Reducing time to first encrypted frame in a content stream

• US 10,645,430 B2
• Filed: 06/07/2017
• Issued: 05/05/2020
• Est. Priority Date: 12/12/2011
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google LLC (Alphabet Inc.)
• Inventors: Dorwin, David Kimbal
• Primary Examiner(s): Rahim, Monjur
• Application Number:
  US15/616,417
• Publication Number:
  US 20170270306A1
• Time in Patent Office: 1,063 Days
• Field of Search: 713150
• CPC Class Codes: G06F 11/3003 Monitoring arrangements specially adapted to the computing system or computing system component being monitored
• CPC Class Codes: G06F 21/105 Arrangements for software license management or administration, e.g. for managing licenses at corporate level
• CPC Class Codes: G06F 21/1062 Editing
• CPC Class Codes: G06F 21/1073 Conversion
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 40/143 Markup, e.g. Standard Generalized Markup Language [SGML] or Document Type Definition [DTD]
• CPC Class Codes: G06T 11/00 2D [Two Dimensional] image generation
• CPC Class Codes: G11B 20/00086 Circuits for prevention of unauthorised reproduction or copying, e.g. piracy indicating unauthorised use of record carriers in general G11B23/28; scrambling for television signal recording H04N5/913; network architectures or network protocols for network security H04L63/00; cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 2463/103 applying security measure for protecting copy right protecting software against unauthorised usage in a vending or licensing environment, e.g. protection the software providers copyright G06F21/10; data processing systems or methods, specially adapted for payment schemes, architectures or protocols G06Q20/00; secrecy systems or subscription systems H04N7/16
• CPC Class Codes: H04L 47/801 Real time traffic
• CPC Class Codes: H04L 47/805 QOS or priority aware
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0876 : based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 65/1101 : Session protocols
• CPC Class Codes: H04L 65/1108 : Web based protocols, e.g. webRTC
• CPC Class Codes: H04L 65/613 : for the control of the source by the destination control signals issued by the client directed to the server or network components specially adapted for selective content distribution H04N21/637
• CPC Class Codes: H04L 65/762 : at the source reformatting of additional data in video distribution servers H04N21/2355
• CPC Class Codes: H04L 65/80 : Responding to QoS
• CPC Class Codes: H04L 9/0631 : Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms
• CPC Class Codes: H04L 9/0861 : Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/32 : including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04N 21/2347 : involving video stream encryption
• CPC Class Codes: H04N 21/24 : Monitoring of processes or resources, e.g. monitoring of server load, available bandwidth, upstream requests monitoring of server performance or load G06F11/34; arrangements for observation, testing or troubleshooting for broadcast or for distribution combined with broadcast H04H20/12
• CPC Class Codes: H04N 21/25825 : involving client display capabilities, e.g. screen resolution of a mobile phone optimising the visualisation of content during browsing in the Internet G06F16/9577; processing of terminal status or physical abilities in wireless networks H04W8/22; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/25833 : involving client hardware characteristics, e.g. manufacturer, processing or storage capabilities allocation of resources considering hardware capabilities in multiprogramming arrangements G06F9/5044; allocation of resources considering software capabilities in multiprogramming arrangements G06F9/5055
• CPC Class Codes: H04N 21/41407 : embedded in a portable device, e.g. video client on a mobile phone, PDA, laptop constructional details of equipment or arrangements specially adapted for portable computer application G06F1/1626; arrangements specially adapted for mobile receivers in broadcast systems H04H20/57
• CPC Class Codes: H04N 21/4405 : involving video stream decryption
• CPC Class Codes: H04N 21/4516 : involving client characteristics, e.g. Set-Top-Box type, software version or amount of memory available

Abstract

Techniques are described for reducing time to decrypt a next encrypted frame in a content stream by optimizing a license/key acquisition process. When requesting content, a key identifier and/or license identifier may be included within a webpage using a link, script, or similar access point. When a client device sends a request for content, the loading of the webpage within the client device includes the embedded key identifier. Access to the key/license identifier at the client device then may initiate a key/license acquisition process by the client device. The key/license may be obtained from a key management device in parallel with, or prior to, downloading of at least a portion of the content stream.

Claims

1. A network device, comprising:

a memory; and

one or more processors coupled to the memory that perform actions including;

receiving, from a client device, a request for a webpage that includes a link and/or mechanism that can be used to present an encrypted content item;

in response to receiving the request for the webpage, determining that the webpage includes encrypted content and retrieving a key identifier corresponding to the encrypted content item from the memory;

transmitting to the client device a webpage script, corresponding to the request for the webpage, that includes the key identifier corresponding to the encrypted content item and that is configured to cause the client device to transmit a request to a second network device for access to a key associated with the encrypted content item;

subsequent to transmitting the key identifier corresponding to the encrypted content item, receiving, from the client device, an indication of a user selection of the link and/or mechanism and a request for a first encrypted frame of the encrypted content item, the user selection corresponding to the encrypted content item; and

responsive to receiving the indication and the request for the first encrypted frame, transmitting to the client device at least a portion of the encrypted content item including the first encrypted frame, wherein a key associated with the key identifier is usable to decrypt the first encrypted frame.

2. The network device of claim 1, wherein the one or more processors perform actions further including:

transmitting to the client device a subsequent key identifier that corresponds to a subsequent portion of the encrypted content item, wherein the subsequent portion of the encrypted content item is a portion of the encrypted content item that is presented subsequent to a portion of the encrypted content item that corresponds to the key identifier.

3. The network device of claim 1, wherein the webpage script is further configured to cause the client device to pre-initialize at least a decryption module usable to decrypt the encrypted content item.

4. The network device of claim 1, wherein the one or more processors perform actions further including:

determining that the encrypted content item is associated with a key rotation scheme; and

transmitting to the client device a subsequent key identifier based on the key rotation scheme.

5. The network device of claim 1, wherein the one or more processors perform actions further including:

subsequent to transmitting the webpage script to the client device, transmitting at least one portion of the encrypted content item to the client device.

6. The network device of claim 5, wherein the one or more processors perform actions further including:

concurrent with transmitting the at least one portion of the encrypted content item to the client device, transmitting a subsequent key identifier corresponding to a subsequent portion of the encrypted content item, wherein the subsequent portion of the encrypted content item is presented subsequent to the at least one portion of the encrypted content item.

7. A method, comprising:

receiving, from a client device, a request for a webpage that includes a link and/or mechanism that can be used to present an encrypted content item;

in response to receiving the request for the webpage, determining, using a hardware processor, that the webpage includes encrypted content and retrieving a key identifier corresponding to the encrypted content item;

transmitting to the client device a webpage script, corresponding to the request for the webpage, that includes the key identifier corresponding to the encrypted content item and that is configured to cause the client device to transmit a request for access to a key associated with the encrypted content item;

subsequent to transmitting the key identifier corresponding to the encrypted content item, receiving, from the client device, an indication of a user selection of the link and/or mechanism and a request for a first encrypted frame of the encrypted content item, the user selection corresponding to the encrypted content item; and

responsive to receiving the indication and the request for the first encrypted frame, transmitting to the client device at least a portion of the encrypted content item including the first encrypted frame, wherein a key associated with the key identifier is usable to decrypt the first encrypted frame.

8. The method of claim 7, further comprising:

transmitting to the client device a subsequent key identifier that corresponds to a subsequent portion of the encrypted content item, wherein the subsequent portion of the encrypted content item is a portion of the encrypted content item that is presented subsequent to a portion of the encrypted content item that corresponds to the key identifier.

9. The method of claim 7, wherein the webpage script is further configured to cause the client device to pre-initialize at least a decryption module usable to decrypt the encrypted content item.

10. The method of claim 7, further comprising:

determining that the encrypted content item is associated with a key rotation scheme; and

transmitting to the client device a subsequent key identifier based on the key rotation scheme.

11. The method of claim 7, further comprising:

subsequent to transmitting the webpage script to the client device, transmitting at least one portion of the encrypted content item to the client device.

12. The method of claim 11, further comprising:

concurrent with transmitting the at least one portion of the encrypted content item to the client device, transmitting a subsequent key identifier corresponding to a subsequent portion of the encrypted content item, wherein the subsequent portion of the encrypted content item is presented subsequent to the at least one portion of the encrypted content item.

13. A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method, the method comprising:

receiving, from a client device, a request for a webpage that includes a link and/or mechanism that can be used to present an encrypted content item;

in response to receiving the request for the webpage, determining that the webpage includes encrypted content and retrieving a key identifier corresponding to the encrypted content item;

transmitting to the client device a webpage script, corresponding to the request for the webpage, that includes the key identifier corresponding to the encrypted content item and that is configured to cause the client device to transmit a request for access to a key associated with the encrypted content item;

subsequent to transmitting the key identifier corresponding to the encrypted content item, receiving, from the client device, an indication of a user selection of the link and/or mechanism and a request for a first encrypted frame of the encrypted content item, the user selection corresponding to the encrypted content item; and

responsive to receiving the indication and the request for the first encrypted frame, transmitting to the client device at least a portion of the encrypted content item including the first encrypted frame, wherein a key associated with the key identifier is usable to decrypt the first encrypted frame.

14. The non-transitory computer-readable medium of claim 13, wherein the method further comprises:

transmitting to the client device a subsequent key identifier that corresponds to a subsequent portion of the encrypted content item, wherein the subsequent portion of the encrypted content item is a portion of the encrypted content item that is presented subsequent to a portion of the encrypted content item that corresponds to the key identifier.

15. The non-transitory computer-readable medium of claim 13, wherein the webpage script is further configured to cause the client device to pre-initialize at least a decryption module usable to decrypt the encrypted content item.

16. The non-transitory computer-readable medium of claim 13, wherein the method further comprises:

determining that the encrypted content item is associated with a key rotation scheme; and

transmitting to the client device a subsequent key identifier based on the key rotation scheme.

17. The non-transitory computer-readable medium of claim 13, wherein the method further comprises:

subsequent to transmitting the webpage script to the client device, transmitting at least one portion of the encrypted content item to the client device.

18. The non-transitory computer-readable medium of claim 17, wherein the method further comprises:

concurrent with transmitting the at least one portion of the encrypted content item to the client device, transmitting a subsequent key identifier corresponding to a subsequent portion of the encrypted content item, wherein the subsequent portion of the encrypted content item is presented subsequent to the at least one portion of the encrypted content item.