Method and apparatus for protection of media objects including HTML

• US 10,452,759 B1
• Filed: 06/29/2017
• Issued: 10/22/2019
• Est. Priority Date: 12/12/2011
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google LLC (Alphabet Inc.)
• Inventors: Dorwin, David Kimbal, Scherkus, Andrew
• Primary Examiner(s): Tsang, Henry
• Application Number:
  US15/638,259
• Time in Patent Office: 845 Days
• Field of Search: None
• CPC Class Codes: G06F 11/3003 Monitoring arrangements specially adapted to the computing system or computing system component being monitored
• CPC Class Codes: G06F 21/105 Arrangements for software license management or administration, e.g. for managing licenses at corporate level
• CPC Class Codes: G06F 21/1062 Editing
• CPC Class Codes: G06F 21/1073 Conversion
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 40/143 Markup, e.g. Standard Generalized Markup Language [SGML] or Document Type Definition [DTD]
• CPC Class Codes: G06T 11/00 2D [Two Dimensional] image generation
• CPC Class Codes: G11B 20/00086 Circuits for prevention of unauthorised reproduction or copying, e.g. piracy indicating unauthorised use of record carriers in general G11B23/28; scrambling for television signal recording H04N5/913; network architectures or network protocols for network security H04L63/00; cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 2463/103 applying security measure for protecting copy right protecting software against unauthorised usage in a vending or licensing environment, e.g. protection the software providers copyright G06F21/10; data processing systems or methods, specially adapted for payment schemes, architectures or protocols G06Q20/00; secrecy systems or subscription systems H04N7/16
• CPC Class Codes: H04L 47/801 Real time traffic
• CPC Class Codes: H04L 47/805 QOS or priority aware
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0876 : based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 65/1101 : Session protocols
• CPC Class Codes: H04L 65/1108 : Web based protocols, e.g. webRTC
• CPC Class Codes: H04L 65/613 : for the control of the source by the destination control signals issued by the client directed to the server or network components specially adapted for selective content distribution H04N21/637
• CPC Class Codes: H04L 65/762 : at the source reformatting of additional data in video distribution servers H04N21/2355
• CPC Class Codes: H04L 65/80 : Responding to QoS
• CPC Class Codes: H04L 9/0631 : Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms
• CPC Class Codes: H04L 9/0861 : Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/32 : including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04N 21/2347 : involving video stream encryption
• CPC Class Codes: H04N 21/24 : Monitoring of processes or resources, e.g. monitoring of server load, available bandwidth, upstream requests monitoring of server performance or load G06F11/34; arrangements for observation, testing or troubleshooting for broadcast or for distribution combined with broadcast H04H20/12
• CPC Class Codes: H04N 21/25825 : involving client display capabilities, e.g. screen resolution of a mobile phone optimising the visualisation of content during browsing in the Internet G06F16/9577; processing of terminal status or physical abilities in wireless networks H04W8/22; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/25833 : involving client hardware characteristics, e.g. manufacturer, processing or storage capabilities allocation of resources considering hardware capabilities in multiprogramming arrangements G06F9/5044; allocation of resources considering software capabilities in multiprogramming arrangements G06F9/5055
• CPC Class Codes: H04N 21/41407 : embedded in a portable device, e.g. video client on a mobile phone, PDA, laptop constructional details of equipment or arrangements specially adapted for portable computer application G06F1/1626; arrangements specially adapted for mobile receivers in broadcast systems H04H20/57
• CPC Class Codes: H04N 21/4405 : involving video stream decryption
• CPC Class Codes: H04N 21/4516 : involving client characteristics, e.g. Set-Top-Box type, software version or amount of memory available

Abstract

A method, apparatus, and manufacture for content protection for protecting some objects is provided. A content protection operation or license operation is performed for at least one media object of a web application. Some or all of the objects are then marked as protected. When an operation is performed that accesses a protected object, a user agent determines whether to deny the operation, to allow the operation and mark data exported by the operation and objects storing the exported data as protected objects, or to allow the operation and not mark data exported by the operation and objects storing the exported data as protected objects.

Claims

1. A method, comprising:

receiving, by a computing device, an object model comprising a plurality of objects;

determining that, by the computing device, a first operation for a media object of the plurality of objects was performed, wherein the first operation is at least one of a content protection operation or a license operation, and wherein the media object comprises a hypertext markup language (HTML) video element, an HTML audio element, or an HTML media element;

designating within the object model, based on determining that the first operation was performed, one or more of the plurality of objects as protected objects;

in response to a second operation initiating access to a protected object of the designated protected objects, making a determination whether to (1) deny the second operation access to the protected object, (2) allow the second operation access to the protected object and allow data associated with the protected object to be exported by the second operation, or (3) allow the second operation access to the protected object but designate the data exported by the second operation or objects storing the exported data as protected; and

controlling access to the protected object according to the determination.

2. The method of claim 1, further comprising:

identifying, by the computing device, a reference to media content;

determining that the media content is encrypted; and

designating the protected objects in response to determining that the media content is encrypted.

3. The method of claim 1, wherein the second operation is performed by an element of a web application responsible for extracting content from the protected object.

4. The method of claim 3, wherein the element of the web application is an HTML canvas element.

5. The method of claim 4, further comprising:

in response to the second operation initiating access to the protected object, making the determination to allow the second operation access to the protected object but designate the data exported by the second operation or objects storing the exported data as protected; and

allowing the HTML canvas element to utilize first data from the protected object and preventing the first data from being read from the HTML canvas element.

6. The method of claim 1, wherein designating the one or more of the plurality of objects as protected objects comprises setting a Boolean flag for each of the protected objects, and wherein determining that the second operation is initiating access to a protected object based on determining that the Boolean flag of the protected object is set.

7. The method of claim 1, further comprising:

determining, by the computing device, that content protection is enabled, wherein the determination is made in response to a second operation initiating access to the protected object and the content protection being enabled.

8. The method of claim 7, wherein determining that content protection is enabled is based on determining that the plurality of objects originate from more than one domain, detecting at least one of a web browser add-on or a web browser extension, or detecting a predetermined type of script.

9. The method of claim 1, wherein the media object is an HTML5 element.

10. The method of claim 1, wherein the plurality of objects comprises the media object.

11. A computing device, comprising:

one or more processors; and

a memory having instructions stored thereon that, when executed by the one or more processors, cause the computing device to perform operations comprising;

receiving, by the computing device, an object model comprising a plurality of objects;

determining that, by the computing device, a first operation for a media object of the plurality of objects was performed, wherein the first operation is at least one of a content protection operation or a license operation, and wherein the media object comprises a hypertext markup language (HTML) video element, an HTML audio element, or an HTML media element;

designating within the object model, based on determining that the first operation was performed, one or more of the plurality of objects as protected objects;

in response to a second operation initiating access to a protected object of the designated protected objects, making a determination whether to (1) deny the second operation access to the protected object, (2) allow the second operation access to the protected object and allow data associated with the protected object to be exported by the second operation, or (3) allow the second operation access to the protected object but designate the data exported by the second operation or objects storing the exported data as protected; and

controlling access to the protected object according to the determination.

12. The computing device of claim 11, wherein the operations further comprise:

identifying, by the computing device, a reference to media content;

determining that the media content is encrypted; and

designating the protected objects in response to determining that the media content is encrypted.

13. The computing device of claim 11, wherein the second operation is performed by an element of a web application responsible for extracting content from the protected object.

14. The computing device of claim 13, wherein the element of the web application is an HTML canvas element.

15. The computing device of claim 14, wherein the operations further comprise:

in response to the second operation initiating access to the protected object, making the determination to allow the second operation access to the protected object but designate the data exported by the second operation or objects storing the exported data as protected; and

allowing the HTML canvas element to utilize first data from the protected object and preventing the first data from being read from the HTML canvas element.

16. The computing device of claim 11, wherein designating the one or more of the plurality of objects as protected objects comprises setting a Boolean flag for each of the protected objects, and wherein determining that the second operation is initiating access to a protected object based on determining that the Boolean flag of the protected object is set.

17. The computing device of claim 11, further comprising:

determining, by the computing device, that content protection is enabled, wherein the determination is made in response to a second operation initiating access to the protected object and the content protection being enabled.

18. The computing device of claim 17, wherein determining that content protection is enabled is based on determining that the plurality of objects originate from more than one domain, detecting at least one of a web browser add-on or a web browser extension, or detecting a predetermined type of script.

19. The computing device of claim 11, wherein the plurality of objects comprises the media object, and the media object is an HTML5 element.

20. A non-transitory computer memory medium storing instructions thereon that, when executed by a computing device, cause the computing device to perform operations facilitating:

receiving an object model comprising a plurality of objects;

determining that a first operation for a media object of the plurality of objects was performed, wherein the first operation is at least one of a content protection operation or a license operation, and wherein the media object comprises a hypertext markup language (HTML) video element, an HTML audio element, or an HTML media element;

designating within the object model, based on determining that the first operation was performed, one or more of the plurality of objects as protected objects;

identifying a second operation as initiating access to a protected object of the designated protected objects, the second operation being performed by an element of a web application responsible for extracting content from the protected object;

in response to the second operation initiating access to the protected object, making a determination whether to (1) deny the second operation access to the protected object, (2) allow the second operation access to the protected object and allow data associated with the protected object to be exported by the second operation, or (3) allow the second operation access to the protected object but designate the data exported by the second operation or objects storing the exported data as protected; and

controlling access to the protected object according to the determination.