Methods and Apparatus for Integrating Digital Rights Management (DRM) Systems with Native HTTP Live Streaming

• US 20130166906A1
• Filed: 12/22/2011
• Published: 06/27/2013
• Est. Priority Date: 12/22/2011
• Status: Active Grant

• Current Assignee: Adobe Inc.
• Original Assignee: Adobe Systems Incorporated (Adobe Inc.)
• Inventors: Swaminathan, Viswanathan, Kishore, Kelly Yoshikazu
• Granted Patent: US 8,806,193 B2
• Time in Patent Office: Days
• US Class Current: 713/155
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2463/062 applying encryption of the keys
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 65/612 for unicast
• CPC Class Codes: H04L 65/764 at the destination reformatting of additional data in video clients H04N21/4355
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04N 21/2541 Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/63345 by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 21/64322 IP
• CPC Class Codes: H04N 21/8355 involving usage data, e.g. number of copies or viewings allowed
• CPC Class Codes: H04N 21/8456 by decomposing the content in the time domain, e.g. in time segments

Abstract

Methods and apparatus for integrating digital rights management (DRM) systems with native HTTP live streaming. Several methods for integrating a DRM system with HTTP live streaming on an operating system (OS) platform are described. In each of these methods, a manifest is delivered to an application on a device; the application then accesses a remote DRM server to obtain a license and one or more keys for the content. The DRM server enforces the rights of the client in regard to the indicated content. The application may modify the manifest to indicate a method for obtaining the key. The application delivers the manifest to the OS, which uses the indicated method (e.g., a URL) to obtain the key. While similar, the methods primarily differ in the manner in which the OS is directed to obtain the key.

Claims

1. A method, comprising:

performing, by an application implemented on a device configured according to an operating system (OS) platform;

obtaining a manifest file, wherein the manifest file indicates content to be streamed to the device from a content server according to an HTTP (Hypertext Transfer Protocol) live streaming (HLS) protocol supported by the OS platform and further indicates metadata for the content;

accessing a digital rights management (DRM) server according to the metadata to obtain a license for the content and a key for decrypting the content;

modifying the manifest file to include a Uniform Resource Locator (URL) for obtaining the key; and

providing the modified manifest file to an OS platform module;

wherein the OS platform module obtains the key according to the URL indicated in the manifest file, obtains a data stream of the indicated content from the content server, and decrypts data in the stream according to the obtained key.

2. The method as recited in claim 1, further comprising the application locally storing the key in a file in a file storage area of the application, wherein the URL for obtaining the key is a file URL for the file that includes the key, and wherein the OS platform module obtains the key from the file according to the file URL.

3. The method as recited in claim 1, further comprising the application providing the key to a local HTTP server implemented on the device, wherein the URL for obtaining the key is a localhost URL for the local HTTP server that hosts the key, and wherein the OS platform module obtains the key from the local HTTP server according to the localhost URL via HTTP.

4. The method as recited in claim 1, further comprising the application providing the key to a local HTTPS (Hypertext Transfer Protocol Secure) server implemented on the device, wherein the URL for obtaining the key is a localhost URL for the local HTTPS server that hosts the key, and wherein the OS platform module obtains the key from the local HTTPS server according to the localhost URL via HTTPS.

5. The method as recited in claim 1, further comprising the application locally storing the key in a secure local store of the application, wherein the URL for obtaining the key is an application-defined URL for a module of the application, wherein the module of the application is configured to access the key from the secure local store, and wherein the OS platform module obtains the key from the module of the application according to the application-defined URL.

6. The method as recited in claim 1, wherein the key obtained from the DRM server is obtained as an encrypted key included in a token, wherein the URL for obtaining the key is a URL for a remote HTTPS (Hypertext Transfer Protocol Secure) service, wherein the token is included as a token parameter of the URL included in the manifest file, and wherein the OS platform module obtaining the key according to the URL comprises:

the OS platform module contacting the remote HTTPS service according to the URL; and

the remote HTTPS service decrypting the encrypted key included in the token parameter and returning the decrypted key to the OS platform module via HTTPS.

7. The method as recited in claim 6, wherein the application signs the token with a client signature, and wherein the remote HTTPS service verifies that the signature of the token matches identifying information for the client in the token.

8. The method as recited in claim 1, wherein the OS platform module is a media player module.

9. A device, comprising:

at least one processor; and

a memory comprising program instructions, wherein the program instructions are executable by the at least one processor to implement an operating system (OS) platform module and an application, wherein the application is operable to;

obtain a manifest file, wherein the manifest file indicates content to be streamed to the device from a content server according to a HTTP (Hypertext Transfer Protocol) live streaming (HLS) protocol supported by the OS platform and further indicates metadata for the content;

access a digital rights management (DRM) server according to the metadata to obtain a license for the content and a key for decrypting the content;

modify the manifest file to include a Uniform Resource Locator (URL) for obtaining the key; and

provide the modified manifest file to the OS platform module;

wherein the OS platform module is operable to obtain the key according to the URL indicated in the manifest file, obtain a data stream of the indicated content from the content server, and decrypt data in the stream according to the obtained key.

10. The device as recited in claim 9, wherein the application is further operable to locally store the key in a file in a file storage area of the application, wherein the URL for obtaining the key is a file URL for the file that includes the key, and wherein the OS platform module is operable to obtain the key from the file according to the file URL.

11. The device as recited in claim 9, wherein the program instructions are further executable by the at least one processor to implement a local HTTP server on the device, wherein the application is further operable to provide the key to the local HTTP server on the device, wherein the URL for obtaining the key is a localhost URL for the local HTTP server that hosts the key, and wherein the OS platform module is further operable to obtain the key from the local HTTP server according to the localhost URL via HTTP.

12. The device as recited in claim 9, wherein the program instructions are further executable by the at least one processor to implement a local HTTPS (Hypertext Transfer Protocol Secure) server on the device, wherein the application is further operable to provide the key to the local HTTPS server on the device, wherein the URL for obtaining the key is a localhost URL for the local HTTPS server that hosts the key, and wherein the OS platform module is further operable to obtain the key from the local HTTPS server according to the localhost URL via HTTPS.

13. The device as recited in claim 9, wherein the application is further operable to locally store the key in a secure local store of the application on the device, wherein the URL for obtaining the key is an application-defined URL for a module of the application, wherein the module of the application is configured to access the key from the secure local store, and wherein the OS platform module is further operable to obtain the key from the module of the application according to the application-defined URL.

14. The device as recited in claim 9, wherein the key obtained from the DRM server is obtained as an encrypted key included in a token, wherein the URL for obtaining the key is a URL for a remote HTTPS (Hypertext Transfer Protocol Secure) service, wherein the application is further operable to include the token as a token parameter of the URL included in the manifest file, and wherein, to obtain the key, the OS platform module is operable to contact the remote HTTPS service according to the URL, wherein the remote HTTPS service decrypts the encrypted key included in the token parameter and returns the decrypted key to the OS platform module via HTTPS.

15. The device as recited in claim 14, wherein the application is further operable to sign the token with a client signature, and wherein the remote HTTPS service verifies that the signature of the token matches identifying information for the client in the token.

16. A non-transitory computer-readable storage medium storing program instructions, wherein the program instructions are computer-executable to implement an application on a device configured according to an operating system (OS) platform, wherein the application is operable to:

obtain a manifest file, wherein the manifest file indicates content to be streamed to the device from a content server according to an HTTP (Hypertext Transfer Protocol) live streaming (HLS) protocol supported by the OS platform and further indicates metadata for the content;

access a digital rights management (DRM) server according to the metadata to obtain a license for the content and a key for decrypting the content;

modify the manifest file to include a Uniform Resource Locator (URL) for obtaining the key; and

provide the modified manifest file to an OS platform module;

wherein the OS platform module obtains the key according to the URL indicated in the manifest file, obtains a data stream of the indicated content from the content server, and decrypts data in the stream according to the obtained key.

17. The non-transitory computer-readable storage medium as recited in claim 16, wherein the application is further operable to locally store the key in a file in a file storage area of the application, wherein the URL for obtaining the key is a file URL for the file that includes the key, and wherein the OS platform module obtains the key from the file according to the file URL.

18. The non-transitory computer-readable storage medium as recited in claim 16, wherein the program instructions are further computer-executable to implement a local HTTP server on the device, wherein the application is further operable to provide the key to the local HTTP server on the device, wherein the URL for obtaining the key is a localhost URL for the local HTTP server that hosts the key, and wherein the OS platform obtains the key from the local HTTP server according to the localhost URL via HTTP.

19. The non-transitory computer-readable storage medium as recited in claim 16, wherein the program instructions are further computer-executable to implement a local HTTPS server on the device, wherein the application is further operable to provide the key to the local HTTPS server on the device, wherein the URL for obtaining the key is a localhost URL for the local HTTPS server that hosts the key, and wherein the OS platform module obtains the key from the local HTTPS server according to the localhost URL via HTTPS.

20. The non-transitory computer-readable storage medium as recited in claim 16, wherein the application is further operable to locally store the key in a secure local store of the application on the device, wherein the URL for obtaining the key is an application-defined URL for a module of the application, wherein the module of the application is configured to access the key from the secure local store, and wherein the OS platform module obtains the key from the module of the application according to the application-defined URL.

21. The non-transitory computer-readable storage medium as recited in claim 16, wherein the key obtained from the DRM server is obtained as an encrypted key included in a token, wherein the URL for obtaining the key is a URL for a remote HTTPS service, wherein the application is further operable to include the token as a token parameter of the URL included in the manifest file, and wherein, to obtain the key, the OS platform module contacts the remote HTTPS service according to the URL, wherein the remote HTTP service decrypts the encrypted key included in the token parameter and returns the decrypted key to the OS platform module via HTTPS.

22. The non-transitory computer-readable storage medium as recited in claim 21, wherein the application is further operable to sign the token with a client signature, and wherein the remote HTTP service verifies that the signature of the token matches identifying information for the client in the token.

23. The non-transitory computer-readable storage medium as recited in claim 16, wherein the application is operable to perform said obtaining the manifest file in response to the OS platform module requesting the manifest file according to an application-defined URL for a module of the application.