Identifying and locating authenticated services using broadcast encryption
AssigneeInternational Business Machines Corporation
InventorsThomas A. Bellwood, Jeffrey B. Lotspiech, Matthew F. Rutkowski
Life of this patent
Estimating the term…
Abstract
Provided are techniques to enable, using broadcast encryption, a device to locate a service offered by a server with the knowledge that the service offered by the server is a trusted service. A signed enhanced Management Key Block (eMKB) includes a trusted service locator (TSL) that includes one or more records, or “trusted service data records” (TSDRs), each identifying a particular service and a corresponding location of the service is generated and transmitted over a network. Devices authorized to access a particular service parse the eMKB for the end point of the service, connect to the appropriate server and transmit a request.
Claims25
A method, comprising:
- generating an enhanced management key block (eMKB) comprising a broadcast encryption management key block (MKB) data and information corresponding to a plurality of service providers;
- digitally signing the eMKB with a verification signature to produce a digitally signed eMKB operable by a device to verify, using the verification signature, authenticity of each service provider of the plurality of service providers based upon a verification of the digitally-signed eMKB;
- and
- transmitting the digitally signed eMKB, including the verification signature, to the device.
A method, comprising:
- receiving, at a device, an enhanced management key block (eMKB) including broadcast encryption management key block (MKB) data and information corresponding to a plurality of service providers;
- verifying the eMKB with a verification signature associated with the eMKB;
- and
- verifying the authenticity of each service provider of the plurality of service providers based upon the verifying of the eMKB.
An apparatus, comprising:
- a processor;
- a non-transitory computer-readable storage medium coupled to the processor;
- and
- logic, stored on the computer-readable storage medium and executed on the processor, for:
- generating an enhanced management key block (eMKB) comprising a broadcast encryption management key block (MKB) data and information corresponding to a plurality of service providers;
- digitally signing the eMKB with a verification signature to produce a digitally signed eMKB operable by a device to verify, using the verification signature, authenticity of each service provider of the plurality of service providers based upon a verification of the digitally-signed eMKB;
- and
- transmitting the digitally signed eMKB, including the verification signature, to the device.
A computer programming product, comprising:
- a non-transitory computer-readable storage medium coupled to the processor;
- and
- logic, stored on the computer-readable storage medium for execution on a processor, for:
- generating an enhanced management key block (eMKB) comprising a broadcast encryption management key block (MKB) data and information corresponding to a plurality of service providers;
- digitally signing the eMKB with a verification signature to produce a digitally signed eMKB operable by a device to verify, using the verification signature, authenticity of each service provider of the plurality of service providers based upon a verification of the digitally-signed eMKB;
- and
- transmitting the digitally signed eMKB, including the verification signature, to the device.
A method, comprising:
- generating an enhanced management key block (eMKB) comprising a broadcast encryption management key block (MKB) data and information corresponding to a plurality of service providers;
- digitally signing the eMKB with a verification signature to produce a digitally signed eMKB operable by a device to verify, using the verification signature, authenticity of each service provider of the plurality of service providers based, upon a verification of the digitally-signed eMKB;
- and
- transmitting the digitally signed eMKB, including the verification signature, to the device;
- wherein the information corresponding to the plurality of service providers identifies an access location corresponding to a service of a plurality of services;
- wherein a service associated with a service provider of the plurality of service providers is one of a list consisting of:
- delivery of media content;
- and
- collection of data provided by the device;
- and
- wherein the collected data is one of a first consisting of:
- health monitoring Information compiled by the device;
- and
- utility usage data compiled by the device.
Dependencies are inferred from the claim text.