CN1914679A - Device and method for authorizing a user to get access to content stored in encrypted form on a storage medium - Google Patents

Abstract

The present invention relates to a device and a method for authorizing a user to get access to content stored in encrypted form on a storage medium(10), said storage medium storing a machine-readable medium identifier(id) and at least one key table(KL) encrypted by use of a key table key(KLK) and storing at least one asset key(AK) for decrypting encrypted content(C). In order to allow a user to provide access to the content to other users in a simple but secure way, a device is proposed comprising: - a connection means(6) for connecting said device to a network(3), - a drive(5) for accessing said storage medium(10), in particular for reading content(C) and said medium identifier(id) from said storage medium(l0), and - a transmitter(7) for transmitting said medium identifier(id) and a user identifier(ui) of a user, who shall be authorized to get access to said content(C) and who is identified to said network(3) by said user indentifier(ui), to an authentication unit(AuC) within said network(3), said medium identifier(id) and said user identifier(ui) being used by said authentication unit(AuC) for generating a key table key(KLK) for said user enabling said user to decrypt at least one predetermined key table(KL).

Description

Apparatus and method for an authorized user to gain access to content stored in encrypted form on a storage medium

The present invention relates to a device and corresponding method for authorizing a user to gain access to content stored in encrypted form on a storage medium storing a machine-readable medium identifier and at least one A keytab key-encrypted keytab and stores at least one asset key for decrypting encrypted content. The invention further relates to a network in which the method is applied and a computer program for implementing the method.

European patent application 02078437.7 (PHNL020775) describes a method of protecting content stored on a storage medium accessible by a drive of a portable device connectable to a network against unauthorized access. In order to provide a high level of protection against unauthorized access, the authentication process of the network is used to generate an encryption key - hereinafter referred to as asset key, for the encryption and decryption of the content stored on the storage medium . In particular, the application describes the use of this method in mobile telephony networks where the authentication key is stored in the SIM card used by the mobile phone. Therefore, the main idea is that the storage medium contains a unique medium identifier, and the mobile communication network authentication process is used to convert this medium identifier into an actual asset key. This conversion is performed by the user's SIM card when used in the mobile phone network, therefore, without this SIM card, the content of the storage medium cannot be read. This provides a simple and secure method for users to protect their private content, hereafter also referred to as the SIM encryption method.

A disadvantage of this approach is that access to content is limited to a single user, and more specifically, to a single user's SIM card. It is therefore an object of the present invention to provide a device and method which allow a user to provide other users with access to content in a simple and secure manner. Furthermore, it will also enable transparent access from different devices owned by the same user, for example from different mobile phones with different SIM cards. A corresponding network and computer program for implementing the method will also be provided.

According to the invention, this object is achieved by a device as claimed in claim 1, which device comprises:

- connecting means for connecting said device to a network;

- a drive for accessing said storage medium, in particular for reading content and said medium identifier from said storage medium; and

- a sender for sending said medium identifier and a user identifier of a user to an authentication unit within said network, the user will be authorized to gain access to said content and said network is via said a user identifier identifying the user, said medium identifier and said user identifier being used by said authentication unit to generate a keytab key for said user enabling said user to decrypt at least one predetermined key surface.

A corresponding method is defined in claim 9 . In claim 11 a computer program for implementing said method is defined. A network in which the invention is applied is defined in claim 10, the network comprising:

- a first user device for authorizing a second user device of a user to obtain access to content stored in encrypted form on a storage medium storing a machine-readable medium identifier and at least one A key table encrypted by a key table key and storing at least one asset key for decrypting encrypted content, the first user equipment includes:

- connecting means for connecting said device to a network;

- a drive for accessing said storage medium, in particular for reading content and said medium identifier from said storage medium; and

- a sender for sending said medium identifier and a user identifier of a user to an authentication unit within said network, the user will be authorized to gain access to said content and said network is via said a user identifier identifying the user;

- Verification unit, comprising:

- a receiver for receiving said medium identifier and said user identifier;

- key generating means for generating a key table key for said user using said medium identifier and said user identifier, said key table key enabling said user to decrypt said at least one encryption key table; and

- a sender for sending said key table key to said first and/or said second user equipment; and

- A second user device of a user to be authorized to gain access to content stored in encrypted form on a storage medium, comprising:

- connecting means for connecting said device to said network;

- a receiver for receiving said keytab key from said verification unit or from said first user equipment;

- A drive for accessing said storage medium, in particular for reading content from said storage medium, and decrypting at least one predetermined keytab with the received keytab key.

The invention is based on the idea that, using a network authentication process, a user who has access to content stored on a storage medium can authorize other users to gain access to the same content. Using the medium identifier and the user identifier of the user to be authorized, the authentication unit of the network generates and provides a keytab key. This key table key can then be used by the user to be authorized to decrypt an assigned and predetermined key table provided for the "new" user, in which is stored a The asset key to decrypt the content to which access is granted. This way, "new" users can be added to the authorized list without their direct intervention. This method is simple to implement yet provides a high level of security because the keytab keys are generated using the network's very secure authentication process to allow access to the keytab and thus to the keys used to decrypt the content. asset key.

The proposed network according to the invention, preferably a communication network such as a GSM or UMTS network, comprises at least two user equipments, which may all belong to the same users, or can belong to different users. The authentication process used to authenticate the user is very secure because breaking the authentication algorithm in the mobile communication network will allow the user to make calls paid by other users. Therefore, the protection level of such an authentication algorithm is very high, which is considered sufficient to protect the user's data when it is used to generate the keytab keys proposed according to the present invention. Furthermore, said verification unit is also used to generate an asset key as described in the above-mentioned European patent application 02 078 437.7 (PHNL020775). The description of this method in that document is incorporated herein by reference.

Preferred embodiments of the invention are defined in the dependent claims. According to one embodiment, the device further comprises a receiver for receiving a keytab key from the network for a user to be authorized, and a transmitter operable to send the received keytab key to said user . Thus, a user who wants to authorize another user to have access to content communicates with the network to obtain a new keytab key for the other user, which user then receives the keytab key and converts it, e.g. forwarded to said other user by SMS or any other form of electronic message. The user to be authorized is thus not involved in the generation of the new keytab key.

According to another embodiment, the user to be authorized can also be provided with a new keytab key directly from the network. To identify this user, the network may use the user identifier for generating the keytab key that has been provided by the first user to the authentication unit together with a medium identifier.

According to another embodiment, the storage means not only store a single key table, but also store multiple key tables, eg one key table for each user. Furthermore, each key table may be assigned a user check identifier which the device checks prior to decryption to find the correct key table assigned to said user. This avoids having to decrypt multiple (or even all) keytabs to find the correct keytab for the user. The user check identifier may for example be the same as the user identifier which identifies the user to the network, e.g. when applied in a mobile communication network, the user check identifier is said user's International Mobile Subscriber Identity (IMSI) or phone number.

If it is necessary to hide the user's identity, this user check identifier can also be encrypted (for example in a very simple manner by an XOR function with the user's keytab key). This in turn means that this encrypted user check identifier needs to be decrypted, especially for multiple or all tables. However, this operation is very simple and not too time-consuming. Since each user check identifier is encrypted with a different key (a different user's keytab key), it is not easy to identify potential user check identifiers, so even with a simple algorithm such as using the symbolic XOR function, It is also safe enough.

In order to see whether the correct key table has been decrypted and whether the decryption was performed correctly, each key table may further contain a decryption check identifier proposed according to the invention. For said checking, a suitable decryption checking device can be provided in the user equipment. Additionally, some randomly generated padding fields can be provided to make hacking more difficult. In a preferred embodiment, the user check identifier is also used as the decryption check identifier, e.g. once externally unencrypted to authenticate that the user belongs to the keytab, and twice inside the keytab (i.e. encrypted) to check that the decryption was correct.

In a simple embodiment, only one keytab is provided on the storage medium, and a first user who wants to authorize a second user provides his own keytab key to the second user, enabling him to decrypt the same key table. Alternatively, each user may be provided with a separate keytab on the storage medium, each encrypted with a different keytab key. In order to generate such a key table, suitable key table generating means are provided according to another embodiment. The first user thus encrypts the asset key (which allows the decryption of content to which other users will gain access) with a keytab key and thus generates a keytab which is then used by said The access means are stored on a storage medium.

Therefore, according to a preferred aspect of the present invention, each item of content is encrypted with its own asset key, which can be any random key; these asset keys are stored in a key table. The first user obtains his keytab key with known SIM encryption methods (eg with his SIM card), which is the key used to encrypt the keytab. Encrypted asset keys and keytabs are stored on media. If the first user wishes to access the asset key, he needs to use the SIM encryption method again to obtain his keytab key. Other users obtain other keys with SIM encryption because their SIMs are different. If the first user wants the second user to have access to the content, the first user encrypts the key table with the asset key in the second user's SIM derived key (SIM derived key). A second encrypted keytab is now stored on the media instead of the SIM-derived key itself.

Preferably, as described above, the invention is applied to a mobile communication network and the user equipment is a mobile phone. The authentication algorithm used to authenticate the mobile communication device to the network is then employed to generate a keytab key and preferably an asset key (actually any random key will do) as well.

When the network is a mobile communication network, the authentication unit of the home location register (HLR-home location register) of the user to be authorized is used to generate a key table key for said user in order to transmit the medium identifier to the authentication unit and user identifier. Also a secure channel may be implemented for transferring the generated keytab keys to the user equipment. Preferably, an authentication process is also used to generate keys for the secure channel in a similar manner to the generation of keytab keys.

Preferably, the mobile network operator also provides the above process in the form of a service. Users from different networks can also be authorized in the same way that the network treats roaming users. Furthermore, by providing this service but not supporting users from other networks, the network can also encourage users of different networks to subscribe to this network.

Description of drawings

The invention will now be explained in more detail with reference to the following drawings:

Figure 1 shows an embodiment of a record carrier according to the invention;

Figure 2 shows an embodiment of a network according to the invention;

Figure 3 represents a flow chart of the method according to the invention;

Figure 4 shows an embodiment of a user equipment according to the invention.

Detailed ways

Figure 1 shows a storage medium 10 according to the invention and shows what is stored on such a record carrier. For the purposes of the following description it is assumed that a particular user of a first user device has access to content stored in encrypted form on a record carrier 10, for example an optical record carrier such as a CD, DVD or BD, which is a user Device readable, the user device may for example be a portable mobile phone having a drive for accessing the record carrier 10 . It is further assumed that the record carrier 10 stores, in addition to storing encrypted content, a machine-readable medium identifier id and at least one key table KL which is encrypted using a key table key KLK and which stores at least An asset key AK. The asset key AK has been used to encrypt the content C and is therefore required for the user to decrypt the encrypted content C.

It is also possible for more than one key table KL to be stored on the record carrier 10, in particular one key table KL for each individual user, and each key table KL can be stored by a different key table key KLK encryption. Furthermore, each key table KL may store more than one asset key AK for decrypting different parts of the content C stored on the record carrier 10 . Furthermore, each key table may be assigned a user check identifier UC for finding the correct key table KL, and/or each key table may contain a user check identifier UC for checking whether a key table KL has been corrected. The decryption check identifier DC which is deciphered directly, these two identifiers will be explained in more detail below.

Figure 2 shows an embodiment of a network according to the invention, illustrating the general utility of the invention. FIG. 3 shows the steps of the method according to the invention in the form of a flowchart. In the network shown in FIG. 2, a mobile telephone network, in particular a GSM network 3, is shown as an example, to which two user equipments 1, 2 of two mobile telephones can be connected here and can communicate via Networks communicate with each other and with other users. The mobile phones 1 , 2 each contain a SIM card reader 4 for reading a SIM card 20 . An authentication key is stored on the SIM card 20 , which is a secret key shared with the authentication center AuC of the GSM network 3 for authenticating the mobile phone 1 , 2 when it is connected to the network 3 . The mobile phone 1, 2 further comprises a drive 5 for reading data and/or storing data on a removable storage medium 10, for example a compact disc drive. The user equipment 1, 2 further comprises connection means 6 for connecting to the network 3, comprising a transmitter 7 for sending data and a receiver 8 for receiving data.

As described in the above-mentioned European patent application 02 078 437.7 (PHNL020775), the mobile communication network authentication process is used to assign a unique identifier of the record carrier 10 (such as a serial number stored in a specific area on the record carrier 10) into an asset key AK for encrypting the content C (or part of the content C) stored on the record carrier 10 . This conversion is performed by the SIM card 2, or by the authentication center AuC, so that the content cannot be decrypted and read without this SIM card. This provides an easy and secure way for users to protect their private content. If the user now wishes to allow other users to access his content or transparently from other devices he owns, follow the procedure below.

In a first step S1 a unique identifier id is read from the record carrier. Then (S2), this medium identifier id and the user identifier ui of a second user who will be authorized by the first user to gain access to a specific part of the first user's content are sent to the authentication center AuC of the network 3 . Wherein (S3), a key table key KLK is generated from the medium identifier id and the user identifier ui by a key generator 31, for example in the case of key table in the form of key locks (key lockers) , the key table key KLK is a key locker key (key lockerkey). Then, the generated key table key KLK can be sent back to the first user equipment 1 only (S4), or to both the first user equipment 1 and the second user equipment 2 (S8).

In the first case, the first user equipment 1 now generates a key table KL2 for the second user equipment 2 by using the received key table key KLK (S5), i.e. the key table to be given to the second user for Asset keys to access content encrypted by the keytab key KLK. The second user 2 is then authorized to obtain this key table key KLK for decrypting the newly generated key table KL2 from the first user (S6). By using the key table key KLK, he can decrypt the key table KL2, read the asset key from it, and use the asset key to decrypt the content. In this way, user 2 is added to the authorization list without direct intervention.

In the second case, the key table key KLK is also passed directly to the second user (S8), the first user device 1 now also generates a Key table KL2 (S9) (same as step S5). However, the second user 2 can directly decrypt the new key table KL2 immediately thereafter by using this key table key KLK (S10).

A further possibility is that a second user has a record carrier to which he has no access rights. But it can ask users who have access rights to give him access rights through the network. Thus, a first user may provide his keytab key to a second user over the network, thereby authorizing the second user to access his own keytab by using the same keytab key. In this case it is sufficient to have a single key table stored on the record carrier which is used by all users authorized by the first user 1 .

As mentioned above, each key table KL preferably also contains a decryption check identifier DC (cf. FIG. 1 ) for indicating that the decryption of the key table was correct. To check this, the user equipment comprises a decryption checking unit 9 - as shown in the embodiment of the user equipment 1 shown in Fig. 4 . In addition, the keytab can also include some randomly generated padding fields to make hacking more difficult. When a user tries to access the record carrier, SIM mapping should be used to convert the unique identifier ui into an asset key, which is a potential key for decrypting a key table. This latent key is used to decrypt the key table present on the record carrier, yielding an actual asset key. However, if the user is not authorized, his SIM will generate a keytab key, however this keytab key does not decrypt any keytab correctly, as can be easily seen from the decryption check identifier .

Preferably, as mentioned above, the key table is a key lock to be able to store different rights for each user and to hide certain content from some users. The keytabs can also be all (for each user) in one key lock. The key lock key is then a hidden key on the record carrier.

Furthermore, as also shown in the embodiment of Fig. 4, the user equipment may comprise a user checking unit 11 for checking a corresponding user checking identifier uc, preferably stored on the record carrier and assigned to each key table. . The user check identifier uc is used to find the correct key table for a user, thus avoiding the need to decrypt every available key table in order to find the correct key table. For example, the user's SIM card contains an identifier that identifies the user to the mobile network, known in GSM as the International Mobile Subscriber Identity (IMSI), which can be utilized. Alternatively, the user's phone number can be used. Furthermore, this user check identifier uc can also be encrypted in a very simple manner (eg XOR with a key) if it is desired to hide the user identity. This means that each user check identifier needs to be decrypted again by a simpler XOR operation. Since each user check identifier is preferably XORed with a different key, it is not easy to identify potential user check identifiers, so this method is sufficiently secure to hide the user's identity.

Preferably, users wishing to authorize other users also generate a new keytab for each new user. Therefore, a key table generation unit 12 is also provided in each user equipment 1, as shown in FIG. 4 .

Users who create content will be authorized as described in the aforementioned European Patent Application 02 078 437.7 (PHNL020775). Adding additional users to the authorized list can be done over the network. Therefore, preferably a secure connection is provided between the user equipment and the network in GSM of the user to be authorized, in particular the home location register HLR. Likewise, the user's phone number or the user's IMSI can be used as the user identifier. Of course, other user identifiers that uniquely identify the user to the network may also be used.

The authentication process described above can also be used to generate keys for the secure channel between the user equipment and the network in a similar manner.

The mobile network operator preferably also provides the above procedure as a service. Users from different networks can also be authorized in the same way that the network treats roaming users. However, by offering this service but not supporting users from other networks, the network can also encourage friends or family of the current user to subscribe to their network.

The present invention provides a simple and easy method for adding additional users to the authorized list for gaining access to content belonging to a particular user. A web verification process is used in this highly secure process.

Claims (11)

1. A device for authorizing a user to gain access to content stored in encrypted form on a storage medium (10) storing a machine-readable medium identifier (id) and at least one pass-use key A key table (KL) encrypted by a table key (KLK) and storing at least one asset key (AK) for decrypting encrypted content (C), said device comprising: connecting means (6) for connecting said device to a network (3); a drive (5) for accessing said storage medium (10), in particular for reading content (C) and said medium identifier (id) from said storage medium (10); and Transmitter (7) for sending said medium identifier (id) and a user identifier (ui) of a user to an authentication unit (AuC) within said network (3) that the user will be authorized to obtain access to said content (C) and said network (3) identifies the user by said user identifier (ui), said medium identifier (id) and said user identifier (ui) are identified by said The authentication unit (AuC) is used to generate a key table key (KLK) for the user, so that the user can decrypt at least one predetermined key table (KL). 2. The device as claimed in claim 1, further comprising a receiver (8) for receiving said key table key (KLK) from said network (3) for said user, and wherein said sending A device (7) is operable to send said received keylist key (KLK) to said user. 3. The device as claimed in claim 1, wherein said storage means (10) store a plurality of key tables (KL), in particular one key table per user, wherein each key table is assigned a user check identifier (uc), and wherein said device further comprises a user check means (11) for checking which key table (KL) is assigned to said user. 4. The apparatus described in claim 1, wherein said at least one key table (KL) further comprises a decryption check identifier (DC), and, wherein said apparatus further comprises a decryption check means (9), with to check whether a key table (KL) has been correctly decrypted according to the decryption check identifier (DC). 5. The apparatus described in claim 1, further comprising key table generating means (12) for generating a key table key (KLK) by encrypting one or more asset keys (AK) with a key table key (KLK) A key table (KL), wherein said drive (5) is operable to store said key table (KL) on said storage medium (10). 6. The device as claimed in claim 1, wherein said device is a mobile communication device, in particular a mobile phone, wherein said network is a mobile communication network, and wherein said authentication unit (AuC) uses a The device's authentication algorithm to generate the keylist key (KLK). 7. The device as claimed in claim 6, wherein said user identifier (id) is an International Mobile Subscriber Identity or a telephone number of said user. 8. The device as claimed in claim 6, wherein said transmitter (7) is operable to transmit said medium identifier (id) and said user identifier (ui) to said Authentication unit (Auc) of the subscriber's home location register. 9. Method for authorizing a user to gain access to content stored in encrypted form on a storage medium (10) storing a machine-readable medium identifier (id) and at least one pass-use key A key table (KL) encrypted by the table key (KLK), and storing at least one asset key (AK) for decrypting the encrypted content (C), the method includes the following steps: connecting said device to a network (3); sending said medium identifier (id) and a user identifier (ui) of a user to an authentication unit (AuC) within said network (3), which user will be authorized to obtain access to said content (C) access rights and said network (3) identifies the user by said user identifier (ui), said medium identifier (id) and said user identifier (ui) are used by said authentication unit (AuC) for The user generates a key table key (KLK) to enable the user to decrypt at least one predetermined key table (KL). 10. A network comprising: - a first user device (1) for authorizing a second user device of a user to obtain access to content stored in encrypted form on a storage medium (10) storing a machine-readable medium identification identifier (id) and at least one key table (KL) encrypted by using a key table key (KLK), and store at least one asset key (AK) for decrypting encrypted content (C), the first User equipment includes: - connecting means (6) for connecting said device to a network (3); - a drive (5) for accessing said storage medium (10), in particular for reading content (C) and said medium identifier (id) from said storage medium (10); and - sender (7) for sending said medium identifier (id) and a user identifier (ui) of a user to an authentication unit (AuC) within said network (3), the user to be authorized gaining access to said content (c) and said network (3) identifying the user by said user identifier (ui); - Authentication Unit (AuC), consisting of: - a receiver (30) for receiving said medium identifier (id) and said user identifier (ui); - Key generating means (31) for generating a key table key for said user with said medium identifier (id) and said user identifier (ui), said key table key enabling all said user can decrypt said at least one key table; and - a sender (32) for sending said key table key to said first and/or said second user equipment; and - A second user device (2) of a user who will be authorized to gain access to content stored on the storage medium in encrypted form, comprising: - connecting means (6) for connecting said device to said network; - a receiver (8) for receiving said keytab key from said authentication unit or from said first user equipment; - A drive (5) for accessing said storage medium, in particular for reading content from said storage medium, and decrypting at least one predetermined key table with the received key table key. 11. Computer program comprising program code means for causing a computer to carry out the steps of the method as claimed in claim 9 when said computer program is run on a computer.

Images