Certicom Patent Suit Against Sony Threatens to Unravel AACS
In a move whose repercussions could seriously impact the future development of the AACS content protection system, and even endanger the production plans of high-definition disc console manufacturers worldwide, cryptography software provider Certicom this morning filed suit in Marshall, Texas, against Sony Corporation.
Its claim is that Sony's use of Elliptic Curve Cryptography (ECC) in two of its implemented technologies - AACS and Digital Transmission Content Protection - conceptually violate Certicom's patents for that cryptographic method.
A check of the US Patent and Trademark Office database does indeed turn up a 2003 patent filed in 2000 as a renewal of a concept first referenced by at least one of the creators in 1993.
As Certicom CEO Bernard Crotty stated in a conference call to analysts this afternoon, the Sony suit is probably the first in a string of patent suits the company may file against AACS and DTCP licensees who refuse to license the underlying cryptography for those schemes directly from Certicom.
"I think the takeaway is that we have a very strong patent position with respect to anybody implementing or utilizing those standards," Crotty told analysts, "and I think that we will be looking to have discussions with people in those areas. But ultimately, if we can't reach a licensing arrangement, we could be looking at this sort of thing again in the future."
"We're going to exercise good judgment throughout this [process], and we prefer to license, so we're going to give that every opportunity," he continued, "but as we've shown today, if we can't get there, we won't be shy about taking the next step."
What's at issue is a key methodology used in public key cryptography when the number of bits in a word is radically increased.
A public key involves a modulus - a numeric base, which in this case is the product of two very large prime numbers multiplied together. At the root of the secret is the identity of these prime numbers.
Today, we're starting to deal with 1,024-bit public keys, which are huge numbers, an entire directory of which may be difficult to store; and as the number of bits required increases, cryptographers need ever higher prime numbers...and beyond a certain point, primes are notoriously sparse.
Rather than try to reduce the size of public keys, ECC borrows from the notion that both these primes can be represented as points on an elliptic curve. The curve can then be represented by geometric coordinates, in such a way that any point on the curve multiplied by an integer will yield another point on the same curve. So once the formula knows how to interpret the curve, an algorithm can derive the primes involved in the cryptographic calculations, which also fall on that curve.
The underlying math is perhaps centuries old, and Certicom itself offers a public tutorial on elliptic curves on its own Web site.
Certicom apparently patented the concept of elliptic curve mathematics in cryptography as soon as it could following the first suggestion of its use in 1985, by a fellow Certicom admits worked for IBM at the time. It since filed subsequent patents on variations of its use, including #6,563,928, "Strengthened public key protocol," which describes the use of exponentiation as a technique for placing the very large numbers required for high-bit cryptography into a smaller, more manageable group.
This is one of two patents Certicom claims Sony willfully infringed upon, and as Certicom points out, the method is used in Sony's AACS supporting products including the PlayStation 3, its Blu-ray Disc players, Vaio computers, and numerous HDTVs; as well as in its DTCP supporting products including its i.LINK wireless video streaming ports.
For good measure, Certicom also threw in an infringement claim with regard to US patent #6,704,870, "Digital signatures on a smartcard," which Certicom claims is exploited by pretty much the same list of products - including the PS3 and Blu-ray.
What could be extremely troubling to Sony's partners is a portion of the otherwise boilerplate language of the Certicom suit accuses Sony of willfully infringing upon Certicom's intellectual property by virtue of its having advocated Blu-ray - and thus the AACS content protection system it relies upon - in the first place.
"Defendants have...directly infringed, and induced others to infringe, and committed acts of contributory infringement, of one or more claims of the '870 Patent," Certicom's suit reads, "by making, using, selling, and offering to sell in the United States, and/or importing into the United States products that utilize encryption systems which infringe that patent. The infringing products are all products that utilize encryption systems in accordance with the AACS specification and/or the DTCP specification and include, but are not limited to, all products which include DTCP-enabled i.LINK, DTCP-IP and/or Blu-ray technology."
Intel is the principal creator of the DTCP system, in association with Sony, Hitachi, Matsushita, and Toshiba. Sony is itself the champion of the Blu-ray Disc Association, whose members also include Apple, HP, Dell, Philips, Samsung, Sharp, Mitsubishi, and Thomson.
If Certicom's legal theory is upheld by a federal court, then all of these companies could be vulnerable to similar patent suits for willful infringement - and the danger of treble damages that entails - simply for being members of their respective associations.
"We've got a very strong financial footing," Certicom CTO Herve Seguin told analysts this afternoon. "We're very, very confident that we can successfully pursue the suit with the resources we have on hand, with some left over, and we really believe the stakes are high enough for us to commit our funds to that venture."
Another very well-known user of ECC technology is the federal government. Would Certicom consider going after them? No need to, the company's Executive VP, Dr. Scott Vanstone, confirmed to analysts today, since the National Security Agency is a paid licensee and a legitimate user.
Is there a possibility that companies such as Sony, and others who received what they believed to be valid licenses from the AACS Licensing Authority, could implement a workaround that doesn't infringe upon Certicom's IP? Not likely, the company said today, since Certicom patented the concept of ECC, not some specific implementation of it. Did the company investigate Sony's implementations in PS3 or Blu-ray to detect specific infringements?
"We weren't able to determine how the implementation is being done," admitted Vanstone, "so all we can determine is that they're using concepts that we have coverage on, solid coverage on."
Certicom said it expects the initial phase of this court battle to last several months, if not as long as two years, and is prepared to shoulder the expenses during that period.
"Certicom certainly can claim ownership of ECC," Schneier told us. "The algorithm was developed and patented by the company's founders, and the patents are well written and strong. I don't like it, but they can claim ownership."