Secure Content Distribution System

A distribution server comprising:

• a host processor;
• and
• a non-transitory computer-readable medium communicatively coupled to the host processor, wherein the host processor is configured for executing instructions stored in the non-transitory computer-readable medium and thereby performing operations comprising:
• receiving, by a distribution server, a user selection of content, wherein the user selection of content is stored as encrypted content in a database accessible by a host processor of the distribution server, wherein the encrypted content is encrypted using an encryption key, and wherein the encryption key is stored in encrypted form in a protected storage area of the database that is not accessible to the host processor;
• creating an authenticated communication channel over a network between a remote server and an decryption process executed by the distribution server in isolation from the host processor, the decryption process having access to the protected storage area;
• receiving a protected storage area encryption key from the remote server via the authenticated communication channel;
• and
• using the decryption process to decrypt the encryption key using a protected storage area key, decrypt a portion of the encrypted content corresponding to the user selection of content using the decrypted encryption key, and provide the decrypted portion of the content to the host processor, wherein the decrypted encryption key remains in the protected storage area isolated from the host processor.

A non-transitory computer readable medium storing instructions that, when executed by a host processor of a distribution server, cause the distribution server to perform a computer-implemented method for distributing content of a content provider, the method comprising:

• receiving, by a distribution server, a user selection of content, wherein the user selection of content is stored as encrypted content in a database accessible by a host processor of the distribution server, wherein the encrypted content is encrypted using an encryption key, and wherein the encryption key is stored in encrypted form in a protected storage area of the database that is not accessible to the host processor;
• creating an authenticated communication channel over a network between a remote server and an decryption process executed by the distribution server in isolation from the host processor, the decryption process having access to the protected storage area;
• receiving a protected storage area encryption key from the remote server via the authenticated communication channel;
• and
• using the decryption process to decrypt the encryption key using a protected storage area key, decrypt a portion of the encrypted content corresponding to the user selection of content using the decrypted encryption key, and provide the decrypted portion of the content to the host processor, wherein the decrypted encryption key remains in the protected storage area isolated from the host processor.