# US 8,571,210 B2 · Content protection apparatus and method using binding of additional information to encryption key > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,571,210 B2 - Document ID: US8571210B2 - Status: Granted - Kind: B2 - Application number: 13/241,124 - Filed: 2011-09-22 - Published: 2012-04-26 - Granted: 2013-10-29 - Earliest claimed: 2010-10-25 - Assignees: Electronics and Telecommunications Research Institute - Applicants: Sin-Hyo Kim; Yun-Kyung Lee; Byung-Ho Chung; Hye-Ran Mun; Sang-Woo Lee; Sok-Joon Lee; Jung-Yeon Hwang; Gun-Tae Bae; Hyun-Sook Cho - Inventors: Sin-Hyo Kim; Yun-Kyung Lee; Byung-Ho Chung; Hye-Ran Mun; Sang-Woo Lee; Sok-Joon Lee; Jung-Yeon Hwang; Gun-Tae Bae; Hyun-Sook Cho - Web page: https://patentgrep.com/patent/US8571210B2 ## CPC - H04L 9/08: Key distribution {or management, e.g. generation, sharing or updating, of cryptographic keys or passwords (network architectures or network communication protocols for supporting key management in a packet data network H04L63/06)} - G06F 21/107: {License processing; Key processing} - H04L 2209/16: Obfuscation or hiding, e.g. involving white box - H04L 2209/603: Digital right managament [DRM] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The present invention relates to a content protection apparatus and method using binding of additional information to an encryption key. The content protection apparatus includes an encryption unit for creating an encryption key required to encrypt data requested by a user terminal and then generating encrypted data in which the data is encrypted. An additional information management unit manages additional information including authority information about the encrypted data. A White-Box Cryptography (WBC) processing unit generates a WBC table required to bind the encryption key corresponding to the encrypted data to the additional information. A bound data generation unit generates bound data in which the encrypted key is bound to the additional information, using a cipher included in the WBC table. ## Claims ### Claim 1 A content protection apparatus using binding of additional information to an encryption key, comprising: an encryption unit configured to create an encryption key required to encrypt data requested by a user terminal and encrypt the data to generate encrypted data; an additional information management unit configured to manage additional information including authority information about the data; a White-Box Cryptography (WBC) processing unit configured to generate a WBC table, wherein the WBC table is used to bind the encryption key corresponding to the encrypted data to the additional information; a bound data generation unit configured to generate bound data in which the encryption key is bound to the additional information, using a cipher included in the WBC table; and a risk management unit configured to, if a request for management of a risk is received from the user terminal, determine and process a security risk situation involving the encrypted data and the bound data which have been transmitted to the user terminal. ### Claim 2 (depends on 1) The content protection apparatus of claim 1, wherein the bound data is set such that when the additional information changes, the encryption key bound to the additional information also automatically changes. ### Claim 3 (depends on 1) The content protection apparatus of claim 1, wherein the WBC processing unit transmits the WBC table to the user terminal before transmitting both the encrypted data and the bound data to the user terminal. ### Claim 4 (depends on 1) The content protection apparatus of claim 1, wherein the encryption unit is configured to create a new encryption key required to encrypt the data at a request of the risk management unit if it is determined that the security risk situation has occurred and generate re-encrypted data using the new encryption key. ### Claim 5 (depends on 4) The content protection apparatus of claim 4, wherein the bound data generation unit regenerates bound data by binding the new encryption key to the additional information at a request of the risk management unit if the new encryption key is created. ### Claim 6 (depends on 1) The content protection apparatus of claim 1, wherein the data management unit upgrades a software version of the data at a request of the risk management unit if it is determined that the security risk situation has occurred. ### Claim 7 A content protection apparatus using binding of additional information to an encryption key, comprising: a White-Box Cryptography (WBC) table mapping unit configured to, when encrypted data and bound data are received from a server, extract a white-box cipher required to unbind the bound data from a pre-stored WBC table; an unbinding unit configured to unbind an encryption key and additional information of the bound data using the white-box cipher; a decryption unit configured to decrypt the encrypted data using the unbound encryption key if the bound data has been unbound; and a data processing unit configured to provide the decrypted data to a user at a request of the user. ### Claim 8 (depends on 7) The content protection apparatus of claim 7, further comprising a security risk situation determination unit configured to, if decryption of the encrypted data has failed, determine that as the additional information has changed due to an attack, the encryption key has also changed, and then request that the server manage a risk. ### Claim 9 A content protection method using binding of additional information to an encryption key, the method being performed by a server, comprising: creating an encryption key required to encrypt data requested by a user terminal and then generating encrypted data in which the data is encrypted; generating a White-Box Cryptography (WBC) table to bind the encryption key, which corresponds to the encrypted data, to additional information, which includes authority information about the data; generating bound data by binding the encrypted key to the additional information using a cipher included in the WBC table; transmitting the encrypted data and the bound data to the user terminal; and if a request for management of a risk involving the encrypted data or the bound data is received from the user terminal, determining and processing a security risk situation involving the encrypted data or the bound data. ### Claim 10 (depends on 9) The content protection method of claim 9, wherein the bound data is set such that when the additional information changes, the encryption key bound to the additional information also automatically changes. ### Claim 11 (depends on 9) The content protection method of claim 9, further comprising, before transmitting the encrypted data and the bound data to the user terminal, transmitting the WBC table to the user terminal. ### Claim 12 (depends on 9) The content protection method of claim 9, further comprising, if it is determined that the security risk situation has occurred, creating a new encryption key required to encrypt the data, and then generating encrypted data by re-encrypting the data using the new encryption key. ### Claim 13 (depends on 12) The content protection method of claim 12, further comprising, if the new encryption key has been created, regenerating bound data by binding the new encryption key to the additional information. ### Claim 14 (depends on 9) The content protection method of claim 9, further comprising, if it is determined that the security risk situation has occurred, upgrading a software version of the data. ### Claim 15 A content protection method using binding of additional information to an encryption key, the method being performed by a user terminal, comprising: when encrypted data and bound data are received from a server, unbinding an encryption key and additional information of the bound data using a white-box cipher included in a pre-stored White-Box Cryptography (WBC) table; when the bound data is unbound, decrypting the encrypted data using the unbound encryption key; and playing the decrypted data at a request of a user. ### Claim 16 (depends on 15) The content protection method of claim 15, further comprising, if decryption of the encrypted data has failed, determining that as the additional information has changed due to an attack, the encryption key has changed, and then requesting that the server manage a risk.