Method and apparatus to control access to content

• US 7,953,079 B2
• Filed: 06/04/2007
• Issued: 05/31/2011
• Est. Priority Date: 06/04/2007
• Status: Active Grant

• Current Assignee: Cisco Systems, Inc.
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: John, Sunil Shashikanthan, Tasker, Michael Edric
• Primary Examiner(s): Shah; Chirag G
• Assistant Examiner(s): Rivas; Salvador E
• Application Number:
  US11/810,134
• Publication Number:
  US 20080298358A1
• Time in Patent Office: 1,457 Days
• Field of Search: None
• US Class Current: 370/389
• CPC Class Codes: H04H 2201/80 characterised in that motion picture association of America [MPAA] ratings are used
• CPC Class Codes: H04H 60/23 using cryptography, e.g. encryption, authentication, key distribution
• CPC Class Codes: H04N 21/26603 for automatically generating descriptors from content, e.g. when it is not made available by its provider, using content analysis techniques
• CPC Class Codes: H04N 21/435 Processing of additional data, e.g. decrypting of additional data, reconstructing software from modules extracted from the transport stream
• CPC Class Codes: H04N 21/4381 Recovering the multiplex stream from a specific network, e.g. recovering MPEG packets from ATM cells transmission of MPEG streams over ATM H04L12/5601
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/4532 involving end-user characteristics, e.g. viewer profile, preferences monitoring of user activities for profile generation for accessing a video database G06F16/739; user profiles in network data switching protocols H04L67/306; processing of user preferences or user profiles in wireless networks H04W8/18
• CPC Class Codes: H04N 21/4627 Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/64322 IP

Abstract

The present invention provides a method, apparatus and computer program product for accessing content via a packet-switched network based on a content access policy. The content is marked with a rating. The rating is extracted from the content, to verify conformance with the content access policy. On verification of the conformance between the rating and the content access policy, access to the marked content is provided.

Claims

1. A method comprising:

programming into a network infrastructure device a content access policy for a content consumer device;

receiving content data packets that are addressed to the content consumer device via a packet switched network at the network infrastructure device,

wherein each content data packet is encoded with a content classification and rating in an address region of the content data packet headers, wherein the content classification and rating are encoded within a source address, a source port number, a destination port number, and a destination address of a content packet header;

extracting the content classification and rating from each encoded content data packet;

verifying that the content classification and rating for each encoded content data packet conforms with the content access policy; and

providing access to each encoded content data packet upon verifying that each encoded content data packet conforms with the content access policy.

2. The method according to claim 1, wherein receiving comprises receiving encoded content data packets in accordance with the Internet Protocol Suite.

3. The method according to claim 1, wherein programming comprises programming the content access policy for the content consumer device via the network infrastructure device.

4. The method according to claim 1, wherein the encoded content classification and rating comprise at least one of a television rating and a content description that indicates the subject matter contained in the encoded content data packets.

5. The method according to claim 1, wherein extracting further comprises:

identifying one or more numeric fields in the address region of each content data packet in which the content classification and rating is encoded; and

identifying the content classification and rating based on values of the one or more numeric fields.

6. The method according to claim 1, further comprising encrypting the content data packets using a security key.

7. The method according to claim 6, wherein providing access to each content data packet upon verification comprises providing access to the security key.

25. The method of claim 3, further comprising defining the content access policy using a Graphical User Interface (GUI) or a Command Line Interface (CLI), wherein defining comprises selecting a user and one or more content access parameters for the selected user according to a hierarchical filter that defines content preferences based on one or more content sub-classifications.

26. The method of claim 25, and further comprising displaying on a display device selection options for the one or more content access parameters comprising user identifier, a plurality of content classifications, content sub-classifications and a plurality of program ratings, and wherein selecting the one or more content access parameters comprises selecting, for a selected one of a plurality of users, at least one allowed program rating among the plurality of program ratings, a content preference among the plurality of content classifications or content sub-classifications, and user information for the selected user, wherein the user information includes one or more of Internet Protocol (IP) address, Media Access Control (MAC) address, age, name, location and billing information.

8. A method comprising:

identifying a content classification of the content of a data packet using a content rating module of a content distribution device, wherein the data packet comprises a header that enables the data packet to be transmitted over a packet-switched network;

selecting a rating based on the content of the data packet; and

encoding the content classification and the rating within a source address, a source port number, a destination port number, and a destination address of a data packet header.

9. The method according to claim 8, further comprising transmitting the content data packet over the packet switched network.

10. The method according to claim 8, wherein encoding comprises encoding the content classification and the rating in the data packet header comprising an Internet Protocol (IP) header.

11. The method according to claim 10, wherein encoding comprises dynamically encoding the content classification and rating into numeric fields of the data packet IP header.

12. The method according to claim 10, wherein encoding comprises sub-dividing an address region of the header into a predetermined number of bit fields that may be used to classify content according to one or more sub-classifications comprising content rating, subject matter type, subject matter sub-types, and a geographic location associated with a content type or sub-type to form a hierarchical content classification.

27. The method of claim 8, wherein identifying comprises identifying the content classification using image recognition.

28. The method of claim 11, wherein dynamically encoding comprises dynamically updating the rating using a dynamic content classification scheme and further comprising:

querying a content distributor to determine whether or not the dynamic content classification scheme is still valid; and

in response to determining that the dynamic content classification scheme is not valid, querying the content distributor for a current content classification scheme.

13. An apparatus comprising:

a network interface receiving module configured to receive content data packets that are addressed to a content consumer device via a packet switched network, wherein each content data packet is encoded with a content classification and rating in an address region of a header of the content data packets, wherein the content classification and rating are encoded within a source address, a source port number, a destination port number, and a destination address of a content packet header;

an access control device extraction module configured to;

extract the content classification and rating from each content data packet;

verify that the content classification and rating for each content data packet conforms with the content access policy; and

provide access to each content data packet upon verifying that each content data packet conforms with the content access policy.

14. The apparatus according to claim 13, wherein the access control device is further configured to encrypt the content data packets.

15. The apparatus according to claim 14, wherein the access control device comprises a security-key provider configured to provide access to the security key.

16. The apparatus according to claim 13, wherein the access control device is further configured to switch to alternate content when the content classification of the content data packet does not conform with the content access policy.

17. The apparatus according to claim 13, wherein the access control device extraction module is configured to extract the content classification and rating comprising at least one of a television rating and a content description that indicates the subject matter contained in the content data packets.

18. The apparatus according to claim 13, wherein the access control device is further configured to generate a user interface that is configured to allow the content access policy to be defined for the access control device and to generate a hierarchical filter that defines content preferences based on one or more sub-classifications contained in numeric fields of the address region of the corresponding content data packet headers.

19. The apparatus according to claim 18, wherein the access control device is configured to generate the user interface comprising one of a Graphical User Interface (GUI) and a Command Line Interface (CLI).

20. The apparatus according to claim 13, wherein the access control device is further configured to extraction module comprises:

identify one or more numeric fields in the address region of the content data packet headers in which the content classification and rating are encoded; and

identify the content classification and rating based upon the value of the one or more numeric fields.

21. The apparatus according to claim 20, wherein the access control device is further configured to interface with a database to lookup content ratings, classifications, and sub-classifications that correspond to the one or more numeric fields.

22. The apparatus according to claim 21, wherein the access control device is configured to interface with the database comprising one of a dynamic database, a content addressable database, and a web service based database.

23. The apparatus according to claim 13, wherein the network interface is configured to receive the content data packets comprising Internet Protocol data packets.

24. A non-transitory computer readable medium storing instructions that, when executed by a processor, cause the processor to:

program a content access policy for a content consumer device;

receive content data packets that are addressed to the content consumer device via a packet switched network, wherein the content classification and rating are encoded within a source address, a source port number, a destination port number, and a destination address of a header of a content data packet;

extract the content classification and rating from each encoded content data packet;

verify that the content classification and rating for each encoded content data packet conforms with the content access policy; and

provide access to each encoded content data packet upon verifying that each encoded content data packet conforms with the content access policy.