Method and system for end to end securing of content for video on demand

• US 20040078575A1
• Filed: 01/29/2003
• Published: 04/22/2004
• Est. Priority Date: 01/29/2002
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Widevine Technologies Incorporated (Alphabet Inc.)
• Inventors: Rassool, Reza P., Morten, Glenn A., Baker, Brian Andrew, Claeys, Tom E.
• Granted Patent: US 7,328,345 B2
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/0457 wherein the sending and receiving network entities apply dynamic encryption, e.g. stream encryption cryptographic mechanisms or cryptographic arrangements for stream encryption H04L9/065
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

A system and method for providing end-to-end security of content over a heterogeneous distribution chain is provided. A content owner provides content to an aggregator that receives the content and processes the content. The processing may involve decrypting the content and associating at least one of a unique fingerprint and a watermark to the decrypted content. The unique fingerprint and a watermark to the decrypted content provide identifying characteristics to the content. Additional content-based fingerprints may be used to monitor quality of consumer experience for Video and Audio. The content may be sent in a decrypted state to a client or in an encrypted state. When the content is encrypted the aggregator wraps and encrypts the content with a signature such that an end-to-end flow of the content may be determined. Application Level encryption is used to provide network/distribution medium transparency as well as persistent encryption. When the content is transmitted from a consumer to another consumer the transmitting consumer loses rights to the content.

Claims

1. A system for providing end-to-end security of content over a heterogeneous distribution chain, comprising:

a content owner having content;

an aggregator arranged to receive the content and configured to perform the following actions;

receive the content;

decrypt content that is encrypted and associate at least one of a unique fingerprint and a watermark to the decrypted content;

wrap and encrypt the decrypted content with a signature such that an end-to-end flow of the content may be determined; and

transmit the content to a recipient in at least one of the following states, including a decrypted state and an encrypted state.

2. The system of claim 1, wherein the content owner is further configured to transmit content that is encrypted and wrapped to the aggregator.

3. The system of claim 1, further comprising a key manager and a key exchange arranged to manage encryption keys and decryption keys, the decryption keys relating to content that has been encrypted by an upstream provider, and the encryption keys that are used for distribution of the content.

4. The system of claim 3, wherein the key manager is further configured to manage symmetric keys of the aggregator and asymmetric keys that may be employed for at least one of signing of the content, of encrypting the content and key exchange.

5. The system of claim 3, wherein the unique fingerprint using the watermark applied to the decrypted content allows for identification of the authorized decryption agent.

6. The system of claim 1, wherein the watermark is configured to identify the recipient of the content.

7. The system of claim 1, wherein the watermark is configured to identify a source of the content.

8. The system of claim 5, wherein the content is watermarked and fingerprinted such that a distribution path and a service provider in a market stream relating to the content are uniquely identified.

9. The system of claim 4, wherein wrapping/encrypting the decrypted content further comprises providing an encryption key wrap to the content as it is communicated to the recipient.

10. The system of claim 1, wherein the aggregator further comprises a persistent security database configured to store the encrypted content.

11. The system of claim 1, wherein the aggregator further comprises a content in the clear database configured to store the decrypted content having the at least one of the unique fingerprint and the watermark.

12. The system of claim 1, wherein the clear database may be used to initiate trans-encryption in order to change the encryption properties allowing the use of legacy conditional access and consumer premise equipment in next generation networks.

13. The system of claim 1, further comprising a bridge and a key exchange configured to encrypt the content as it is transmitted to a downstream recipient.

14. The system of claim 1, further comprising a QOS API configured to enable selection of Quality of Service profiles based on system and content attributes.

15. The system of claim 14, wherein the QOS API is further configured to provide an upstream content provider with information concerning the unencrypted content.

16. A method for providing end-to-end security of content over a heterogeneous distribution chain, comprising:

receiving content from a provider;

determining when to inspect the content; and

when;

decrypting the content when it is encrypted and associating at least one of a unique fingerprint and a watermark to the decrypted content;

wrapping and encrypting the decrypted content with a signature such that an end-to-end flow of the content may be determined; and

determining when to transmit the content in an encrypted state, and when;

transmitting the content in the encrypted state to a recipient;

otherwise transmitting the content in a decrypted state to the recipient.

17. The method of claim 16, further comprising managing encryption keys and decryption keys, the decryption keys relating to content that has been encrypted by the provider, and the encryption keys that are used for distribution of the content to the recipient.

18. The method of claim 17, wherein managing the encryption keys further comprises managing symmetric and asymmetric keys that may be employed for at least one of signing of the content, of encrypting the content and key exchange.

19. The method of claim 17, wherein the unique fingerprint using the watermark applied to the decrypted content allows for identification of the authorized decryption agent.

20. The method of claim 16, wherein the watermark is configured to identify the recipient of the content.

21. The method of claim 16, wherein the watermark is configured to identify a source of the content.

22. The method of claim 19, wherein the content is watermarked and fingerprinted such that a distribution path and a service provider in a market stream relating to the content are uniquely identified.

23. The method of claim 22, wherein wrapping/encrypting the decrypted content further comprises providing an encryption key wrap to the content as it is communicated to the recipient.

24. The method of claim 16, further comprising enabling a selection of Quality of Service profiles based on system and content attributes.

25. The method of claim 24, wherein enabling the selection of Quality of Service profiles based on system and content attributes further comprises providing an upstream content provider with information concerning the unencrypted content.

26. The method of claim 23, wherein the encryption key wrap to the content further comprise a content owner'"'"'s symmetric encryption key S/k, that has been encrypted by an aggregator'"'"'s encryption key, A/k.

27. The method of claim 16, further comprising determining when the provider and the recipient are a consumer, and when:

ensuring that the provider loses rights to the content after the transmission.

28. The method of claim 16, wherein the identifying of the last authorized decryption agent by watermarking the agent'"'"'s fingerprint to the content is performed at least one of the following times including:

the time of decryption and as part of the decryption process.

29. The method of claim 16, further comprising the use of content fingerprints taken before encryption and after decryption in order to determine the quality of experience for Video and Audio service.

30. The method of claim 16, wherein in application level encryption is used in order to provide network/distribution medium transparency and persistent encryption in storage devices and caches.

31. The method of claim 16, wherein selective encryption is used in order to provide network/distribution medium transparency and persistent encryption in storage devices and caches.

32. A system for providing end-to-end security of content over a heterogeneous distribution chain, comprising:

means for receiving content from a provider;

means for determining when to inspect the content; and

when;

means for decrypting the content when it is encrypted and means for adding at least one of a unique fingerprint and a watermark to the decrypted content;

means for wrapping and encrypting the decrypted content with a signature such that an end-to-end flow of the content may be determined; and

means for determining when to transmit the content in an encrypted state, and when;

means for transmitting the content in the encrypted state to a recipient;

otherwise means for transmitting the content in a decrypted state to the recipient.