METHOD AND SYSTEM FOR SECURELY STREAMING CONTENT

• US 20090235347A1
• Filed: 03/12/2008
• Published: 09/17/2009
• Est. Priority Date: 03/12/2008
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Yahoo! Inc. (Apollo Global Management, Inc.)
• Inventors: Gade, Bhargavaram B., Syed, Omar, Khanin, Alex, Anipindi, Sastry, Ames, Robert, Polavarapu, Vinay, Syed, Ghousuddin, Juhnke, Karl, Lee, Mark Ray
• Granted Patent: US 8,555,367 B2
• Time in Patent Office: Days
• US Class Current: 726/10
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 65/70 Media network packetisation
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04N 21/2541 Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/26613 for generating or managing keys in general key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04
• CPC Class Codes: H04N 21/63345 by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 21/812 involving advertisement data advertising per se G06Q30/02
• CPC Class Codes: H04N 21/8193 dedicated tools, e.g. video decoder software or IPMP tool
• CPC Class Codes: H04N 21/8352 involving content or source identification data, e.g. Unique Material Identifier [UMID]

Abstract

A system and method for securely streaming media. The system includes a gateway server that receives requests for access to a secured data resource from an end users. The request include an authorization ticket and a referring website. The gateway server validates the authorization ticket using a secret key shared with the referring website, and validates the referring website by verifying that referring website is on a white-list for the secured data resource. The gateway server selects a data server to service the request, and formats a data server access request containing the data server location and data server request parameter data and transmits the data server access request to the end users. When end users transmit the data server access requests to a data server, the data server validates the request and transmits it to the end user.

Claims

1. A method comprising the steps of:

receiving a request for access to a secured data resource from an end user, the request comprising an authorization ticket and a referring website;

validating the authorization ticket;

validating the referring website;

selecting a data server to service the request;

formatting a data server access request, the data server access request comprising a data server location and data server request parameter data comprising an identifier for the secured data resource; and

transmitting the data server access request to the end user.

2. The method of claim 1 wherein the authorization ticket is validated using a secret key shared with the referring website.

3. The method of claim 2 wherein the authorization ticket is an MD5 signature.

4. The method of claim 1 wherein the referring website is validated by verifying that referring website is on a white-list for the secured data resource.

5. The method of claim 1 wherein the data server access request additionally comprises a second authorization ticket which is generated using at least a portion of the data server request parameter data and a secret key shared with the data server.

6. The method of claim 5 wherein the data server request parameter data additionally comprises data that indicates the second authorization ticket is only valid for one use on a data server.

7. The method of claim 5 wherein the request parameter data additionally comprises data that indicates the second authorization ticket is valid for a specified time interval, and additionally comprises data indicating the time the ticket was generated.

8. The method of claim 1 wherein the data server request parameter data is encrypted using a secret key shared with the data server.

9. The method of claim 1 wherein the request for access to a secured data resource additionally comprises information indicating the geographic location of the end user and the method comprises the additional steps of determining the geographic location of the end user and verifying that an end user from that geographic location is permitted to access the secured data resource.

10. The method of claim 5 comprising the additional steps of:

receiving the data server access request from the end user at the selected data server;

the selected data server validating the second authorization ticket;

the selected data server transmitting the secured data server resource to the end user.

11. The method of claim 10 wherein the second authorization ticket is validated using a secret key shared with a gateway server.

12. The method of claim 11 wherein the authorization ticket is an MD5 signature.

13. The method of claim 10 wherein the end user additionally transmits the referring website to the selected data server and the selected data server additionally validates the referring website:

14. The method of claim 13 wherein the referring website is validated by verifying that referring website is on a white-list for the secured data resource.

15. The method of claim 10 wherein the data server request parameter data additionally comprises data that indicates the second authorization ticket is only valid for one use on a data server and the selected data server verifies that the ticket has not been previously used.

16. The method of claim 10 wherein the request parameter data additionally comprises data that indicates the second authorization ticket is valid for a specified time interval, and additionally comprises data indicating the time the ticket was generated and the selected data server verifies that the ticket has not expired.

17. The method of claim 10 wherein the data server request parameter data is encrypted using a secret key shared with the data server.

22. The method of claim 10 wherein the data server request parameter data additionally comprises data that indicates the authorization ticket is only valid for one use on a data server and the method additionally comprises the step of verifying that the ticket has not been previously used.

23. The method of claim 10 wherein the data server request parameter data additionally comprises data that indicates the second authorization ticket is valid for a specified time interval, and additionally comprises data indicating the time the ticket was generated and the method additionally comprises the step of verifying that the ticket has not expired.

24. The method of claim 10 wherein the data server request parameter data is encrypted using a secret key shared with the data server.

18. A method comprising the steps:

receiving a data server access request from an end user, the data server access request comprising a data server location and data server request parameter data comprising an identifier for the secured data resource, an authorization ticket, and a referring website;

validating the authorization ticket;

validating the referring website;

transmitting the secured data server resource to the end user.

19. The method of claim 18 wherein the second authorization ticket is validated using a secret key shared with a gateway server.

20. The method of claim 19 wherein the authorization ticket is an MD5 signature.

21. The method of claim 18 wherein the referring website is validated by verifying that referring website is on a white-list for the secured data resource.

25. A computer-readable medium having computer-executable instructions for a method comprising the steps of:

receiving a request for access to a secured data resource from an end user, the request comprising an authorization ticket and a referring website;

validating the authorization ticket;

validating the referring website;

selecting a data server to service the request;

formatting a data server access request, the data server access request comprising a data server location and data server request parameter data comprising an identifier for the secured data resource; and

transmitting the data server access request to the end user.

26. The computer-readable medium of claim 25 wherein the authorization ticket is validated using a secret key shared with the referring website.

27. The computer-readable medium of claim 26 wherein the authorization ticket is an MD5 signature.

28. The computer-readable medium of claim 25 wherein the referring website is validated by verifying that referring website is on a white-list for the secured data resource.

29. The computer-readable medium of claim 26 wherein the data server access request additionally comprises a second authorization ticket which is generated using at least a portion of the data server request parameter data and a secret key shared with the data server.

30. The computer-readable medium of claim 29 wherein the data server request parameter data additionally comprises data that indicates the second authorization ticket is only valid for one use on a data server.

31. The computer-readable of claim 29 wherein the request parameter data additionally comprises data that indicates the second authorization ticket is valid for a specified time interval, and additionally comprises data indicating the time the ticket was generated.

32. The computer-readable of claim 25 wherein the data server request parameter data is encrypted using a secret key shared with the data server.

33. The computer-readable of claim 25 wherein the request for access to a secured data resource additionally comprises information indicating the geographic location of the end user and the method comprises the additional steps of determining the geographic location of the end user and verifying that an end user from that geographic location is permitted to access the secured data resource.

34. The computer-readable of claim 30 comprising the additional steps of:

receiving the data server access request from the end user at the selected data server;

the selected data server validating the second authorization ticket;

the selected data server transmitting the secured data server resource to the end user.

35. The computer-readable of claim 34 wherein the second authorization ticket is validated using a secret key shared with a gateway server.

36. The computer-readable of claim 35 wherein the authorization ticket is an MD5 signature.

37. The computer-readable of claim 34 wherein the end user additionally transmits the referring website to the selected data server and the selected data server additionally validates the referring website:

38. The computer-readable of claim 37 wherein the referring website is validated by verifying that referring website is on a white-list for the secured data resource.

39. The computer-readable of claim 34 wherein the data server request parameter data additionally comprises data that indicates the second authorization ticket is only valid for one use on a data server and the selected data server verifies that the ticket has not been previously used.

40. The computer-readable of claim 34 wherein the request parameter data additionally comprises data that indicates the second authorization ticket is valid for a specified time interval, and additionally comprises data indicating the time the ticket was generated and the selected data server verifies that the ticket has not expired.

41. The computer-readable of claim 34 wherein the data server request parameter data is encrypted using a secret key shared with the data server.

42. A computer-readable medium having computer-executable instructions for a method comprising the steps of:

receiving a data server access request from an end user, the data server access request comprising a data server location and data server request parameter data comprising an identifier for the secured data resource, an authorization ticket, and a referring website;

validating the authorization ticket;

validating the referring website;

transmitting the secured data server resource to the end user.

43. The computer-readable medium of claim 42 wherein the second authorization ticket is validated using a secret key shared with a gateway server.

44. The computer-readable medium of claim 43 wherein the authorization ticket is an MD5 signature.

45. The computer-readable medium of claim 42 wherein the referring website is validated by verifying that referring website is on a white-list for the secured data resource.

46. The computer-readable medium of claim 42 wherein the data server request parameter data additionally comprises data that indicates the authorization ticket is only valid for one use on a data server and the method additionally comprises the step of verifying that the ticket has not been previously used.

47. The computer-readable medium of claim 42 wherein the data server request parameter data additionally comprises data that indicates the second authorization ticket is valid for a specified time interval, and additionally comprises data indicating the time the ticket was generated and the method additionally comprises the step of verifying that the ticket has not expired.

48. The computer-readable medium of claim 42 wherein the data server request parameter data is encrypted using a secret key shared with the data server.

49. A system comprising:

a gateway server operatively connected to an end user, the gateway server comprising,

a receiving module that receives a request for access to a secured data resource from an end user, the request comprising an authorization ticket and a referring website,

a validation module that validates the authorization ticket and the referring website,

a selection module that selects a data server to service the request,

a request formatting module that formats a data server access request, the data server access request comprising a data server location and data server request parameter data comprising an identifier for the secured data resource,

a transmission module that transmits the data server access request to the end user.

50. The system of claim 49 wherein the authorization module validates the authorization ticket using a secret key shared with the referring website.

51. The system of claim 50 wherein the authorization ticket is an MD5 signature.

52. The system of claim 49 wherein the authorization module validates the referring website by verifying that referring website is on a white-list for the secured data resource.

53. The system of claim 49 wherein the data server access request additionally comprises a second authorization ticket which is generated by the request formatting module using at least a portion of the data server request parameter data and a secret key shared with the data server.

54. The system of claim 53 wherein the data server request parameter data additionally comprises data that indicates the second authorization ticket is only valid for one use on a data server.

55. The system of claim 53 wherein the request parameter data additionally comprises data that indicates the second authorization ticket is valid for a specified time interval, and additionally comprises data indicating the time the ticket was generated.

56. The system of claim 49 wherein the data server request parameter data is encrypted by the request formatting module using a secret key shared with the data server.

57. The system of claim 49 wherein the request for access to a secured data resource additionally comprises information indicating the geographic location of the end user and the authorization module additionally validates the geographic location of the end user by verifying that an end user from that geographic is permitted to access the secured data resource.

58. The system of claim 53 wherein the selected data server is operatively connected to the end user and further selected data server comprises,

a second receiving module that receives the data server access request from the end user;

a second validation module that validating the second authorization ticket; and

a second transmission module that transmits the secured data server resource to the end user.

59. The method of claim 58 wherein the second authorization ticket is validated by the second validation module using a secret key shared with a gateway server.

60. The method of claim 59 wherein the authorization ticket is an MD5 signature.

61. The method of claim 58 wherein the end user additionally transmits the referring website to the selected data server and the second validation module additionally validates the referring website:

62. The method of claim 61 wherein the referring website is validated by the second validation module by verifying that referring website is on a white-list for the secured data resource.

63. The method of claim 58 wherein the data server request parameter data additionally comprises data that indicates the second authorization ticket is only valid for one use on a data server and the second validation module verifies that the ticket has not been previously used.

64. The method of claim 58 wherein the request parameter data additionally comprises data that indicates the second authorization ticket is valid for a specified time interval, and additionally comprises data indicating the time the ticket was generated and the selected data server verifies that the ticket has not expired.

65. The method of claim 58 wherein the data server request parameter data is encrypted using a secret key shared with the data server.

66. A system comprising:

a gateway server operatively connected to an end user, the gateway server comprising;

a receiving module that receives a data server access request from an end user, the data server access request comprising a data server location and data server request parameter data comprising an identifier for the secured data resource, an authorization ticket, and a referring website;

a validation module that validates the authorization ticket and the referring website;

a transmission module that transmits the secured data server resource to the end user.

67. The system of claim 66 wherein the authorization ticket is validated by the validation module using a secret key shared with a gateway server.

68. The system of claim 67 wherein the authorization ticket is an MD5 signature.

69. The method of claim 66 wherein the referring website is validated by the validation module by verifying that referring website is on a white-list for the secured data resource.

70. The method of claim 66 wherein the data server request parameter data additionally comprises data that indicates the authorization ticket is only valid for one use on a data server and the validation module verifies that the ticket has not been previously used.

71. The method of claim 66 wherein the data server request parameter data additionally comprises data that indicates the second authorization ticket is valid for a specified time interval, and additionally comprises data indicating the time the ticket was generated and the validation module verifies that the ticket has not expired.

72. The method of claim 66 wherein the data server request parameter data was encrypted using a secret key shared by the data server with a gateway server.