Secure presentation of media streams in response to encrypted digital content

• US 20040088557A1
• Filed: 07/09/2003
• Published: 05/06/2004
• Est. Priority Date: 07/09/2002
• Status: Active Grant

• Current Assignee: Kaleidescape Incorporated
• Original Assignee: Kaleidescape Incorporated
• Inventors: Watson, Stephen, Rechsteiner, Paul, Hui, Kevin, Collens, Daniel A., Malcolm, Michael A.
• Granted Patent: US 7,702,101 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: H04N 2005/91364 the video signal being scrambled
• CPC Class Codes: H04N 21/23476 by partially encrypting, e.g. encrypting the ending portion of a movie
• CPC Class Codes: H04N 21/4181 for conditional access
• CPC Class Codes: H04N 21/4182 for identification purposes, e.g. storing user identification data, preferences, personal settings or data restricting access to computer systems by authenticating users using a predetermined code in combination with an additional device, e.g. dongle or smart card G06F21/123
• CPC Class Codes: H04N 21/4367 Establishing a secure communication between the client and a peripheral device or smart card
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/4627 Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/8355 involving usage data, e.g. number of copies or viewings allowed
• CPC Class Codes: H04N 5/913 for scrambling ; for copy protection
• CPC Class Codes: H04N 7/163 by receiver means only
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

Secure presentation of media streams includes encoding the media streams into digital content, encrypting a portion of that digital content, the portion being required for presentation, in which the encrypted version is substantially unchanged in formatting parameters from the clear version of the digital content. Selecting those portions for encryption so there is no change in distribution of the media stream: packetization of the digital data, or synchronization of audio with video portions of the media stream. When encoding the media stream into MPEG-2, refraining from encrypting information by which the video block data is described, packet formatting information, and encrypting the video block data using a block-substitution cipher. A block-substitution cipher can be used to encrypt each sequence of 16 bytes of video data in each packet, possibly leaving as many as 15 bytes of video data in each packet in the clear.

Claims

1. A method, including steps of

encoding a media stream into a digital content format representing that media stream;

and

encrypting a portion of that digital content, less than the entire digital content format representing that media stream, the portion of the digital content that is encrypted being required for presentation of the media stream;

wherein the encrypted version of that digital content is substantially un-changed in formatting parameters from an unencrypted version of that digital content.

2. A method as in claim 1, wherein

said steps of encoding provide an MPEG encoding of at least some video data.

3. A method as in claim 1, wherein

said steps of encrypting include steps of

encrypting at least some audio or video data using a block-substitution cipher.

4. A method as in claim 1, wherein

said steps of encrypting include steps of

encrypting at least some audio or video data using a block-substitution cipher;

and

refraining from encrypting at least some audio or video data using that block-substitution cipher, wherein an amount of audio or video data not encrypted is less than a block size for that block-substitution cipher.

5. A method as in claim 1, wherein

said steps of encrypting include steps of

identifying at least a first set of data and a second set of data in the digital format;

and

separately encrypting the first set of data and the second set of data;

whereby the first set of data can be made available to a first set of users and the second set of data can be made available to a second set of users, the first set of users being distinguishable from the second set of users.

6. A method as in claim 1, wherein

said steps of encrypting include steps of

refraining from encrypting at least one of (a) information by which at least some audio or video data is described, or (b) at least some formatting information.

7. A method as in claim 1, wherein

the digital content format includes

at least some audio or video data;

and

at least some formatting information.

8. A method as in claim 1, wherein

the digital content format representing that media stream includes a set of layers, each relatively higher-level layer representing an abstraction for which each relatively lower-level layer represents an implementation thereof;

a first set of relatively higher-level layers represent audio or video information for the media stream, while a second set of relatively lower-level layers represent techniques by which that information is formatted or supplemented; and

the step of encrypting is applied only to that portion of the digital content representing audio and video information.

9. A method as in claim 1, wherein

the digital content format representing that media stream includes a set of layers, each relatively higher-level layer representing an abstraction for which each relatively lower-level layer represents an implementation thereof;

a first set of relatively higher-level layers represent audio or video information for the media stream, while a second set of relatively lower-level layers represent techniques by which that information is broken into packets, indexed, multiplexed, or supplemented with metadata; and

the step of encrypting is applied only to that portion of the digital content representing audio and video information.

10. A method as in claim 1, wherein

the digital content format representing that media stream includes a set of layers, each relatively higher-level layer representing an abstraction for which each relatively lower-level layer represents an implementation thereof;

a first set of relatively higher-level layers represent audio and video information for the media stream, while a second set of relatively lower-level layers represent techniques by which that information is broken into packets, indexed, multiplexed, or supplemented with metadata; and

the step of encrypting is not applied to at least part of that portion of the digital content representing other than audio and video information.

11. A method as in claim 1, wherein

the media stream includes at least one of:

a movie, animation, sound, still media, a picture, an illustration, a database, a collection of information.

12. A method as in claim 1, including steps of

selecting that portion of the digital content for encryption so there is no substantial change in distribution of that digital content.

13. A method as in claim 12, wherein

said steps of selecting include ensuring there is no substantial change in packetization of a set of digital data in that digital content.

14. A method as in claim 12, wherein

said steps of selecting include ensuring there is no substantial change in synchronization of audio with video portions of the media stream.

15. A method as in claim 12, wherein

said steps of selecting include ensuring there is no substantial change in length of at least some identifiable audio or video data in that digital content.

16. Apparatus including

an input port capable of being coupled to a communication link, the communication link being capable of carrying digital content, the digital content including at least some presentable information and at least some formatting information;

a digital content decoder, the decoder being capable of identifying the presentable information in response to the formatting information;

a digital content decryptor, the decryptor being capable of decrypting the presentable information in response to a key;

wherein the decryptor is protected by a relatively-higher degree of security than the decoder.

17. Apparatus as in claim 16, wherein the communication link includes at least one of:

a computer network capable of carrying digital content;

a reader capable of retrieving information in response to physical media, the physical media being capable of carrying digital content.

18. Apparatus as in claim 16, wherein the decoder includes an MPEG decoder.

19. Apparatus as in claim 16, wherein

the decoder is included in a first selected set of hardware or software, the first selected set being trusted;

and

the decryptor and the key are included in a second selected set of hardware or software, the second selected set being relatively more trusted than the first selected set.

20. Apparatus as in claim 16, wherein the decoder is responsive to the formatting information to present at least some metadata about one or more media streams without the decoder having access to the presentation information.

21. Apparatus as in claim 16, wherein the decoder is responsive to the formatting information to provide at least one of the following functions without the decoder having access to the presentation information:

known playback functions known for media streams;

navigation within the digital content;

content selection within the digital content;

or

manipulation of the presentation.

22. Apparatus as in claim 16, wherein the digital content represents a media stream including at least one of:

a movie, animation, sound, still media, a picture, an illustration, a database, a collection of information.

23. Apparatus as in claim 16, wherein the relatively-higher degree of security includes tamper-resistant hardware operating under control of verified software.

24. Apparatus as in claim 16, wherein

the digital content represents a first media stream and a second media stream,

the decoder being responsive to the formatting information and the decryptor being responsive to a selected key,

the selected key providing differential access to selected users to the first media stream and the second media stream.

25. Apparatus as in claim 24, wherein

the first media stream includes audio information and the second media stream includes video information;

the first media stream includes information in a first language and the second media stream includes information in a second language;

the first media stream includes presentation information targeted at a first type of audience and the second media stream includes information targeted at a first type of audience.

26. A method, including steps of

encoding a media stream into a digital content format representing that media stream, that digital content format having a set of information nodes, those information nodes being disposed in at least a partial ordering;

encrypting a portion of that digital content, the portion being encrypted less than the entire digital content format representing that media stream, the portion of the digital content that is encrypted being required for presentation of the media stream;

wherein the unencrypted portion of that digital content is substantially closed in a direction under that partial ordering, whereby it is possible to decode the unencrypted portion of that digital content without having to decrypt it.