System, method, and apparatus for securely providing content viewable on a secure device

• US 7,007,170 B2
• Filed: 01/20/2004
• Issued: 02/28/2006
• Est. Priority Date: 03/18/2003
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Widevine Technologies Incorporated (Alphabet Inc.)
• Inventors: Morten, Glenn A.
• Primary Examiner(s): Zand, Kambiz
• Application Number:
  US10/760,642
• Publication Number:
  US 20040184616A1
• Time in Patent Office: 770 Days
• Field of Search: 713/193, 380/45, 380/282, 380/285
• US Class Current: 713/193
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G11B 20/00086 Circuits for prevention of unauthorised reproduction or copying, e.g. piracy indicating unauthorised use of record carriers in general G11B23/28; scrambling for television signal recording H04N5/913; network architectures or network protocols for network security H04L63/00; cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
• CPC Class Codes: H04N 21/23473 by pre-encrypting
• CPC Class Codes: H04N 21/23476 by partially encrypting, e.g. encrypting the ending portion of a movie
• CPC Class Codes: H04N 21/4181 for conditional access
• CPC Class Codes: H04N 21/4182 for identification purposes, e.g. storing user identification data, preferences, personal settings or data restricting access to computer systems by authenticating users using a predetermined code in combination with an additional device, e.g. dongle or smart card G06F21/123
• CPC Class Codes: H04N 21/44055 by partially decrypting, e.g. decrypting a video stream that has been partially encrypted
• CPC Class Codes: H04N 21/44236 Monitoring of piracy processes or activities protecting computer platforms against harmful, malicious or unexpected behaviour or activities using intrusion detection and counter measures G06F21/566; computer virus detection and handling G06F21/56
• CPC Class Codes: H04N 21/4627 Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/4753 for user identification, e.g. by entering a PIN or password cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08
• CPC Class Codes: H04N 21/8352 involving content or source identification data, e.g. Unique Material Identifier [UMID]
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

A system, apparatus, and method are directed to providing and securely viewing secure content. In one embodiment, a secure player provides secure screening/previewing of secure content, such as a motion picture, by a member of an awards organization. A content key is employed to selectively encrypt at least a portion of a content stream. The content key is encrypted with a screener key. The encrypted content key is embedded into the secure content. The screener key is encrypted using public/private key pair that is bound to the secure player. The secure content may be distributed on a medium, such as a DVD, high definition DVD, and the like. The secure player is configured to receive the medium, screener key, and a screener identity. The screener identity and screener key are employed by the secure player to decrypt and enable secure viewing of the content.

Claims

1. A system for securely playing a content stream, comprising:

(a) a processor that is arranged to perform actions, including;

(1) selectively encrypting at least a portion of the content stream using a content key;

(2) encrypting the content key using a screener key; and

(3) encrypting the screener key using a public key; and

(b) a player that is arranged to receive the selectively encrypted content stream and encrypted screener key, and to perform actions, including;

(1) decrypting the encrypted screener key using a private key associated with the public key, wherein the public key and the private key are bound to the player such that the public key and the private key are unique to the player;

(2) decrypting the encrypted content key using the screener key; and

(3) decrypting the selectively encrypted content stream using the content key.

2. The system of claim 1, wherein the player is arranged to perform actions, further comprising, employing a user identity to enable access to the encrypted screener key.

3. The system of claim 1, wherein the player further comprises:

(a) an authentication module that is arranged to perform actions, including;

receiving a user identity;

authenticating the received user identity;

determining an authorization associated with the user identity; and

if the user identity is authorized to access the encrypted screener key, enabling the encrypted screener key to be retrieved.

4. The system of claim 1, wherein the encrypted screener key resides on at least one of a smart card, PCMCIA card, memory stick, DVD, CD, tape, and a floppy disc.

5. The system of claim 1, wherein selectively encrypting at least a portion of the content stream further comprises encrypting at least a portion of at least one of a video elementary stream (ES), audio ES, intra-frames (I-frames), forward predicted frames (P-frames), and bi-directional predicted frames (B-frames).

6. The system of claim 1, wherein selectively encrypting at least a portion of the content stream further comprises employing another content key to encrypt at least another portion of the content stream.

7. The system of claim 1, wherein selectively encrypting at least a portion of the content stream further comprises rotating through a plurality of content keys, each of which is employed to selectively encrypt a different portion of the content stream.

8. The system of claim 1, wherein the processor is arranged to perform further actions, including:

creating a key package that includes the encrypted content key; and

embedding the key package into the content stream.

9. An apparatus for securely playing content, comprising:

(a) a loader configured to receive a screener key associated with a selectively encrypted content stream, wherein the screener key is encrypted using a public key that is bound to the apparatus such that the public key is unique to the apparatus; and

(b) a decryption engine, coupled to the loader, that is configured to perform actions, including;

(1) receiving the selectively encrypted content stream;

(2) employing the loader to retrieve the screener key;

(3) decrypting the screener key using a private key associated with the public key, wherein the private key is constrained to the apparatus; and

(4) employing the screener key to decrypt a content key, wherein the content key enables decryption of the selectively encrypted content stream.

10. The apparatus of claim 9, wherein the loader is configured to perform actions, further comprising:

(a) receiving a request for access to the screener key from the decryption engine;

(b) requesting authorization to provide access, from an authentication module; and

(c) if authorization is received, providing the encrypted screener key to the decryption engine.

11. The apparatus of claim 9, wherein the loader is further configured to store another screener key on a screener key module.

12. The apparatus of claim 11, wherein the screener key module comprises at least one of a smart card, PCMCIA card, memory stick, DVD, CD, tape, and a floppy disc.

13. The apparatus of claim 9, wherein the private key and public key associated with the apparatus are generated by a Federal Information Processing Standard (FIPS) level 4 device.

14. The apparatus of claim 9, further comprising a tamper agent configured to monitor for an unauthorized action and, if an unauthorized action is detected, to provide a response to the unauthorized action.

15. The apparatus of claim 14, wherein the response to the unauthorized action further comprises at least one of erasing the selectively encrypted content stream, locking the apparatus from an operation, erasing the private key, erasing the screener key, and reporting the unauthorized action.

16. A method for creating secure content for use in a player, the method comprising:

(a) selectively encrypting at least a portion of a content stream using a content key;

(b) generating a key package comprising the content key;

(c) encrypting the key package using a screener key;

(d) encrypting the screener key employing a public key bound to the player such that the public key is unique to the player;

(e) embedding the encrypted key package into the selectively encrypted content stream.

17. The method of claim 16, further comprising, copying the selectively encrypted content stream including the embedded key package onto a content media.

18. The method of claim 17, wherein the content media further comprises at least one of a DVD, high definition DVD, Video Compact Disc (VCD), Super VCD (SVCD), Super Audio CD (SACD), Dynamic Digital Sound (DDS) media, Read/Write DVD, and a CD-Recordable (CD-R).

19. The method of claim 16, wherein the content key is generated employing a encryption/decryption algorithm comprising at least one of Advanced Encryption Standard (AES), RSA, International Data Encryption Algorithm (IDEA), and Data Encryption Standard (DES) algorithm.

20. The method of claim 16, wherein the key package further comprises at least one of synchronization information that indicates a relationship between the content key and the selectively encrypted content stream, and a content identifier associated with the content stream.

21. The method of claim 16, wherein the key package further comprises a content identifier associated with the content stream, wherein the content identifier remains unencrypted.

22. The method of claim 16, further comprising, storing the encrypted screener key in a screener key module, wherein the screener key module is removable from the player.

23. The method of claim 16, wherein the screener key module further comprises at least one of a content identifier associated with the selectively encrypted content stream, an access constraint, and a fulfillment right.

24. The method of claim 16, wherein selectively encrypting at least a portion of a content stream further comprises selecting for encryption at least a portion of at least one of a video elementary stream (ES), audio ES, intra-frames (I-frames), forward predicted frames (P-frames), and bi-directional predicted frames (B-frames).

25. The method of claim 16, wherein the screener key is generated employing a encryption/decryption algorithm comprising at least one of an Advanced Encryption Standard (AES), RSA, International Data Encryption Algorithm (IDEA), Skipjack, RC4, and a Data Encryption Standard (DES) algorithm.

26. The method of claim 16, wherein selectively encrypting at least a portion of a content stream further comprises partitioning the content stream into content units.

27. A method for securely playing a content stream, comprising:

(a) receiving the content stream, wherein the content stream comprises at least one selectively encrypted content unit;

(b) receiving a key package, wherein the key package is encrypted using a screener key;

(c) retrieving the screener key, wherein the retrieved screener key is encrypted using a public key;

(d) decrypting the retrieved screener key using a private key associated with the public key wherein the private key is constrained to a content stream player such that the public key and the private key are unique to the content stream player;

(e) decrypting the key package using the decrypted screener key; and

(f) decrypting at least one selectively encrypted content unit using the decrypted content key.

28. The method of claim 27, wherein the decrypted content unit comprises a compressed content unit, further comprising, decompressing the compressed content unit.

29. The method of claim 27, wherein retrieving the screener key further comprises, determining an authorization to retrieve the screener key.

30. The method of claim 27, wherein the selectively encrypted content unit further comprises at least a portion of at least one of a video elementary stream (ES), audio ES, intra-frames (I-frames), forward predicted frames (P-frames), and bi-directional predicted frames (B-frames).

31. The method of claim 27, wherein the screener key is generated employing a encryption/decryption algorithm comprising at least one of an Advanced Encryption Standard (AES), RSA, International Data Encryption Algorithm (IDEA), Skipjack, RC4, and a Data Encryption Standard (DES) algorithm.

32. A computer-readable medium encoded with a data structure for use in securing content, the data structure comprising:

a first data field comprising at least one selectively encrypted content unit from a content stream;

a second data field comprising a key package, wherein the key package comprises at least one content key for decrypting the at least one selectively encrypted content unit, and a content identifier associated with the content stream, wherein the at least one content key is encrypted using a screener key, the screener key being encrypted using a public key bound to a targeted player such that the public key is unique to the targeted player.

33. The computer-readable medium of claim 32, wherein the key package further comprises an access constraint associated with the content stream.

34. The computer-readable medium of claim 32, wherein the second data field is interspersed between at least two content units.

35. The computer-readable medium of claim 32, wherein the content key is generated employing a encryption/decryption algorithm comprising at least one of Advanced Encryption Standard (AES), RSA, International Data Encryption Algorithm (IDEA), and Data Encryption Standard (DES) algorithm.

36. The computer-readable medium of claim 32, wherein the key package further comprises synchronization information that indicates a relationship between at least one content key and the selectively encrypted content unit.

37. The computer-readable medium of claim 32, wherein the selectively encrypted content unit further comprises at least a portion of at least one of a video elementary stream (ES), audio ES, intra-frames (I-frames), forward predicted frames (P-frames), and bi-directional predicted frames (B-frames).

38. The computer-readable medium of claim 32, wherein the content stream further comprises a plurality of content units, at least one content unit being of a different length.