Global access control for segmented streaming delivery

• US 8,239,546 B1
• Filed: 09/26/2011
• Issued: 08/07/2012
• Est. Priority Date: 09/26/2011
• Status: Active Grant

• Current Assignee: Brightcove Incorporated
• Original Assignee: Unicorn Media, Inc. (Brightcove Incorporated)
• Inventors: McGowan, Albert John
• Primary Examiner(s): Luu, Le H
• Application Number:
  US13/245,324
• Time in Patent Office: 316 Days
• Field of Search: 709/227, 709/228, 709/229, 709/217, 709/218, 709/219, 709/231, 725/25, 725/87, 455/414.1, 713/170, 713/156, 380/281, 726/26
• US Class Current: 709/227
• CPC Class Codes: H04L 65/00 Network arrangements, protocols or services for supporting real-time applications in data packet communication real-time or near real-time messaging, e.g. instant messaging [IM] H04L51/04; selective video distribution H04N21/00
• CPC Class Codes: H04L 65/1066 Session management
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 65/1094 Inter-user-equipment sessions transfer or sharing
• CPC Class Codes: H04L 65/762 at the source reformatting of additional data in video distribution servers H04N21/2355
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/148 Migration or transfer of sessions
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Various arrangements for controlling access to streaming media assets are presented. Transmission of segments of a media asset to a first user device may be commenced. During transmission of the media asset to the first user device, beaconing data from the first user device may be received and stored as session information. The first user device may no longer be permitted to receive the media asset at least partially due to the first user device no longer being authenticated. Transmission of a remainder of the plurality of media segments to the first user device may be ceased such that the first user device does not receive the media asset in its entirety.

Claims

1. A method for controlling access to streaming media assets during streaming, the method comprising:

commencing transmission of a media asset to a first user device, wherein

the first user device is linked with a user account, and

transmission of the media asset comprises sequential transmission of a plurality of media segments;

receiving during transmission of the media asset to the first user device, beaconing data from the first user device;

storing session information linked with the first user device and the user account, wherein;

the session information is at least partially based on the beaconing data received from the first user device, and

the session information indicates the first user device and the user account have an active session of receiving the media asset;

receiving authentication information linked with a second user device and the user account while transmission of the media asset to the first user device is occurring;

determining the first user device is no longer permitted to receive the media asset at least partially due to the first user device no longer being permitted access to the media asset based on at least the session information; and

ceasing transmission of a remainder of the plurality of media segments to the first user device, wherein

ceasing transmission of the remainder of the plurality of media segments results in the first user device not receiving the media asset in its entirety.

2. The method for controlling access to streaming media assets during streaming of claim 1, the method further comprising:

receiving from the first user device, authentication information linked with the first user device and the user account;

transmitting at least a portion of the authentication information linked with the first user device and the user account to a content provider computer system; and

receiving from the content provider computer system, a response indicating the first user device is authorized to receive the media asset, wherein

the response, indicating the first user device is authorized to receive the media asset, is received prior to commencing transmission of the media asset to the first user device linked with the user account.

3. The method for controlling access to streaming media assets during streaming of claim 2, the method further comprising:

transmitting at least a portion of the authentication information linked with the second user device and the user account to the content provider computer system; and

receiving from the content provider computer system, a second response indicating the second user device is authorized to receive a second media asset.

4. The method for controlling access to streaming media assets during streaming of claim 2, the method further comprising:

commencing transmission of a second media asset to the second user device linked with the user account, wherein

transmission of the second media asset is commenced after transmission of the remainder of the plurality of media segments is ceased to the first user device.

5. The method for controlling access to streaming media assets during streaming of claim 1, the method further comprising:

receiving, from an authentication computer system, authentication information indicating that the first user device is permitted to receive the media asset, wherein

the authentication computer system determines the first user device and the user account are permitted to receive the media asset by transmitting a query to a content provider computer system and by receiving a response to the query from the content provider computer system indicating the first user device and the user account are authorized to receive the media asset.

6. The method for controlling access to streaming media assets during streaming of claim 1 wherein the media asset is a video accessible via a subscription.

7. The method for controlling access to streaming media assets during streaming of claim 1 wherein at least a subset of the plurality of media segments is encrypted when transmitted to the first user device.

8. A computer system for controlling access to streaming media assets during streaming, the computer system comprising:

a network interface;

a memory configured to store one or more of a plurality of media segments; and

a processor communicatively coupled with the memory and the network interface and configured to cause the computer system to;

cause transmission of a media asset to a first user device to commence, wherein

the first user device is linked with a user account, and

transmission of the media asset comprises sequential transmission of the plurality of media segments;

receive during transmission of the media asset to the first user device, beaconing data from the first user device;

store session information linked with the first user device and the user account, wherein;

the session information is at least partially based on the beaconing data received from the first user device, and

the session information indicates the first user device and the user account have an active session with the computer system; and

control access by any additional user devices linked with the user account to one or more streaming media assets at least while the session information, at least partially based on at least the session information, indicates the user account has the active session with the computer system, wherein

the one or more streaming media assets comprise the media asset.

9. The computer system for controlling access to streaming media assets during streaming of claim 8, wherein the processor is further configured to cause the computer system to:

receive, from the first user device, authentication information linked with the first user device and the user account;

cause at least a portion of the authentication information linked with the first user device and the user account to be transmitted to a content provider computer system; and

receive a response indicating the first user device is authorized to receive the media asset, wherein

the response indicating the first user device is authorized to receive the media asset is received prior to commencing transmission of the media asset to the first user device linked with the user account.

10. The computer system for controlling access to streaming media assets during streaming of claim 9, wherein the processor is further configured to cause the computer system to:

receive authentication information linked with a second user device and the user account; and

deny access to the second user device at least while the session information indicates the first user device linked with the user account has the active session with the computer system.

11. The computer system for controlling access to streaming media assets during streaming of claim 8, wherein the processor is further configured to cause the computer system to:

receive authentication information indicating that the first user device is permitted to receive the media asset, wherein

the authentication information is received from an authentication computer system, and

the authentication computer system determines the first user device and the user account are permitted to receive the media asset by transmitting a query to a content provider computer system and by receiving a response to the query from the content provider computer system indicating the first user device and the user account are authorized to receive the media asset.

12. The computer system for controlling access to streaming media assets during streaming of claim 8, wherein the processor is further configured to cause the computer system to:

receive authentication information linked with a second user device and the user account; and

cause transmission of a remainder of the plurality of media segments to the first user device to cease, wherein

ceasing transmission of the remainder of the plurality of media segments results in the first user device not receiving the media asset in its entirety.

13. The computer system for controlling access to streaming media assets during streaming of claim 12, wherein the processor is further configured to cause the computer system to:

cause transmission of a second media asset to the second user device linked with the user account to commence, wherein

transmission of the second media asset is commenced after the computer system ceases transmission of the remainder of the plurality of media segments to the first user device.

14. The computer system for controlling access to streaming media assets during streaming of claim 8, wherein the media asset is a video accessible via a subscription.

15. The computer system for controlling access to streaming media assets during streaming of claim 8, wherein at least a subset of the plurality of media segments is encrypted when transmitted to the first user device.

16. A computer program product residing on a non-transitory processor-readable medium and comprising processor-readable instructions configured to cause a processor to:

cause transmission of a media asset to a first user device to commence, wherein

the first user device is linked with a user account, and

transmission of the media asset comprises sequential transmission of a plurality of media segments;

receive during transmission of the media asset to the first user device, beaconing data from the first user device;

store session information linked with the first user device and the user account, wherein;

the session information is at least partially based on the beaconing data received from the first user device, and

the session information indicates the first user device and the user account have an active session with the computer system; and

control access by any additional user devices linked with the user account to one or more streaming media assets at least while the session information, based on at least the session information, indicates the user account has the active session with the computer system, wherein

the one or more streaming media assets comprise the media asset.

17. The computer program product of claim 16 wherein the processor-readable instructions further comprise processor-readable instructions configured to cause the processor to:

receive from the first user device, authentication information linked with the first user device and the user account;

cause at least a portion of the authentication information linked with the first user device and the user account to be transmitted to a content provider computer system; and

receive a response indicating the first user device is authorized to receive the media asset, wherein

the response indicating the first user device is authorized to receive the media asset is received prior to commencing transmission of the media asset to the first user device linked with the user account.

18. The computer program product of claim 16 wherein the processor-readable instructions further comprise processor-readable instructions configured to cause the processor to:

receive authentication information indicating that the first user device is permitted to receive the media asset, wherein

the authentication information is received from an authentication computer system, and

the authentication computer system determines the first user device and the user account are permitted to receive the media asset by transmitting a query to a content provider computer system and by receiving a response to the query from the content provider computer system indicating the first user device and the user account are authorized to receive the media asset.

19. The computer program product of claim 16 wherein the processor-readable instructions further comprise processor-readable instructions configured to cause the processor to:

receive authentication information linked with a second user device and the user account; and

deny access to the second user device at least while the session information indicates the first user device linked with the user account has the active session with the computer system.

20. The computer program product of claim 16 wherein the processor-readable instructions further comprise processor-readable instructions configured to cause the processor to:

receive authentication information linked with a second user device and the user account; and

cause transmission of a remainder of the plurality of media segments to the first user device to cease, wherein

ceasing transmission of the remainder of the plurality of media segments results in the first user device not receiving the media asset in its entirety.