Self-keyed protection of anticipatory content

• US 8,516,253 B1
• Filed: 01/18/2011
• Issued: 08/20/2013
• Est. Priority Date: 01/18/2010
• Status: Active Grant

• Current Assignee: ViaSat Incorporated
• Original Assignee: ViaSat Incorporated
• Inventors: Sebastian, William B., Newman, Dan
• Primary Examiner(s): Homayounmehr, Farid
• Assistant Examiner(s): Tsang, Henry
• Application Number:
  US13/008,765
• Time in Patent Office: 945 Days
• Field of Search: None
• US Class Current: 713/168
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords

Abstract

Systems and methods are provided to facilitate anticipatory pushing of content to clients of a communications network in such a way that the content is unusable by the anticipatory clients until explicitly requested. Embodiments apply one or more self-keying techniques to a content dataset to generate an anticipatory dataset, such that the anticipatory dataset cannot be used to reconstruct the content dataset without a keying dataset that also can only be generated using the content dataset. The anticipatory dataset is pre-pushed to a client in anticipation of a future request for the content. If and when the client subsequently issues a request for the content dataset, the server intercepts the new copy of the content dataset received in response to the request, uses the content dataset to generate the keying dataset, and communicates the keying dataset to the client for local reconstruction of the content dataset by the client.

Claims

1. A method comprising:

receiving a first copy of a content dataset at a proxy server of a communications network without a corresponding request for the content dataset from a first client terminal over the communications network;

calculating an anticipatory dataset as a function of the content dataset, such that the anticipatory dataset represents at least a portion of the content dataset but cannot be used to reconstruct the content dataset without a keying dataset that is also calculated from the content dataset;

communicating the anticipatory dataset to the first client terminal from the proxy server over the communications network for anticipatory storage of the anticipatory dataset local to the first client terminal; and

subsequent to communicating the anticipatory dataset to the first client terminal;

intercepting a second copy of the content dataset at the proxy server, the second copy of the content dataset being communicated to the first client terminal in response to a content request issued by the first client terminal for the content dataset;

calculating the keying dataset as a function of the second copy of the content dataset at the proxy server; and

communicating the keying dataset from the proxy server to the client terminal for use by the first client terminal in locally reconstructing the content dataset as a function of the keying dataset and the anticipatory dataset;

wherein calculating the keying dataset comprises extracting a hold-back portion of the content dataset to use as the keying dataset; and

wherein calculating the anticipatory dataset as a function of the content dataset comprises removing the hold-back portion of the content dataset to generate the anticipatory dataset, so that the anticipatory dataset cannot be used to reconstruct the content dataset without the keying dataset.

2. The method of claim 1, wherein calculating the anticipatory dataset as a function of the content dataset comprises:

encrypting the content dataset to generate the anticipatory dataset in such a way that the anticipatory dataset cannot be used to reconstruct the content dataset without decrypting the anticipatory dataset as a function of the keying dataset.

3. The method of claim 1, wherein:

calculating the anticipatory dataset as a function of the content dataset comprises encrypting the content dataset to generate the anticipatory dataset in such a way that the content dataset is reconstructable by decrypting the anticipatory dataset as a function of the keying dataset.

4. The method of claim 1, wherein receiving the first copy of the content dataset at the proxy server of the communications network without the corresponding request for the content dataset from the client terminal over the communications network comprises intercepting the first copy of the content dataset at the proxy server, the first copy of the content dataset being communicated to a second client terminal in response to a content request issued by the second client terminal for the content dataset.

5. The method of claim 4, further comprising:

calculating the keying dataset as a function of the first copy of the content dataset at the proxy server; and

communicating the anticipatory dataset and the keying dataset to the second client terminal from the proxy server over the communications network for local reconstruction at the second client terminal of the content dataset as a function of the keying dataset and the anticipatory dataset in response to the content request issued by the second client terminal for the content dataset.

6. The method of claim 5, wherein communicating the anticipatory dataset and the keying dataset to the second client terminal from the proxy server over the communications network comprises:

multicasting the anticipatory dataset to at least the first client terminal and the second client terminal; and

unicasting the keying dataset only to the first client terminal.

7. The method of claim 5, further comprising:

removing the first copy of the content dataset and the keying dataset from the proxy server subsequent to communicating the anticipatory dataset and the keying dataset to the second client terminal and prior to receiving a content request issued by the first client terminal for the content dataset.

8. The method of claim 4, further comprising:

communicating the first copy of the content dataset to the second client terminal from the proxy server over the communications network in response to the content request issued by the second client terminal for the content dataset.

9. The method of claim 1, further comprising:

removing the first copy of the content dataset from the proxy server subsequent to communicating the anticipatory dataset to the first client terminal.

10. The method of claim 1, further comprising:

determining that the second copy of the content dataset is equivalent to the first copy of the content dataset,

wherein the calculating the keying dataset step and the communicating the keying dataset step are performed only when the second copy of the content dataset is equivalent to the first copy of the content dataset.

11. A server system disposed at a server side of a communications network and in operative communications with a plurality of client terminals disposed at respective client sides of the communications network, the server system comprising:

a proxy server comprising a memory configured to;

receive a first copy of a content dataset without a corresponding request for the content dataset from a first client terminal over the communications network;

calculate an anticipatory dataset as a function of the content dataset, such that the anticipatory dataset represents at least a portion of the content dataset but cannot be used to reconstruct the content dataset without a keying dataset that is also calculated from the content dataset;

communicate the anticipatory dataset to the first client terminal from the proxy server over the communications network for anticipatory storage of the anticipatory dataset local to the first client terminal; and

subsequent to communicating the anticipatory dataset to the first client terminal;

intercept a second copy of the content dataset at the proxy server, the second copy of the content dataset being communicated to the first client terminal in response to a content request issued by the first client terminal for the content dataset;

calculate the keying dataset as a function of the second copy of the content dataset at the proxy server; and

communicate the keying dataset from the proxy server to the client terminal for use by the first client terminal in locally reconstructing the content dataset as a function of the keying dataset and the anticipatory dataset;

wherein calculating the keying dataset by the proxy server comprises extracting a hold-back portion of the content dataset to use as the keying dataset; and

wherein calculating the anticipatory dataset by the proxy server as a function of the content dataset comprises removing the hold-back portion of the content dataset to generate the anticipatory dataset, so that the anticipatory dataset cannot be used to reconstruct the content dataset without the keying dataset.

12. The server system of claim 11, wherein the proxy server is configured to calculate the anticipatory dataset as a function of the content dataset by:

encrypting the content dataset to generate the anticipatory dataset in such a way that the anticipatory dataset cannot be used to reconstruct the content dataset without decrypting the anticipatory dataset as a function of the keying dataset.

13. The server system of claim 11, wherein:

calculating the anticipatory dataset as a function of the content dataset comprises encrypting the content dataset to generate the anticipatory dataset in such a way that the content dataset is reconstructable by decrypting the anticipatory dataset as a function of the keying dataset.

14. A method comprising:

receiving an anticipatory dataset at a client terminal from a proxy server over a communications network prior to the client terminal issuing a request for a content dataset, the anticipatory dataset calculated by the proxy server as a function of the content dataset, such that the anticipatory dataset represents at least a portion of the content dataset but cannot be used to reconstruct the content dataset without a keying dataset that is also calculated from the content dataset;

storing the anticipatory dataset local to the client terminal;

issuing the request for the content dataset from the client terminal over the communications network subsequent to storing the anticipatory dataset;

receiving the keying dataset from the proxy server over the communications network in response to issuing the request for the content dataset, the keying dataset calculated by the proxy server as a function of the content dataset intercepted at the proxy server in response to issuing the request for the content dataset; and

reconstructing the content dataset at the client terminal as a function of the anticipatory dataset and the keying dataset

wherein the keying dataset is calculated by the proxy server as a function of the content dataset by extracting a hold-back portion of the content dataset to use as the keying dataset; and

wherein the anticipatory dataset is calculated by the proxy server as a function of the content dataset by removing the hold-back portion of the content dataset to generate the anticipatory dataset, so that the anticipatory dataset cannot be used to reconstruct the content dataset without the keying dataset.

15. The method of claim 14, wherein:

the anticipatory dataset is calculated by the proxy server as a function of the content dataset by encrypting the content dataset to generate the anticipatory dataset in such a way that the anticipatory dataset cannot be used to reconstruct the content dataset without decrypting the anticipatory dataset as a function of the keying dataset; and

reconstructing the content dataset at the client terminal as a function of the anticipatory dataset and the keying dataset comprises decrypting the anticipatory dataset as a function of the keying dataset at the client terminal.

16. The method of claim 14 further comprising:

reconstructing the content dataset at the client terminal as a function of the anticipatory dataset and the keying dataset comprises filling in missing portions of the anticipatory dataset with the keying dataset at the client terminal.

17. A client system disposed at a client side of a communications network and in operative communications with a proxy server disposed at a server side of the communications network, the client system comprising:

a proxy client comprising a memory configured to;

receive an anticipatory dataset from the proxy server over the communications network prior to issuing a request for a content dataset, the anticipatory dataset calculated by the proxy server as a function of the content dataset, such that the anticipatory dataset represents at least a portion of the content dataset but cannot be used to reconstruct the content dataset without a keying dataset that is also calculated from the content dataset;

store the anticipatory dataset local to the proxy client;

issue the request for the content dataset over the communications network subsequent to storing the anticipatory dataset;

receive the keying dataset from the proxy server over the communications network in response to issuing the request for the content dataset, the keying dataset calculated by the proxy server as a function of the content dataset intercepted at the proxy server in response to issuing the request for the content dataset; and

reconstruct the content dataset as a function of the anticipatory dataset and the keying dataset;

wherein the keying dataset is calculated by the proxy server as a function of the content dataset by extracting a hold-back portion of the content dataset to use as the keying dataset; and

wherein the anticipatory dataset is calculated by the proxy server as a function of the content dataset by removing the hold-back portion of the content dataset to generate the anticipatory dataset, so that the anticipatory dataset cannot be used to reconstruct the content dataset without the keying dataset.

18. The client system of claim 17, wherein:

the anticipatory dataset is calculated by the proxy server as a function of the content dataset by encrypting the content dataset to generate the anticipatory dataset in such a way that the anticipatory dataset cannot be used to reconstruct the content dataset without decrypting the anticipatory dataset as a function of the keying dataset; and

reconstructing the content dataset as a function of the anticipatory dataset and the keying dataset comprises decrypting the anticipatory dataset as a function of the keying dataset.

19. The client system of claim 17 further comprising:

reconstructing the content dataset as a function of the anticipatory dataset and the keying dataset comprises filling in missing portions of the anticipatory dataset with the keying dataset.