Media Player Security for Full Length Episodes

• US 20130219178A1
• Filed: 02/17/2012
• Published: 08/22/2013
• Est. Priority Date: 02/17/2012
• Status: Active Grant

• Current Assignee: CBS Interactive Inc. (Paramount Global (f/k/a ViacomCBS Inc.))
• Original Assignee: CBS Interactive Inc. (Paramount Global (f/k/a ViacomCBS Inc.))
• Inventors: Xiques, Christopher Peter, Dhruv, Jignesh Yashwant, Hsu, James Kong, Senanayake, Shalitha Arosha
• Granted Patent: US 9,215,065 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 65/612 for unicast
• CPC Class Codes: H04L 65/70 Media network packetisation
• CPC Class Codes: H04L 65/762 at the source reformatting of additional data in video distribution servers H04N21/2355
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps
• CPC Class Codes: H04N 21/23439 for generating different versions
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/8456 by decomposing the content in the time domain, e.g. in time segments

Abstract

A streaming video player and authentication server work in conjunction to provide secure streaming media. Player authentication is used to ensure that only users using an authorized media player authorized users can access and stream the media content. An encryption process protects unauthorized users from playing media streams that are intercepted between the content server and an authorized user. Additionally, timed tokens are used to ensure that a user authorized to access a stream during a specified time period cannot access the same stream at a later time when the user is no longer authorized.

Claims

1. A computer-implemented method for obtaining secure streaming media content, the method comprising:

obtaining from an authentication server responsive to a request for authentication of a media player, an encrypted security asset storing at least one security identifier in an encrypted format;

transmitting a request for a media stream to the authentication server, the request for the media stream including the encrypted security asset storing the at least one security identifier;

receiving from the authentication server responsive to the authentication server verifying the encrypted security asset, playlist information identifying a sequence of media segments in the requested media stream;

transmitting a request to the authentication server for a first media segment in the sequence of media segments based on the playlist information, the request for the first media segment including the encrypted security asset;

receiving a first encryption key for decrypting the first media segment in the sequence of media segments responsive to the authentication server verifying the encrypted security asset, the first encryption key obtained by the authentication server upon receiving the request for the first media segment and the first encryption key used to encrypt the first media segment;

receiving the first media segment encrypted using the first encryption key;

decrypting the first media segment using the first encryption key; and

playing the first media segment using the media player.

2. The method of claim 1, further comprising:

transmitting a request to the authentication server for a second media segment in the sequence of media segments based on the playlist information, the request for the second media segment including the encrypted security asset;

receiving a second encryption key for decrypting the second media segment in the sequence of media segments responsive to the authentication server verifying the encrypted security asset, the second encryption key dynamically generated by the authentication server upon receiving the request for the second media segment and the second encryption key used to encrypt the second media segment;

receiving the second media segment encrypted using the second encryption key;

decrypting the second media segment using the second encryption key; and

playing the second media segment using the media player.

3. The method of claim 1, further comprising:

transmitting a request to the authentication server to authenticate the media player, the request including the at least one security identifier of the media player.

4. A computer-implemented method for providing access to secure media content, the method comprising:

authenticating a media player executing on a client based on at least one security identifier transmitted from the client to an authentication server;

providing an encrypted security asset to the client, the encrypted security asset storing the at least one security identifier and storing a timestamp in an encrypted format;

receiving a request from the client for a media stream, the request for the media stream including the encrypted security asset storing the at least one security identifier;

responsive to verifying the security data in the encrypted security asset, providing playlist information identifying a sequence of media segments in the requested media stream; and

responsive to receiving a request for a first media segment in the sequence of media segments, obtaining a first encryption key for the first media segment and transmitting the first encryption key to the client, the first encryption key for decrypting the first media segment.

5. The method of claim 4, wherein the obtaining the first encryption key comprises:

dynamically generating the first encryption key responsive to receiving the request for the first media segment.

6. The method of claim 4, wherein the obtaining the first encryption key comprises:

requesting the encryption key from a static URL responsive to receiving the request for the first media segment.

7. The method of claim 4, wherein authenticating the media player comprises:

receiving a request from the client to authenticate the media player, the request including the at least one secret identifier of the media player;

comparing the at least one secret identifier against a whitelist storing identities of authentic media players;

authenticating the media player responsive to finding a match between the at least one secret identifier in the request and the whitelist.

8. The method of claim 4, wherein providing the playlist information comprises:

receiving a request for a master index together with the encrypted security asset;

responsive to verifying the encrypted security asset, transmitting the master index comprising links to one or more playlists, each of the one or more indexes corresponding to a different bit rate and each of the one or more playlists comprising links to the sequence of media segments.

9. The method of claim 8, further comprising:

receiving a request for the one or more playlists together with the encrypted security asset; and

responsive to verifying the encrypted security asset, transmitting the one or more playlists and links to encryption keys corresponding to entries of the one or more playlists.

10. The method of claim 4, wherein transmitting the one or more playlists and links to encryption keys comprises:

masking a link to the first encryption key by encrypting at least a portion of the link.

11. A computer-implemented method for obtaining secure streaming media content, the method comprising:

transmitting a sequence of requests for media segments corresponding to a media stream including a request for a first media segment, each request providing information to an authentication server indicating that the media player was previously authenticated;

receiving a first media segment in an encrypted format and a first encryption key for decrypting at least the first media segment in the sequence of media segments;

decrypting the first media segment using the first encryption key; and

playing the first media segment using the media player.

12. The method of claim 11, further comprising:

prior to transmitting the sequence of requests, requesting authentication of the media player using at least one security identifier of the media player; and

receiving verification that the media player is authenticated.

13. The method of claim 12, further comprising:

receiving an encrypted security asset from the authentication server responsive to the request for authentication, the encrypted security asset storing the at least one security identifier in encrypted form; and

transmitting the encrypted security asset to the authentication server together with each of the requests for the media segments.

14. The method of claim 13, wherein the encrypted security asset stores at least one of:

a player identifier associated with the media player, an application identifier associated with an application used to load the media player, a session identifier associated with a current execution of the media player, and a timestamp associated with a time of transmitting the request to authenticate the media player.

15. The method of claim 12, wherein requesting authentication of the media player comprises:

transmitting to the authentication server for verification at least one of;

a player identifier associated with the media player, an application identifier associated with an application used to load the media player, and a session identifier associated with a current execution of the media player.

16. The method of claim 11, wherein the encrypted security asset comprises an encrypted web cookie.

17. The method of claim 11, wherein the authentication server dynamically generates the first encryption key responsive to receiving the request for the first media segment.

18. The method of claim 11, wherein the authentication server obtains the encryption key from a static URL in response to receiving the request for the first media segment.

19. The method of claim 11, further comprising:

prior to transmitting the sequence of requests for the media segments, obtaining playlist information identifying the sequence of media segments in the requested media stream.

20. The method of claim 19, wherein obtaining the playlist information comprises:

transmitting a request for a master index together with an encrypted security asset storing the at least one security identifier in encrypted form;

receiving a master index comprising links to one more playlists, each of the one or more indexes corresponding to a different bit rate and each of the one or more playlists comprising links to the sequence of media segments;

requesting the one or more playlists; and

receiving the requested one or more playlists together with links to encryption keys, each encryption key corresponding to one or more of the media segments in the one or more playlists.