is decrypted by the trusted component, and then encrypted by using the device key, and then the application key encrypted by the device key is used.
  • D_K (app_key) is written into the key store Key store, enabling the device to write the application key online to the key storage area, thereby enabling hardware DRM protection for the application, avoiding the prior art not writing at the factory stage.
  • Applications caused by application keys cannot implement hardware DRM, and the security level is reduced, which improves the security performance of the device.
  • the application key transmitted between the server and the device is the encrypted application key, and the process of decrypting and encrypting the application key is completed by the trusted component, Therefore, the security of online writing is guaranteed.
  • the device private key stored in the key storage area is the device private key D_K (C_pri) encrypted by the root key D_K.
  • the device private key is encrypted by the root key and stored in the key store key store to further improve security.
  • the key storage area is further used to store a device certificate, wherein the device certificate is unique to each device.
  • the device certificate stored in the key storage area is usually also the root certificate D_K encrypted.
  • the device certificate is used to prove to the server that the device is a trusted device.
  • the identity of the device is proved by using the device certificate, and the security of online writing is ensured.
  • FIG. 6 is a schematic structural diagram of a server according to Embodiment 6 of the present application.
  • the server 60 includes: an apparatus 400 for writing an application key online; a storage module 602 for storing an application key app_key to be written; and a sending module 604 for The triggered application key D_pub(app_key) is sent to the device by the trigger of the device.
  • the device is authenticated in advance to determine whether the device is trusted. After the authentication is passed, the encrypted application key is sent to the device to ensure the security of online writing. .
  • the device certificate is used to determine whether the device is trusted. After the authentication is passed, The encrypted application key is sent to the device to ensure the security of online writing.
  • the embodiment of the present application further provides a system for writing an application key online in a digital content device, and the principle of solving the problem in the system and the online writing application in the digital content device in the embodiment of the present application.
  • the method of the key is similar, so the implementation of the system can be referred to the implementation of the method, and the repetition will not be repeated.
  • FIG. 7 is a schematic structural diagram of a system for writing an application key online in a digital content device according to Embodiment 7 of the present application.
  • a system 70 for writing an application key online in a digital content device includes: a digital content device 50; and a server 60.
  • the system for authenticating the application key in the digital content device in the embodiment of the present application authenticates the device identity through the server, and sends the encrypted application key to the device after the authentication is passed, and then the trusted component pairs Encrypt the application key D_pub(app_key) for decryption, encrypt it with the device key, and then write the application key D_K (app_key) encrypted by the device key into the key store Key store, so that the device can apply the key online.
  • the key storage area is written, so that hardware DRM protection can be implemented for the application, and the problem that the application cannot be implemented by the application of the application key in the factory stage cannot be realized, and the security level is lowered, and the device is improved. Security performance.
  • FIG. 8 is a flow chart of a method of writing an application key online in a digital content device in accordance with an eighth embodiment of the present application.
  • the method for writing an application key online in a digital content device includes the following steps:
  • the workstation burns the device key Device key to the device OTP.
  • the workstation burns the device certificate D_K (D_Cert) encrypted by the Device key and the certificate private key D_K (C_Priv) to the key store;
  • the online service process Online Key service on the device CPU establishes a connection with the background server through HTTPS, and submits Device certification (D_Cert) to the server;
  • the app_key to be delivered is encrypted by the public key (D_pub) and sent to the device;
  • Secure OS obtains D_K by reading the corresponding data of OTP;
  • Secure OS uses C_Priv to solve app_key from D_Pub(app_key) via RSA algorithm, then encrypts app_key with Device key (D_K) to get D_K(app_key), and sends D_K(app_key) back to Online. Key service;
  • the system for authenticating the application key in the digital content device in the embodiment of the present application authenticates the device identity through the server, and sends the encrypted application key to the device after the authentication is passed, and then the trusted component pairs Encrypt the application key D_pub(app_key) for decryption, encrypt it with the device key, and then write the application key D_K (app_key) encrypted by the device key into the key store Key store, so that the device can apply the key online.
  • the key storage area is written, so that hardware DRM protection can be implemented for the application, and the problem that the application cannot be implemented by the application of the application key in the factory stage cannot be realized, and the security level is lowered, and the device is improved. Security performance.
  • embodiments of the present application can be provided as a method, system, or computer program product.
  • the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment in combination of software and hardware.
  • the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Multimedia (AREA)
  • Technology Law (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computing Systems (AREA)
  • Storage Device Security (AREA)

Abstract

一种在数字内容设备中在线写入应用密钥的方法、装置及系统，该方法包括：从服务器接收由设备公钥加密的应用密钥D_pub(app_key)，并转发给可信部件（S102）；触发可信部件读取OTP，获得预先存储的根密钥D_K，其中，根密钥是各设备唯一的（S104）；触发可信部件利用预先存储的设备私钥C_pri对加密的应用密钥D_pub(app_key)进行解密，获得应用密钥app_key（S106）；触发可信部件利用根密钥D_K加密应用密钥app_key，得到D_K(app_key) （S108）；将D_K(app_key)写入密钥存储区（S110）。上述方案使得设备能够在线将应用密钥写入密钥存储区，从而能够对该应用实现硬件DRM保护，避免了现有技术中未在工厂阶段写入应用密钥导致的应用不能实现硬件DRM，安全级别降低的问题，提高了设备的安全性能。

Description

在数字内容设备中在线写入应用密钥的方法、装置及系统
本申请要求2015年03月19日递交的申请号为201510122933.2、发明名称为“在数字内容设备中在线写入应用密钥的方法、装置及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及数字内容设备安全技术，特别涉及一种在数字内容设备中在线写入应用密钥的方法、装置及系统。
背景技术
在国际上，对数字内容，例如，音频，视频，软件等利用DRM(Digital Rights Management，数字版权保护)技术进行保护已经是较为普遍的做法，甚至好莱坞的制片商要求播放其影片的产品必须支持DRM保护技术。在中国，DRM内容保护技术也成为趋势，并成为数字内容设备，尤其是例如付费影视内容提供商必须考虑的核心技术之一。
DRM技术包括软件DRM技术和硬件DRM技术。
通常各个DRM方案厂商都有自己的软件DRM解决方案，较为常见的是把密钥Key放在二进制代码中的某个不容易获取的地方。但是由于黑客可以通过各种手段运行特定程序来截取机密，所以本领域技术人员通常认为，CPU(Central Processing Unit，中央处理器)上运行的应用程序能够访问的位置都是不安全的，因此软件DRM被认为是很容易破解的。
硬件DRM是将key保存在一块硬件存储区中，该硬件存储区被称为Key store，通常位于eMMC(Embedded MultiMediaCard，嵌入式多媒体卡)、非线性宏单元模式闪存NAND flash等非易失存储介质上。
硬件DRM通常由一次性可编程硬件存储区OTP(one time program)，Key store，可信视频链路Trust Video Path(在视频DRM保护技术里，通常是指video播放的链路上，各个buffer中的数据只能被可信的部件访问)等构成。
OTP里通常会烧录(即，写入)一个“Root key(根密钥)”，这个Root key又叫设备密钥Device key(D_K)，一般而言，根密钥是各设备唯一的，即，每个设备的根密钥都是不同的。该Root key用于加密Key store里存储的key。OTP的特性是只能“写”一次，这就保证了Root key不会被篡改，而对OTP的“读”权限通常只限于“可信”的硬 件部件。
由于OTP上存储的机密内容的读写权限都受限，连通常的CPU(如ARM“Normal world”模式下的CPU)都不能访问，所以一般的黑客技术无法攻破，因此通常认为硬件DRM技术安全等级高于软件DRM技术。
为了对数字内容设备实现硬件DRM保护，目前市场上通常的做法是：在工厂生产设备时，把应用key(app_key)，如HDCP(High-Bandwidth Digital Content Protection，高带宽数据内容保护技术)key，MarlinTM(一种DRM技术))key等烧录至设备key store里，而把加密这些app_key的根密钥，即设备密钥D_K烧录至设备OTP。
采用现有技术中的方案，如果在数字内容提供设备的工厂阶段某些应用的key没有准备好，没能烧录到设备里，那么出厂之后，设备就不能对这些应用实现硬件DRM保护，导致应用安全级别降低。
发明内容
本申请实施例中提供了一种在数字内容设备中在线写入应用密钥的方法、装置及系统，用于解决现有技术中未在工厂阶段写入应用密钥则不能对应用实现硬件DRM保护导致的应用安全级别降低的问题。
根据本申请实施例的第一个方面，提供了一种在数字内容设备中在线写入应用密钥的方法，包括：从服务器接收由设备公钥加密的应用密钥D_pub(app_key)，并转发给可信部件；触发可信部件读取OTP，获得预先存储的根密钥D_K，其中，根密钥是各设备唯一的；触发可信部件利用预先存储的设备私钥C_pri对加密的应用密钥D_pub(app_key)进行解密，获得应用密钥app_key；触发可信部件利用根密钥D_K加密应用密钥app_key，得到D_K(app_key)；将D_K(app_key)写入密钥存储区。
根据本申请实施例的第二个方面，提供了一种在数字内容设备中在线写入应用密钥的方法，包括：对设备进行身份认证；认证通过后，获取设备对应的设备公钥D_pub；使用D_pub加密待写入的应用密钥app_key；触发服务器将加密的应用密钥D_pub(app_key)发送至设备。
根据本申请实施例的第三个方面，提供了一种在数字内容设备中在线写入应用密钥的装置，包括：第一接收模块，用于从服务器接收由设备公钥加密的应用密钥D_pub(app_key)，并转发给可信部件；第一触发模块，用于触发可信部件读取OTP，获得预先存储的根密钥D_K，其中，根密钥是各设备唯一的；第二触发模块，用于触发可 信部件利用预先存储的设备私钥C_pri对加密的应用密钥D_pub(app_key)进行解密，获得应用密钥app_key；第三触发模块，用于触发可信部件利用根密钥D_K加密应用密钥app_key，得到D_K(app_key)；写入模块，用于将D_K(app_key)写入密钥存储区。
根据本申请实施例的第四个方面，提供了一种在数字内容设备中在线写入应用密钥的装置，包括：认证模块，用于对设备进行身份认证；公钥获取模块，用于在对设备认证通过后，获取设备对应的设备公钥D_pub；加密模块，用于使用D_pub加密待写入的应用密钥app_key；第五触发模块，用于触发服务器将加密的应用密钥D_pub(app_key)发送至设备。
根据本申请实施例的第五个方面，提供了一种数字内容设备，包括：如前述的在线写入应用密钥的装置；可信部件，用于受装置的触发读取OTP，获得预先存储的根密钥D_K，其中，根密钥是各设备唯一的；利用预先存储的设备私钥C_pri对加密的应用密钥D_pub(app_key)进行解密，获得应用密钥app_key；以及利用根密钥D_K加密应用密钥app_key，得到D_K(app_key)；OTP，用于存储根密钥D_K；密钥存储区，用于存储设备私钥C_pri和根密钥加密的应用密钥D_K(app_key)。
根据本申请实施例的第六个方面，提供了一种服务器，包括：如前述的在线写入应用密钥的装置；存储模块，用于存储待写入的应用密钥app_key；发送模块，用于受装置的触发将加密的应用密钥D_pub(app_key)发送至设备。
根据本申请实施例的第七个方面，提供了一种在数字内容设备中在线写入应用密钥的系统，包括：如前述的数字内容设备；以及如前述的服务器。
采用本申请实施例中的在数字内容设备中在线写入应用密钥的方案，在设备侧，通过触发可信部件对从服务器接收到的加密应用密钥D_pub(app_key)进行解密，然后使用设备密钥进行加密，再将由设备密钥加密的应用密钥D_K(app_key)写入密钥存储区Key store，使得设备能够在线将应用密钥写入密钥存储区，从而能够对该应用实现硬件DRM保护，避免了现有技术中未在工厂阶段写入应用密钥导致的应用不能实现硬件DRM，安全级别降低的问题，提高了设备的安全性能。
采用本申请实施例中的在数字内容设备中在线写入应用密钥的方案，在服务器侧，通过对设备进行身份证来判断设备是否可信，在认证通过后，再将加密后的应用密钥发送至设备，保证了在线写入的安全性。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1为本申请实施例一所示的在数字内容设备中在线写入应用密钥的方法流程图；
图2是根据本申请实施例二的在数字内容设备中在线写入应用密钥的方法的流程图；
图3是根据本申请实施例三的在数字内容设备中在线写入应用密钥的装置的结构示意图；
图4是根据本申请实施例四的在数字内容设备中在线写入应用密钥的装置的结构示意图；
图5是根据本申请实施例五的数字内容设备的结构示意图；
图6是根据本申请实施例六的服务器的结构示意图；
图7是根据本申请实施例七的在数字内容设备中在线写入应用密钥的系统的结构示意图；
图8是根据本申请实施例八的在数字内容设备中在线写入应用密钥的方法的流程图。
具体实施方式
为了使本申请实施例中的技术方案及优点更加清楚明白，以下结合附图对本申请的示例性实施例进行进一步详细的说明，显然，所描述的实施例仅是本申请的一部分实施例，而不是所有实施例的穷举。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
现有技术中，如果在数字内容提供设备的工厂阶段某些应用的key没有准备好，没能烧录到设备里，那么出厂之后，设备就不能对这些应用实现硬件DRM保护，导致应用安全级别降低。
另外，目前随着信息技术的发展，可能会不断出现新的应用，那么设备也不能对这些应用实现高安全级别的硬件DRM保护，同样也会导致应用安全级别降低。
本申请实施例旨在提供一种在线升级的方式，将DRM应用的key下发至设备，使设备具有硬件DRM保护的能力。
为解决上述问题，本申请实施例中提供了一种数字内容设备中在线写入应用密钥的方法、装置及系统，通过触发可信部件对从服务器接收到的加密应用密钥D_pub(app_key) 进行解密，然后使用设备密钥进行加密，再将由设备密钥加密的应用密钥D_K(app_key)写入密钥存储区Key store，使得设备能够在线将应用密钥写入密钥存储区，从而能够对该应用实现硬件DRM保护，避免了现有技术中未在工厂阶段写入应用密钥导致的应用不能实现硬件DRM，安全级别降低的问题，提高了设备的安全性能。
本申请适用于所有操作系统和支持Secure OS/Secure Processor以及OTP的硬件平台。
本申请实施例中涉及的技术方案可应用于如天猫魔盒、智能电视、电视棒等娱乐硬件产品的数字内容设备中。
图1为本申请实施例一所示的在数字内容设备中在线写入应用密钥的方法流程图。
如图1所示，根据申请实施例一所示的在数字内容设备中在线写入应用密钥的方法包括如下步骤：
S102，从服务器接收由设备公钥加密的应用密钥D_pub(app_key)，并转发给可信部件；
S104，触发可信部件读取一次性可编程硬件存储区OTP，获得预先存储的根密钥D_K，其中，根密钥是各设备唯一的；
S106，触发可信部件利用预先存储的设备私钥C_pri对加密的应用密钥D_pub(app_key)进行解密，获得应用密钥app_key；
S108，触发可信部件利用根密钥D_K加密应用密钥app_key，得到D_K(app_key)；
S110，将D_K(app_key)写入密钥存储区。
本申请实施例中的加密和解密算法可以是常用的多种加解密算法，如公钥加密算法RSA、ElGamal、Fiat-Shamir、Guillou-Quisquarter、Schnorr、Ong-Schnorr-Shamir数字签名算法、Des/DSA、椭圆曲线数字签名算法和有限自动机数字签名算法等，本申请对具体实施时的具体加解密算法不做限制。
在具体实施时，在工厂生产阶段也可以将确定的其他应用的key用Device key加密，提前存储到key store中。可以采用多种存储格式和方法对应用密钥进行存储，也可以对于不同的应用，采用不同的存储格式和方法对其app key进行存储，例如采用简单的Key-value方式或者XML(ExteileMarkuLaguage，可扩展标记性语言)文件格式，本申请对此不做限制。
在具体实施时，预先存储的根密钥D_K在本申请中可以是AES(Advanced Encryption Standard，高级加密标准)key，其长度为256bit，但也可以是其他如128bit、512bit的长 度等，长度越长，安全性越高；在根密钥是AESkey时，可信部件利用根密钥D_K加密应用密钥app_key也需采用AES算法。但是本领域技术人员应当理解，根密钥D_K也可以是其他类型的key，可信部件也可利用其他加解密算法利用根密钥D_K加密应用密钥app_key，本申请不做限制。
在具体实施时，设备需要先与后台服务器建立连接，在建立连接时，可以通过如HTTPS(HyperText Transfer Protocol，超文本传输协议)的方式，也可以是其他连接方式，本领域技术人员可以理解，能够保证设备与服务器通信的方式均包含在本申请的范围之内。
在具体实施时，可以是由设备先发起在线写入密钥的请求，然后再从服务器接收由设备公钥加密的应用密钥D_pub(app_key)，也可以直接由服务器发起请求下发由设备公钥加密的应用密钥D_pub(app_key)，本申请对此不做限制。
采用本申请实施例中的方法，通过触发可信部件对从服务器接收到的加密应用密钥D_pub(app_key)进行解密，然后使用设备密钥进行加密，再将由设备密钥加密的应用密钥D_K(app_key)写入密钥存储区Key store，使得设备能够在线将应用密钥写入密钥存储区，从而能够对该应用实现硬件DRM保护，避免了现有技术中未在工厂阶段写入应用密钥导致的应用不能实现硬件DRM，安全级别降低的问题，提高了设备的安全性能。
采用本申请实施例中的方法，由于在服务器和设备之间传输的应用密钥是经加密后的应用密钥，并且对该应用密钥进行解密加密的过程均由可信部件完成，因此保证了在线写入的安全性。
优选地，在触发可信部件读取OTP，获得预先存储的根密钥D_K之后，且在触发可信部件利用设备私钥C_pri对加密的应用密钥D_pub(app_key)进行解密之前还包括：从密钥存储区中读取预先存储的由根密钥D_K加密的设备私钥D_K(C_pri)，并将加密的设备私钥D_K(C_pri)转发给可信部件；触发可信部件利用根密钥D_K对加密的设备私钥D_K(C_pri)进行解密，获得设备私钥C_pri。
在具体实施时，为了进一步提高安全性，通常将设备私钥利用根密钥加密后存储在密钥存储区key store中，那么在触发可信部件读取OTP，获得预先存储的根密钥D_K之后，且在触发可信部件利用设备私钥C_pri对加密的应用密钥D_pub(app_key)进行解密之前需要进一步从密钥存储区中读取根密钥D_K加密的设备私钥D_K(C_pri)，并将加密的设备私钥D_K(C_pri)转发给可信部件；触发可信部件利用根密钥D_K对加密的设备私钥D_K(C_pri)进行解密，获得设备私钥C_pri。
优选地，可信部件是安全处理器或处于安全模式下的设备处理器。
在具体实施时，如果系统具有多个处理器，那么可以将独立于中央处理器CPU的另一处理器设置为安全处理器secure processor；如果系统只有一个处理器，如基于支持Trust Zone的ARM处理器，也可以将进入安全模式(“Secure World”)的CPU作为可信部件，当然，本领域技术人员应当理解，在系统具有多个处理器时，也可以将进入安全模式的CPU作为可信部件，本申请对具体的实现方式并不做限制。
在具体实施时，对于可信部件对OTP的访问控制，可以采用常用的可信计算技术进行控制，例如，只允许没有第三方代码的CPU访问OTP，只允许处于安全模式下的CPU访问OTP等。
采用本申请实施例中的方法，由于只允许可信部件访问OTP，所以提高了在线写入应用密钥的安全等级。
图2是根据本申请实施例二的在数字内容设备中在线写入应用密钥的方法的流程图。
如图2所示，根据本申请实施例二的在数字内容设备中在线写入应用密钥的方法包括步骤：
S202，对设备进行身份认证；
S204，认证通过后，获取设备对应的设备公钥D_pub；
S206，使用D_pub加密待写入的应用密钥app_key；
S208，触发服务器并将加密的应用密钥D_pub(app_key)发送至设备。
本申请实施例中的加密和解密算法可以是常用的多种加解密算法，如公钥加密算法RSA、ElGamal、Fiat-Shamir、Guillou-Quisquarter、Schnorr、Ong-Schnorr-Shamir数字签名算法、Des/DSA、椭圆曲线数字签名算法和有限自动机数字签名算法等，本申请对具体实施时的具体加解密算法不做限制。
采用本申请实施例中的方法，通过对设备进行身份证来判断设备是否可信，在认证通过后，再将加密后的应用密钥发产送至设备，保证了在线写入的安全性。
优选地，对设备进行身份认证具体包括：接收来自设备的设备证书，其中，设备证书是预先存储在所述设备中的，并且是各设备唯一的；对设备证书进行认证；获取设备对应的设备公钥D_pub具体包括：从设备证书中提取设备对应的设备公钥D_pub。
在具体实施时，除上述方式以外，还可以采用其他方式对设备的身份进行认证，例 如，设备上报设备ID、MAC地址等唯一标识至服务器，根据该唯一标识对设备进行身份认证，并在认证通过后，在服务器中查找与该设备对应的公钥，然后利用该公钥对应用密钥加密后下发至设备；本领域技术人员应当理解，本领域内能够对设备身份进行认证的方式均包括在本申请的范围之内。
采用本申请实施例中的方法，通过对设备证书来判断设备是否可信，在认证通过后，再将加密后的应用密钥发产送至设备，保证了在线写入的安全性。
基于同一发明构思，本申请实施例中还提供了一种在数字内容设备中在线写入应用密钥的装置，由于该装置解决问题的原理与本申请实施例一中在数字内容设备中在线写入应用密钥的方法相似，因此该装置的实施可以参见方法的实施，重复之处不再赘述。
图3是根据本申请实施例三的在数字内容设备中在线写入应用密钥的装置的结构示意图。
如图3所示，据本申请实施例三的在数字内容设备中在线写入应用密钥的装置300包括：第一接收模块302，用于从服务器接收由设备公钥加密的应用密钥D_pub(app_key)，并转发给可信部件；第一触发模块304，用于触发可信部件读取一次性可编程硬件存储区OTP，获得预先存储的根密钥D_K，其中，根密钥是各设备唯一的；第二触发模块306，用于触发可信部件利用预先存储的设备私钥C_pri对加密的所述应用密钥D_pub(app_key)进行解密，获得应用密钥app_key；第三触发模块308，用于触发可信部件利用根密钥D_K加密应用密钥app_key，得到D_K(app_key)；写入模块310，用于将D_K(app_key)写入密钥存储区。
在具体实施时，本申请实施例能够通过c、c++等计算机语言实现。
在具体实施时，本申请实施例中的装置可以是位于CPU上的在线升级进程。
采用本申请实施例中的装置，通过触发可信部件对从服务器接收到的加密应用密钥D_pub(app_key)进行解密，然后使用设备密钥进行加密，再将由设备密钥加密的应用密钥D_K(app_key)写入密钥存储区Key store，使得设备能够在线将应用密钥写入密钥存储区，从而能够对该应用实现硬件DRM保护，避免了现有技术中未在工厂阶段写入应用密钥导致的应用不能实现硬件DRM，安全级别降低的问题，提高了设备的安全性能。
采用本申请实施例中的装置，由于在服务器和设备之间传输的应用密钥是经加密后的应用密钥，并且对该应用密钥进行解密加密的过程均由可信部件完成，因此保证了在线写入的安全性。
优选地，本申请实施例中的装置还包括：读取模块，用于从密钥存储区中读取预先存储的由根密钥D_K加密的设备私钥D_K(C_pri)，并将加密的设备私钥D_K(C_pri)转发给可信部件；第四触发模块，用于触发可信部件利用根密钥D_K对加密的所述设备私钥D_K(C_pri)进行解密，获得所述设备私钥C_pri。
在具体实施时，为了进一步提高安全性，通常将设备私钥利用根密钥加密后存储在密钥存储区key store中，因此，需要先从从密钥存储区中读取预先存储的由根密钥D_K加密的设备私钥D_K(C_pri)并交给可信设备解密以获得设备私钥。
优选地，可信部件是安全处理器或处于安全模式下的设备处理器。
采用本申请实施例中的装置，由于只允许可信部件访问OTP，所以提高了在线写入应用密钥的安全等级。
基于同一发明构思，本申请实施例中还提供了一种在数字内容设备中在线写入应用密钥的装置，由于该装置解决问题的原理与本申请实施例二中在数字内容设备中在线写入应用密钥的方法相似，因此该装置的实施可以参见方法的实施，重复之处不再赘述。
图4是根据本申请实施例四的在数字内容设备中在线写入应用密钥的装置的结构示意图。
如图4所示，据本申请实施例四的在数字内容设备中在线写入应用密钥的装置400包括：认证模块402，用于对设备进行身份认证；公钥获取模块404，用于在对设备认证通过后，获取设备对应的设备公钥D_pub；加密模块406，用于使用D_pub加密待写入的应用密钥app_key；第五触发模块408，用于触发服务器将加密的应用密钥D_pub(app_key)发送至设备。
采用本申请实施例中的装置，通过预先对设备进行身份认证以判断设备是否可信，在认证通过后，再将加密后的应用密钥发产送至设备，保证了在线写入的安全性。
优选地，认证模块具体包括：接收子模块，用于接收来自设备的设备证书，其中，设备证书是预先存储在所述设备中的，并且是各设备唯一的；认证子模块，用于对设备证书进行认证；公钥获取模块具体用于从设备证书中提取设备对应的设备公钥D_pub。
采用本申请实施例中的装置，通过设备证书来判断设备是否可信，在认证通过后，再将加密后的应用密钥发产送至设备，保证了在线写入的安全性。
图5是根据本申请实施例五的数字内容设备的结构示意图。
如图5所示，据本申请实施例五的数字内容设备50包括：在线写入应用密钥的装置300；可信部件502，用于受装置300的触发读取OTP 504，获得预先存储的根密钥D_K，其中，根密钥是各设备唯一的；利用预先存储的设备私钥C_pri对加密的应用密钥D_pub(app_key)进行解密，获得应用密钥app_key；以及利用根密钥D_K加密应用密钥app_key，得到D_K(app_key)；OTP 504，用于存储根密钥D_K；密钥存储区506，用于存储设备私钥C_pri和根密钥加密的应用密钥D_K(app_key)。
采用本申请实施例中的数字内容设备，通过可信部件对从服务器接收到的加密应用密钥D_pub(app_key)进行解密，然后使用设备密钥进行加密，再将由设备密钥加密的应用密钥D_K(app_key)写入密钥存储区Key store，使得设备能够在线将应用密钥写入密钥存储区，从而能够对该应用实现硬件DRM保护，避免了现有技术中未在工厂阶段写入应用密钥导致的应用不能实现硬件DRM，安全级别降低的问题，提高了设备的安全性能。
采用本申请实施例中的数字内容设备，由于在服务器和设备之间传输的应用密钥是经加密后的应用密钥，并且对该应用密钥进行解密加密的过程均由可信部件完成，因此保证了在线写入的安全性。
优选地，密钥存储区存储的设备私钥是根密钥D_K加密的设备私钥D_K(C_pri)。
将设备私钥利用根密钥加密后存储在密钥存储区key store中能够进一步提高安全性。
优选地，密钥存储区还用于存储设备证书，其中，设备证书是各设备唯一的。
在具体实施时，密钥存储区中存储的通常也是根密钥D_K加密的设备证书。该设备证书用于向服务器证明所述设备是可信设备。
采用本申请实施例中的设备，通过利用设备证书来证明设备的身份，保证了在线写入的安全性。
图6是根据本申请实施例六的服务器的结构示意图。
如图6所示，据本申请实施例六的服务器60包括：如在线写入应用密钥的装置400；存储模块602，用于存储待写入的应用密钥app_key；发送模块604，用于受装置的触发将加密的应用密钥D_pub(app_key)发送至设备。
采用本申请实施例中的服务器，通过预先对设备进行身份认证以判断设备是否可信，在认证通过后，再将加密后的应用密钥发产送至设备，保证了在线写入的安全性。
采用本申请实施例中的装置，通过设备证书来判断设备是否可信，在认证通过后， 再将加密后的应用密钥发产送至设备，保证了在线写入的安全性。
基于同一发明构思，本申请实施例中还提供了一种数字内容设备中在线写入应用密钥的系统，由于该系统解决问题的原理与本申请实施例中在数字内容设备中在线写入应用密钥的方法相似，因此该系统的实施可以参见方法的实施，重复之处不再赘述。
图7是根据本申请实施例七的在数字内容设备中在线写入应用密钥的系统的结构示意图。
如图7所示，据本申请实施例七的在数字内容设备中在线写入应用密钥的系统70包括：数字内容设备50；以及服务器60。
采用本申请实施例中的在数字内容设备中在线写入应用密钥的系统，通过服务器对设备身份进行认证，并在认证通过后将加密应用密钥下发至设备，然后由可信部件对加密应用密钥D_pub(app_key)进行解密，再使用设备密钥进行加密，再将由设备密钥加密的应用密钥D_K(app_key)写入密钥存储区Key store，使得设备能够在线将应用密钥写入密钥存储区，从而能够对该应用实现硬件DRM保护，避免了现有技术中未在工厂阶段写入应用密钥导致的应用不能实现硬件DRM，安全级别降低的问题，提高了设备的安全性能。
图8是根据本申请实施例八的在数字内容设备中在线写入应用密钥的方法的流程图。
如图8所示，本申请实施例八的在数字内容设备中在线写入应用密钥的方法包括以下步骤：
1、在设备出厂前，工作站将设备密钥Device key烧录至设备OTP；
2、工作站将被Device key加密的设备证书D_K(D_Cert)和证书私钥D_K(C_Priv)烧录至key store；
3、在设备需要进行在线写入密钥时，设备CPU上的在线服务进程Online Key service通过HTTPS的方式和后台服务器建立连接，向服务器提交Device certification(D_Cert)；
4、服务器校验证书后，用其public key(D_pub)把要下发的app_key加密，并下发到设备中；
5、Online Key service拿到这个D_Pub(app_key)之后，会把它交给Secure OS(或Secure processor)；
6、Secure OS(或Secure processor)通过读OTP相应的数据，获得D_K；
7、Online key service从key store中读取加密过的D_K(C_Priv)；
8、然后Online key service把D_K(C_Priv)传给Secure OS；Secure OS用D_K解密D_K(C_pri)，得到C_Priv；
9、Secure OS(或Secure processor)用C_Priv通过RSA算法从D_Pub(app_key)中解出app_key，再用Device key(D_K)把app_key加密得到D_K(app_key)，并把D_K(app_key)传回给Online key service；
10、Online key service拿到D_K(app_key)后，存储在key store中。
采用本申请实施例中的在数字内容设备中在线写入应用密钥的系统，通过服务器对设备身份进行认证，并在认证通过后将加密应用密钥下发至设备，然后由可信部件对加密应用密钥D_pub(app_key)进行解密，再使用设备密钥进行加密，再将由设备密钥加密的应用密钥D_K(app_key)写入密钥存储区Key store，使得设备能够在线将应用密钥写入密钥存储区，从而能够对该应用实现硬件DRM保护，避免了现有技术中未在工厂阶段写入应用密钥导致的应用不能实现硬件DRM，安全级别降低的问题，提高了设备的安全性能。
本领域技术人员应当理解，为了描述的方便，以上所述装置的各部分以功能分为各种部件或单元分别描述。当然，在实施本申请时可以把各部件或单元的功能在同一个或多个软件或硬件中实现。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指 定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本申请的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本申请范围的所有变更和修改。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (15)

  1. 一种在数字内容设备中在线写入应用密钥的方法，其特征在于，包括：
    从服务器接收由设备公钥加密的应用密钥D_pub(app_key)，并转发给可信部件；
    触发所述可信部件读取一次性可编程硬件存储区OTP，获得预先存储的根密钥D_K，其中，所述根密钥是各设备唯一的；
    触发所述可信部件利用预先存储的设备私钥C_pri对加密的所述应用密钥D_pub(app_key)进行解密，获得所述应用密钥app_key；
    触发所述可信部件利用所述根密钥D_K加密所述应用密钥app_key，得到D_K(app_key)；
    将所述D_K(app_key)写入密钥存储区。
  2. 根据权利要求1所述的方法，其特征在于，在触发所述可信部件读取一次性可编程硬件存储区OTP，获得预先存储的根密钥D_K之后，且在触发所述可信部件利用设备私钥C_pri对加密的所述应用密钥D_pub(app_key)进行解密之前还包括：
    从密钥存储区中读取预先存储的由根密钥D_K加密的设备私钥D_K(C_pri)，并将加密的所述设备私钥D_K(C_pri)转发给所述可信部件；
    触发所述可信部件利用所述根密钥D_K对加密的所述设备私钥D_K(C_pri)进行解密，获得所述设备私钥C_pri。
  3. 根据权利要求1所述的方法，其特征在于，所述可信部件是安全处理器或处于安全模式下的设备处理器。
  4. 一种在数字内容设备中在线写入应用密钥的方法，其特征在于，包括：
    对所述设备进行身份认证；
    认证通过后，获取所述设备对应的设备公钥D_pub；
    使用D_pub加密待写入的应用密钥app_key；
    触发服务器将加密的所述应用密钥D_pub(app_key)发送至所述设备。
  5. 根据权利要求4所述的方法，其特征在于，
    对所述设备进行身份认证具体包括：
    接收来自所述设备的设备证书，其中，所述设备证书是预先存储在所述设备中的，并且是各设备唯一的；
    对所述设备证书进行认证；
    获取所述设备对应的设备公钥D_pub具体包括：
    从所述设备证书中提取所述设备对应的设备公钥D_pub。
  6. 一种在数字内容设备中在线写入应用密钥的装置，其特征在于，包括：
    第一接收模块，用于从所述服务器接收由设备公钥加密的应用密钥D_pub(app_key)，并转发给可信部件；
    第一触发模块，用于触发所述可信部件读取一次性可编程硬件存储区OTP，获得预先存储的根密钥D_K，其中，所述根密钥是各设备唯一的；
    第二触发模块，用于触发所述可信部件利用预先存储的设备私钥C_pri对加密的所述应用密钥D_pub(app_key)进行解密，获得所述应用密钥app_key；
    第三触发模块，用于触发所述可信部件利用所述根密钥D_K加密所述应用密钥app_key，得到D_K(app_key)；
    写入模块，用于将所述D_K(app_key)写入密钥存储区。
  7. 根据权利要求6所述的装置，其特征在于，还包括：
    读取模块，用于从密钥存储区中读取预先存储的由根密钥D_K加密的设备私钥D_K(C_pri)，并将加密的所述设备私钥D_K(C_pri)转发给所述可信部件；
    第四触发模块，用于触发所述可信部件利用所述根密钥D_K对加密的所述设备私钥D_K(C_pri)进行解密，获得所述设备私钥C_pri。
  8. 根据权利要求6所述的装置，其特征在于，所述可信部件是安全处理器或处于安全模式下的设备处理器。
  9. 一种在数字内容设备中在线写入应用密钥的装置，其特征在于，包括：
    认证模块，用于对所述设备进行身份认证；
    公钥获取模块，用于在对所述设备认证通过后，获取所述设备对应的设备公钥D_pub；
    加密模块，用于使用D_pub加密待写入的应用密钥app_key；
    第五触发模块，用于触发服务器将加密的所述应用密钥D_pub(app_key)发送至所述设备。
  10. 根据权利要求9所述的装置，其特征在于，所述认证模块具体包括：
    接收子模块，用于接收来自所述设备的设备证书，其中，所述设备证书是预先存储在所述设备中的，并且是各设备唯一的；
    认证子模块，用于对所述设备证书进行认证；
    所述公钥获取模块具体用于从所述设备证书中提取所述设备对应的设备公钥 D_pub。
  11. 一种数字内容设备，其特征在于，包括：
    如权利要求6-8中任一项所述的在线写入应用密钥的装置；
    可信部件，用于受所述装置的触发读取OTP，获得预先存储的根密钥D_K，其中，所述根密钥是各设备唯一的；利用预先存储的设备私钥C_pri对加密的所述应用密钥D_pub(app_key)进行解密，获得所述应用密钥app_key；以及利用所述根密钥D_K加密所述应用密钥app_key，得到D_K(app_key)；
    所述OTP，用于存储根密钥D_K；
    密钥存储区，用于存储设备私钥C_pri和根密钥加密的应用密钥D_K(app_key)。
  12. 根据权利要求11所述的设备，其特征在于，所述密钥存储区存储的设备私钥是根密钥D_K加密的设备私钥D_K(C_pri)。
  13. 根据权利要求11所述的设备，其特征在于，所述密钥存储区还用于存储设备证书，其中，所述设备证书是各设备唯一的。
  14. 一种服务器，其特征在于，包括：
    如权利要求9或10所述的在线写入应用密钥的装置；
    存储模块，用于存储待写入的应用密钥app_key；
    发送模块，用于受所述装置的触发将加密的所述应用密钥D_pub(app_key)发送至所述设备。
  15. 一种在数字内容设备中在线写入应用密钥的系统，其特征在于，包括：
    如权利要求11中的数字内容设备；以及
    如权利要求14所述服务器。
PCT/CN2016/076028 2015-03-19 2016-03-10 在数字内容设备中在线写入应用密钥的方法、装置及系统 WO2016146013A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510122933.2A CN106033503A (zh) 2015-03-19 2015-03-19 在数字内容设备中在线写入应用密钥的方法、装置及系统
CN201510122933.2 2015-03-19

Publications (1)

Publication Number Publication Date
WO2016146013A1 true WO2016146013A1 (zh) 2016-09-22

Family

ID=56918336

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/076028 WO2016146013A1 (zh) 2015-03-19 2016-03-10 在数字内容设备中在线写入应用密钥的方法、装置及系统

Country Status (2)

Country Link
CN (1) CN106033503A (zh)
WO (1) WO2016146013A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110209404A (zh) * 2019-06-03 2019-09-06 深兰科技（上海）有限公司 一种序列号烧录方法及终端设备
CN110659036A (zh) * 2019-08-26 2020-01-07 深圳市亿道数码技术有限公司 一种Windows系统中自动烧录谷歌key的方法及系统
CN111405366A (zh) * 2020-03-09 2020-07-10 深圳创维－Rgb电子有限公司 key文件的合成方法、装置及计算机可读存储介质
CN114499851A (zh) * 2022-01-30 2022-05-13 重庆长安汽车股份有限公司 一种基于端云一体化实现安全灌装根密钥的方法
TWI808160B (zh) * 2018-04-24 2023-07-11 美商品譜公司 包含電子鎖之物聯網裝置之安全佈建

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109905233B (zh) * 2017-12-08 2022-07-29 阿里巴巴集团控股有限公司 一种设备数据处理方法及系统
CN107992760B (zh) * 2017-12-08 2021-08-13 深圳小湃科技有限公司 秘钥写入方法、装置、设备及存储介质
CN108155986A (zh) * 2017-12-14 2018-06-12 晶晨半导体(上海)股份有限公司 一种基于可信执行环境的密钥烧录系统及方法
CN109039609A (zh) * 2018-08-24 2018-12-18 深圳美图创新科技有限公司 密钥导入终端的方法及终端
US11184170B2 (en) * 2019-06-28 2021-11-23 Micron Technology, Inc. Public key protection techniques
EP4016921A4 (en) * 2019-08-19 2022-08-24 Huawei Technologies Co., Ltd. CERTIFICATE MANAGEMENT METHOD AND APPARATUS
CN110401677B (zh) * 2019-08-23 2022-05-17 RealMe重庆移动通信有限公司 数字版权密钥的获取方法、装置、存储介质及电子设备
CN110932853B (zh) * 2019-12-06 2022-12-06 深圳市纽创信安科技开发有限公司 一种基于可信模块的密钥管理装置和密钥管理方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060188099A1 (en) * 2005-02-21 2006-08-24 Kabushiki Kaisha Toshiba Key management system and method for the same
CN101174942A (zh) * 2006-10-31 2008-05-07 华为技术有限公司 一种实现密钥保护的方法及系统
CN101542968A (zh) * 2007-08-28 2009-09-23 松下电器产业株式会社 密钥终端装置、加密处理用lsi、固有密钥生成方法和内容系统
CN102394749A (zh) * 2011-09-26 2012-03-28 深圳市文鼎创数据科技有限公司 数据传输的线路保护方法、系统、信息安全设备及应用设备

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1697374A (zh) * 2004-05-13 2005-11-16 华为技术有限公司 密钥数据收发方法及其密钥数据分发装置和接收装置
US9069990B2 (en) * 2007-11-28 2015-06-30 Nvidia Corporation Secure information storage system and method
CN101887754A (zh) * 2010-06-29 2010-11-17 深圳创维－Rgb电子有限公司 一种HDCP Key烧录的方法、装置及数码设备
CN102123028A (zh) * 2011-02-28 2011-07-13 成都四方信息技术有限公司 一种随机密钥生成工作方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060188099A1 (en) * 2005-02-21 2006-08-24 Kabushiki Kaisha Toshiba Key management system and method for the same
CN101174942A (zh) * 2006-10-31 2008-05-07 华为技术有限公司 一种实现密钥保护的方法及系统
CN101542968A (zh) * 2007-08-28 2009-09-23 松下电器产业株式会社 密钥终端装置、加密处理用lsi、固有密钥生成方法和内容系统
CN102394749A (zh) * 2011-09-26 2012-03-28 深圳市文鼎创数据科技有限公司 数据传输的线路保护方法、系统、信息安全设备及应用设备

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
TWI808160B (zh) * 2018-04-24 2023-07-11 美商品譜公司 包含電子鎖之物聯網裝置之安全佈建
CN110209404A (zh) * 2019-06-03 2019-09-06 深兰科技（上海）有限公司 一种序列号烧录方法及终端设备
CN110209404B (zh) * 2019-06-03 2023-07-14 深兰科技（上海）有限公司 一种序列号烧录方法及终端设备
CN110659036A (zh) * 2019-08-26 2020-01-07 深圳市亿道数码技术有限公司 一种Windows系统中自动烧录谷歌key的方法及系统
CN111405366A (zh) * 2020-03-09 2020-07-10 深圳创维－Rgb电子有限公司 key文件的合成方法、装置及计算机可读存储介质
CN111405366B (zh) * 2020-03-09 2022-09-16 深圳创维－Rgb电子有限公司 key文件的合成方法、装置及计算机可读存储介质
CN114499851A (zh) * 2022-01-30 2022-05-13 重庆长安汽车股份有限公司 一种基于端云一体化实现安全灌装根密钥的方法
CN114499851B (zh) * 2022-01-30 2023-05-26 重庆长安汽车股份有限公司 一种基于端云一体化实现安全灌装根密钥的方法

Also Published As

Publication number Publication date
CN106033503A (zh) 2016-10-19

Similar Documents

Publication Publication Date Title
WO2016146013A1 (zh) 在数字内容设备中在线写入应用密钥的方法、装置及系统
US10462114B2 (en) System and associated software for providing advanced data protections in a defense-in-depth system by integrating multi-factor authentication with cryptographic offloading
KR102443857B1 (ko) 암호화키를 사용한 신뢰 실행 환경의 어드레싱 기법
US8838961B2 (en) Security credential deployment in cloud environment
US11469885B2 (en) Remote grant of access to locked data storage device
WO2020192406A1 (zh) 数据存储、验证方法及装置
US8863255B2 (en) Security credential deployment in cloud environment
US9490982B2 (en) Method and storage device for protecting content
WO2017041603A1 (zh) 数据加密方法、装置及移动终端、计算机存储介质
US20130268749A1 (en) Digital rights management system and methods for provisioning content to an intelligent storage
TW201707468A (zh) 基於可信執行環境的業務處理方法和用戶端
TW201530344A (zh) 應用程式存取保護方法及應用程式存取保護裝置
US11468177B2 (en) Apparatus and method for encrypting data in a data storage system
US11831752B2 (en) Initializing a data storage device with a manager device
WO2022251987A1 (zh) 一种数据加解密方法和装置
US11531626B2 (en) System and method to protect digital content on external storage
US11334677B2 (en) Multi-role unlocking of a data storage device
WO2019237304A1 (zh) 一种密钥处理方法及装置
US11366933B2 (en) Multi-device unlocking of a data storage device
US20230289456A1 (en) Certificates in data storage devices
US20230291548A1 (en) Authorization requests from a data storage device to multiple manager devices
WO2017067513A1 (zh) 数据处理方法及存储网关
BR102015011937A2 (pt) agente para fornecer serviço de segurança na nuvem e dispositivo token de segurança para serviço de segurança na nuvem
WO2019120231A1 (zh) 确定tpm可信状态的方法、装置及存储介质
US11216571B2 (en) Credentialed encryption

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16764194

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16764194

Country of ref document: EP

Kind code of ref document: A1