CONTROLLING ACCESS TO DATA STREAMS

• US 20100058061A1
• Filed: 08/29/2008
• Published: 03/04/2010
• Est. Priority Date: 08/29/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Folta, Florin, Smirnov, Serge, Kotteri, Kishore
• Granted Patent: US 8,099,599 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: H04L 2209/16 Obfuscation or hiding, e.g. involving white box
• CPC Class Codes: H04L 2209/30 Compression, e.g. Merkle-Damgard construction
• CPC Class Codes: H04L 9/065 Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords

Abstract

Access to one or more data streams can be controlled by encrypting a description of how segments of the data streams can be assembled, for example, to produce an audio or video program. Access to the one or more data streams can also be provided by obfuscating names of at least some of the segments in order to make it more difficult to determine the proper order for assembling the segments. In at least some embodiments, the data contained in at least some of the segments themselves is not encrypted.

Claims

1. A computer-implemented method comprising:

encrypting a first portion of a description of a plurality of unencrypted data segments, the plurality of unencrypted data segments forming a program, wherein the first portion of the description comprises an order for the plurality of unencrypted data segments;

obfuscating segment names for the plurality of unencrypted data segments; and

storing in one or more computer-readable storage media the encrypted first portion of the description of the plurality of unencrypted data segments, the obfuscated segment names for the plurality of unencrypted data segments, a second portion of the description of the plurality of unencrypted data segments comprising a key used for encrypting the first portion of the description, and the plurality of unencrypted data segments.

2. The computer-implemented method of claim 1, wherein the key used for encrypting the first portion of the description of the plurality of unencrypted data segments comprises a first key combined with a second key.

3. The computer-implemented method of claim 2, wherein the first key is associated with the program, and wherein the second key is associated with an encoder.

4. The computer-implemented method of claim 1, wherein the second portion of the description of the plurality of data segments further comprises:

a unique identifier;

a length of the key used for encrypting the first portion of the description of the plurality of unencrypted data segments; and

a key used for the obfuscating segment names for the plurality of unencrypted data segments.

5. The computer-implemented method of claim 4, wherein the second portion of the description of the plurality of data segments further comprises a size of the encrypted first portion of the description of the plurality of unencrypted data segments.

6. The computer-implemented method of claim 1, wherein the data segments form a first version of the program and a second version of the program, and wherein the first portion of the description comprises a first data segment order for the first version of the program and a second data segment order for the second version of the program.

7. The computer-implemented method of claim 6, wherein the first version of the program is compressed at a first bitrate and the second version of the program is compressed at a second bitrate.

8. The computer-implemented method of claim 1, wherein the second portion of the description of the plurality of unencrypted data segments is encrypted.

9. The computer-implemented method of claim 1, wherein the obfuscating segment names for the plurality of unencrypted data segments comprises generating one or more segment names based on one or more data from a pseudorandom sequence.

10. The computer-implemented method of claim 1, wherein the obfuscating segment names for the plurality of unencrypted data segments comprises:

generating a key for a selected segment based at least in part on a base key; and

encrypting the segment name of the selected segment using the generated key.

11. The computer-implemented method of claim 10, wherein the generating the key for the selected segment based at least in part on the base key comprises combining the base key with a portion of a name of the selected segment.

12. The computer-implemented method of claim 1, the method further comprising transmitting to a client computer the encrypted first portion of the description of the plurality of unencrypted data segments, the obfuscated segment names for the plurality of unencrypted data segments and the second portion of the description of the plurality of unencrypted data segments.

13. A computing device comprising:

a processor; and

one or more computer-readable storage media containing instructions configured to cause the computing device to perform a method comprising;

decrypting a description of a plurality of unencrypted data stream segments;

based on the decrypted description of the plurality of unencrypted data stream segments, de-obfuscating filenames for one or more of the plurality of the unencrypted data stream segments;

based on the de-obfuscated filenames, determining a presentation order for at least some of the plurality of unencrypted data stream segments; and

storing the presentation order in one or more computer-readable storage media.

14. The computing device of claim 13, the method further comprising displaying the at least some of the plurality of unencrypted data stream segments according to the presentation order.

15. The computing device of claim 13, wherein decrypting the description of the plurality of unencrypted data stream segments comprises:

decrypting a header portion of the description of the plurality of unencrypted data stream segments to obtain a key;

decrypting a manifest portion of the description of the plurality of unencrypted data stream segments using the obtained key; and

storing the decrypted manifest portion of the description of the assembling order in one or more computer-readable storage media.

16. The computing device of claim 13, wherein the de-obfuscating filenames for one or more of the plurality of the data stream segments comprises:

generating a key for a filename of a selected one of the plurality of unencrypted data stream segments, wherein the key is based on information contained in the decrypted description of the plurality of unencrypted data stream segments and one or more characteristics of the selected one of the plurality of unencrypted data stream segments;

decrypting the filename of the selected one of the plurality of unencrypted data stream segments using the generated key; and

storing the decrypted filename in one or more computer-readable storage media.

17. The computing device of claim 13, wherein the description of the plurality of unencrypted data stream segments comprises presentation orders for two or more data streams encoded at two or more bitrates.

18. One or more computer-readable storage media containing instructions configured to cause a computer to perform a method comprising:

obfuscating names of a plurality of data segments for a plurality of bitrate streams for transmitting a media program, wherein the data segments comprise unencrypted media program content;

encrypting a description of one or more assembling orders of the plurality of data segments for one or more of the plurality of bitrate streams; and

storing in one or more computer-readable storage media the encrypted description of the one or more assembling orders of the plurality of data segments, the encrypted names of the one or more of the plurality of data segments and the unencrypted media program content.

19. The one or more computer-readable media of claim 18, the method further comprising transmitting the encrypted description of the one or more assembling orders of the plurality of data segments to a remote computer.

20. The one or more computer-readable media of claim 18, the method further comprising transmitting the plurality of data segments to a remote computer in an order other than the one or more assembling orders.