Access control and key management system for streaming media

• US 20030063752A1
• Filed: 06/12/2002
• Published: 04/03/2003
• Est. Priority Date: 09/26/2001
• Status: Active Grant

• Current Assignee: Google Technology Holdings LLC (Alphabet Inc.)
• Original Assignee: General Instrument Corporation (CommScope Holding Company, Inc.)
• Inventors: Medvinsky, Alexander, Peterka, Petr, Moroney, Paul
• Granted Patent: US 8,255,989 B2
• Time in Patent Office: Days
• US Class Current: 380/279
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0457 wherein the sending and receiving network entities apply dynamic encryption, e.g. stream encryption cryptographic mechanisms or cryptographic arrangements for stream encryption H04L9/065
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 65/65 Network streaming protocols, e.g. real-time transport protocol [RTP] or real-time control protocol [RTCP]
• CPC Class Codes: H04L 65/70 Media network packetisation

Abstract

A session rights object and authorization data are used for defining a consumer'"'"'s access right to a media content stream. The access rights are determined at a caching server remotely located from the consumer rather than locally at the end user site. In a first aspect, in a computing network having a content provider, a key distribution center, a caching server and a client, a method for controlling client access to a real-time data stream from the caching server, is disclosed. The method includes receiving, by the client, a session rights object from a content provider, the session rights object defining access rules for accessing the real-time data stream; receiving, by the client, authorization data from the key distribution center, the authorization data defining the client'"'"'s access rights to the real-time data stream; forwarding to the caching server the session rights object and the authorization data; comparing, by the caching server, the session rights object with the authorization data to determine client authorization; and if the client is authorized, streaming, by the caching server, the real-time data stream to the client.

Claims

1. In a communication network, a method for controlling client access to data from a caching server, the method comprising:

providing authorization data defining the client'"'"'s subscription options for the real-time data stream;

providing a session rights object defining the client'"'"'s selections from one or more purchase options;

comparing the session rights object with the authorization data to determine client authorization; and

if the client is authorized, transferring the data to the client.

2. The method of claim 1 wherein the data is real-time data, the real-time data being streamed from the caching server to the client.

3. The method of claim 2 further comprising

forwarding a session key from the caching server to the client, the session key for encrypting the real-time data.

4. The method of claim 1 wherein the session rights object and the authorization data are compared by the caching server.

9. The method of claim 1 wherein the client'"'"'s selections from one or more purchase options include pay per view, pay per time and number of viewings.

5. A method for controlling client access to a real-time data stream from a caching server located within a computing network, the method comprising,

receiving authorization data for accessing the real-time data stream;

receiving a session rights object for accessing the real-time data stream;

forwarding the session rights object and the authorization data from the client to the caching server;

determining whether the client is eligible to receive the real-time data by evaluating the session rights object and the authorization data; and

forwarding a session key from the caching server to the client, the session key for securing streaming of real-time data stream to the client.

6. The method of claim 5 further comprising

forwarding the authorization data from a key distribution center to the client.

7. The method of claim 5 further comprising

forwarding the session rights object from the content provider to the client.

8. The method of claim 5 wherein the authorization data comprises any one or more of client geographic location data, list of services subscribed by the client, subscription identification, and the client'"'"'s ability to pay for the real-time data stream.

10. The method of claim 5 wherein the session rights object contains any one or more geographic location black outs, purchase options for the real-time data stream and content identification.

11. The method of claim 5 wherein the content identification is a URI (uniform resource identifier).

12. A system for controlling client access to a real-time data stream from a caching server located within a computing network, the system comprising,

a client system further comprising

means for receiving a session rights object;

means for receiving authorization data;

means for forwarding the session rights object and the authorization data; and

a caching server further comprising

means for comparing the session rights object with the authorization data to determine client authorization; and

if the client is authorized, means for streaming the real-time data stream to the client.

13. The system of claim 12 further comprising a key distribution means for forwarding the authorization data to the client.

14. The method of claim 12 further comprising a content provider means for forwarding the session rights object to the client.