Process and streaming server for encrypting a data stream to a virtual smart card client system

• US 7,299,292 B2
• Filed: 10/01/2004
• Issued: 11/20/2007
• Est. Priority Date: 03/29/2002
• Status: Expired due to Term

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Widevine Technologies Incorporated (Alphabet Inc.)
• Inventors: Morten, Glenn A., Baker, Brian
• Primary Examiner(s): Vaughn; William
• Assistant Examiner(s): MESFIN, YEMANE
• Application Number:
  US10/957,081
• Publication Number:
  US 20050120125A1
• Time in Patent Office: 1,145 Days
• Field of Search: 709/231, 709/232, 709/229, 713/159, 713/168, 713/170, 713/182, 713/185, 726/2, 726/20, 726/3, 725/87, 725/91
• US Class Current: 709/231
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0457 wherein the sending and receiving network entities apply dynamic encryption, e.g. stream encryption cryptographic mechanisms or cryptographic arrangements for stream encryption H04L9/065
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/612 for unicast
• CPC Class Codes: H04L 65/70 Media network packetisation
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/25866 Management of end-user data customer care in data networks H04L41/5077
• CPC Class Codes: H04N 21/26606 for generating or managing entitlement messages, e.g. Entitlement Control Message [ECM] or Entitlement Management Message [EMM] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/47202 for requesting content on demand, e.g. video on demand
• CPC Class Codes: H04N 21/6125 involving transmission via Internet transmission by internet of broadcast information H04H60/82
• CPC Class Codes: H04N 21/6587 Control parameters, e.g. trick play commands, viewpoint selection
• CPC Class Codes: H04N 7/163 by receiver means only
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58
• CPC Class Codes: H04N 7/17318 : Direct or substantially direct transmission and handling of requests

Abstract

There is disclosed a process for encrypting a data stream to secure the data stream for single viewing and to protect copyrights of the data stream. Specifically, there is disclosed a process for protecting streaming multimedia, entertainment and communications in a network transmission. There is further disclosed a streaming server component operably connected with a streaming server that interacts with a client system that includes a virtual smart card to effect the inventive process.

Claims

1. A system for communicating a data stream over a network, comprising:

a client device that is configured to perform actions, including;

enabling a request for the data stream;

a virtual smart card coupled to the client device, the virtual smart card being configured to perform actions, including;

sending a token associated with the requested data stream;

receiving the requested data stream, wherein the requested stream is encrypted; and

providing a flow control metric associated with the data stream; and

a streaming server that is configured to perform actions, including;

validating the token for the requested data stream, and if the token is valid for the requested data stream,

flowing the encrypted data stream to the virtual smart card, and

employing the flow control metric from the virtual smart card, in part, to control the flow of the encrypted data stream over the network to maintain a substantially full buffer associated with the virtual smart card.

2. The system of claim 1, wherein the virtual smart card further comprises a token manager that is configured to negotiate with the streaming server for the token.

3. The system of claim 1, wherein validating the token for the requested data stream further comprises validating an identifier associated with a location of the data stream with the provided token.

4. The system of claim 1, wherein the virtual smart card further comprises a flow control module that is configured to monitor at least one of a network statistic, and a buffer characteristic to determine the flow control metric.

5. The system of claim 1, wherein the virtual smart card further comprises a binding module that is configured to uniquely associate the virtual smart card to the client device.

6. The system of claim 1, wherein the streaming server is configured to perform further actions, including negotiating encryption keys with the virtual smart card for use in encrypting the requested data stream.

7. The system of claim 6, wherein the virtual smart card further comprises a token manager that is configured to interact with the streaming server to negotiate the encryption keys.

8. The system of claim 7, wherein the virtual smart card further comprises a token storage module that is configured to store at least one of the user information, the token, a URI, and the encryption keys.

9. The system of claim 1, wherein the token further comprises a digital certificate.

10. The system of claim 1, wherein the data stream is provided to the client device such that is viewable for a predetermined number of viewings.

11. A computer readable storage medium for managing a data stream over a network, the computer readable storage medium having computer executable instructions stored thereon that when installed into a server enables the server to perform action, comprising:

receiving a request for the data stream from a client having a virtual smart card;

receiving, from the virtual smart card, a token that is associated with the requested data stream;

enabling a determination of validity of the token for the requested data stream;

if the token is valid for the requested data stream,

enabling a negotiation for an encryption key with the virtual smart card;

enabling an encryption of the data stream as the data stream is streamed to the client, wherein the data stream is encrypted using the negotiated encryption key;

providing, by the virtual smart card, a flow control metric associated with the encrypted data stream; and

controlling, by the server, over the network a rate of flow of the encrypted data stream to the client, wherein the server employs the flow control metric, in part, to control the rate of flow of the encrypted data stream to maintain a substantially full client buffer.

12. The computer readable storage medium of claim 11, wherein the data stream is configured for a single viewing.

13. The computer readable storage medium of claim 11, wherein controlling the rate of flow further comprises transmitting the encrypted data stream to the client at substantially the same rate as the encrypted data stream is received by the client.

14. The computer readable storage medium of claim 11, wherein providing the flow control metric further comprises monitoring at least one of a network statistic, and a client buffer characteristic.

15. A client device for use in receiving a data stream over a network, comprising:

a user interface that is configured to perform actions, including;

enabling a request for the data stream; and

a virtual smart card, coupled to the user interface, configured to perform actions, including;

negotiating a token associated with the requested data stream;

employing the token to enable a validation of the request for the data stream;

if the request is valid, receiving the data stream from a server that is configured to deliver the data stream at a rate of flow that maintains a substantially full client buffer in the client device; and

providing a metric to the server to be employable by the server to control the rate of flow of the data stream so as to maintain the substantially full client buffer.

16. The client device of claim 15, wherein the user interface is configured to perform further actions, comprising:

enabling a user selected time limit for accessing the data stream to be provided to the server, wherein the user selected time limit is associated with the negotiated token such that the access to the data stream is denied upon expiration of the time limit.

17. The client device of claim 15, wherein the token includes user permissions for the requested data stream.

18. The client device of claim 17, wherein the user information includes user account information.

19. The client device of claim 15, wherein the token includes a user selected time limit for accessing the data stream, wherein access to the data stream is denied upon expiration of the user selected time limit.

20. The client device of claim 15, wherein the received data stream is encrypted using at least one of DES, Triple-DES, and AES encryption.

21. The client device of claim 15, wherein the virtual smart card is uniquely bound to the client device.

22. The client device of claim 15, wherein the virtual smart card further comprises a tamper protection module that is configured to detect and to protect from tampering of the virtual smart card.

23. The client device of claim 15, wherein the virtual smart card includes the client buffer.

24. A method for communicating a data stream over a network, comprising:

requesting the data stream;

employing a virtual smart card that is bound to a client device to negotiate a token associated with the requested data stream;

employing the negotiated token to enable a validation of the request for the data stream;

if the request is valid, receiving the data stream from a server that is configured to deliver the data stream at a rate of flow that maintains a client buffer substantially full; and

providing, by the virtual smart card, a metric to the server to be employable by the server, in part, to control the rate of flow of the data stream so as to maintain the substantially full client buffer.

25. The method of claim 24, further comprising:

employing a token manager associated with the virtual smart card to interact with the server to negotiate encryption keys useable to encrypt the data stream as the data stream is streamed to the client device.

26. The method of claim 24, wherein the virtual smart card further comprises a token storage module that is configured to store at least one of the user information, the token, a URI, and the encryption keys.

27. An apparatus for receiving a data stream over a network, comprising:

a means for requesting the data stream;

a means for negotiating a token associated with the requested data stream, wherein the token is employable to enable the request to be validated to receive the data stream;

a means for receiving the requested data stream if the request is valid, wherein the requested stream is encrypted;

a means for providing a flow control metric associated with the received data stream; and

a means for receiving the encrypted data stream in a controlled flow from a server, wherein the server is configured to employ the flow control metric, in part, to control the flow of the encrypted data stream over the network to maintain a substantially full buffer in the apparatus.