Dynamic encryption

• US 8,625,789 B2
• Filed: 09/26/2011
• Issued: 01/07/2014
• Est. Priority Date: 09/26/2011
• Status: Active Grant

• Current Assignee: Brightcove Incorporated
• Original Assignee: Unicorn Media, Inc. (Brightcove Incorporated)
• Inventors: McGowan, Albert John
• Primary Examiner(s): DADA, BEEMNET W
• Application Number:
  US13/245,465
• Publication Number:
  US 20130080772A1
• Time in Patent Office: 834 Days
• Field of Search: 380/200, 380/201, 380/277, 380/286, 380/44, 713/164, 713/189, 713/193
• US Class Current: 380/200
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Abstract

Systems and methods for encrypting a media file for streaming and/or downloading over a network are disclosed. These systems and methods may be part of a larger media servicing network that can be used to, among other things, process uploaded media content, provide it for streaming, and collect metric information regarding the streaming. The disclosed systems and methods provide for receiving requests for a media file or a chunk of a media file and responding to these requests by encrypting the requested chunks dynamically and providing the chunks to the requesting entity. These systems and methods, which can be utilized with a dynamic chunk generation and dynamic index file generation, enable a high degree of flexibility in streaming chunked media files and preclude the need to encrypt the chunks prior to streaming. The systems and methods may also be applied to encrypting files for continuous streaming protocols as well as for progressive download.

Claims

1. A method for providing a plurality of encrypted segments of a media file over a data network, the method comprising:

receiving, at a server, a request for a first segment of the media file;

retrieving the first segment of the media file, wherein the first segment of the media file comprises one of a plurality of segments of the media file that are each separately-addressable from an application layer using a corresponding URI, the first segment of the media file having media content for playback over a period of time;

determine a first encryption key;

creating an encrypted first segment of the media file by encrypting the first segment of the media file using the first encryption key, wherein the encrypting the first segment of the media file occurs after receiving the request for the first segment of the media file;

providing, with the server, the encrypted first segment of the media file;

receiving, at the server, a request for a second segment of the media file;

retrieving the second segment of the media file, wherein the second segment of the media file comprises one of the plurality of segments of the media file that are each separately-addressable from the application layer using the corresponding URI, the second segment of the media file having media content for playback over a period of time;

determining a second encryption key;

creating an encrypted second segment of the media file by encrypting the second segment of the media file using the second encryption key, wherein the encrypting the second segment of the media file occurs after receiving the request for the second segment of the media file; and

providing, with the server, the encrypted second segment of the media.

2. The method for providing the plurality of encrypted segments of the media file over the data network as recited in claim 1, wherein the second encryption key is different than the first encryption key.

3. The method for providing the plurality of encrypted segments of the media file over the data network as recited in claim 1, wherein the requests for the first and second segments of the media file are received from a Media File Delivery Service Provider (MFDSP).

4. The method for providing the plurality of encrypted segments of the media file over the data network as recited in claim 3, wherein the encrypted first and second segments of the media file are provided to the MFDSP.

5. The method for providing the plurality of encrypted segments of the media file over the data network as recited in claim 1, wherein the receiving the requests for the first and second segments of the media file and the providing the encrypted first and second segments of the media file occur during playback of the media file by a device communicatively linked to the data network.

6. The method for providing the plurality of encrypted segments of the media file over the data network as recited in claim 1, wherein the determining the first encryption key comprises generating the first encryption key.

7. The method for providing the plurality of encrypted segments of the media file over the data network as recited in claim 6, wherein the generating the first encryption key comprises using an algorithm received over a communication link.

8. The method for providing the plurality of encrypted segments of the media file over the data network as recited in claim 6, further comprising providing a first decryption key for decrypting the encrypted first segment of the media file.

9. The method for providing the plurality of encrypted segments of the media file over the data network as recited in claim 1, wherein determining the first encryption key comprises:

requesting, over a communication link, the first encryption key; and

receiving, over the communication link, the first encryption key.

10. The method for providing the plurality of encrypted segments of the media file over the data network as recited in claim 9, wherein determining the second encryption key comprises:

requesting, over the communication link, the second encryption key; and

receiving, over the communication link, the second encryption key.

11. The method for providing the plurality of encrypted segments of the media file over the data network as recited in claim 1, determining the first encryption key comprises retrieving the first encryption key from data storage.

12. A non-volatile computer-readable storage medium having instructions embedded thereon, which, when executed by a processor, cause the processor to perform the method for providing the plurality of encrypted segments of the media file over the data network as recited in claim 1.

13. A server for communicating, via a network, a media file having a plurality of segments, the server comprising:

a network interface;

a memory configured to store one or more of the plurality of segments; and

a processor communicatively coupled with the memory and the network interface and configured to cause the server to;

receive, using the network interface, a request for a first segment of the media file;

retrieve the first segment of the media file from the memory, wherein the first segment of the media file comprises one of a plurality of segments of the media file that are each separately-addressable from an application layer using a corresponding URI, the first segment of the media file having media content for playback over a period of time;

determine a first encryption key;

create an encrypted first segment of the media file by encrypting the first segment of the media file using the first encryption key, wherein encrypting the first segment of the media file occurs after receiving the request for the first segment of the media file;

provide, using the network interface, the encrypted first segment of the media file;

receive, using the network interface, a request for a second segment of the media file;

retrieve the second segment of the media file from the memory, wherein the second segment of the media file comprises one of the plurality of segments of the media file that are each separately-addressable from the application layer using the corresponding URI, the second segment of the media file having media content for playback over a period of time;

determine a second encryption key;

create an encrypted second segment of the media file by encrypting the second segment of the media file using the second encryption key, wherein the encrypting the second segment of the media file occurs after receiving the request for the second segment of the media file; and

provide, using the network interface, the encrypted second segment of the media file.

14. The server for communicating, via the network, the media file having the plurality of segments as recited in claim 13, wherein the processor is configured to cause the server to receive the requests for the first and second segments of the media file from a Media File Delivery Service Provider (MFDSP).

15. The server for communicating, via the network, the media file having the plurality of segments as recited in claim 13, wherein the processor is configured to cause the server to provide the encrypted first and second segments of the media file are to the MFDSP.

16. The server for communicating, via the network, the media file having the plurality of segments as recited in claim 13, the processor is configured to cause the server to receive the requests for the first and second segments of the media file and provide the encrypted first and second segments of the media file during playback of the media file by a device communicatively linked to the network.

17. The server for communicating, via the network, the media file having the plurality of segments as recited in claim 13, wherein determining the first encryption key comprises generating the first encryption key.

18. The server for communicating, via the network, the media file having the plurality of segments as recited in claim 17, the processor is configured to cause the server to:

receive an algorithm via the network interface; and

use the algorithm to generate the first encryption key.

19. The server for communicating, via the network, the media file having the plurality of segments as recited in claim 13, wherein the processor is configured to cause the server to determine the first encryption key by:

requesting, using the network interface, the first encryption key; and

receiving, using the network interface, the first encryption key.

20. The server for communicating, via the network, the media file having the plurality of segments as recited in claim 19, wherein the processor is configured to cause the server to determine the second encryption key by:

requesting, using the network interface, the second encryption key; and

receiving, using the network interface, the second encryption key.

21. The server for communicating, via the network, the media file having the plurality of segments as recited in claim 13, wherein the processor is configured to cause the server to determine the first encryption key by retrieving the first encryption key from the memory.

22. A system for securely communicating, with a network, a media file, the system comprising:

a data storage configured to store the media file; and

a processing server communicatively coupled with the data storage, the processing server configured to;

receive a request for a first segment of the media file, the first segment of the media file comprising one of a plurality of segments of the media file that are each separately-addressable from an application layer using a corresponding URI;

retrieve at least a portion of the media file from the data storage;

generate the first segment of the media file, wherein the first segment of the media file comprises media content for playback over a period of time;

determine a first encryption key;

create an encrypted first segment of the media file by encrypting the first segment of the media file using the first encryption key, wherein the encrypting the first segment of the media file occurs after the request for the first segment of the media file is received;

provide the encrypted first segment of the media file;

receive a request for a second segment of the media file, the second segment of the media file comprising one of the plurality of segments of the media file that are each separately-addressable from the application layer using the corresponding URI;

generate the second segment of the media file, wherein the second segment of the media file comprises media content for playback over a period of time;

determine a second encryption key;

create an encrypted second segment of the media file by encrypting the second segment of the media file using the second encryption key, wherein the encrypting the second segment of the media file occurs after receiving the request for the second segment of the media file; and

provide the encrypted second segment of the media file.

23. The system for securely communicating, with the network, the media file as recited in claim 22, further comprising a media caching server configured to:

send the requests for the first and second segments of the media file, via the network, to the processing server;

receive the encrypted first and second segments of the media file, via the network, from the processing server; and

store the encrypted first and second segments of the media file in a memory.

24. The system for securely communicating, with the network, the media file as recited in claim 23, wherein the media caching server is further configured to provide the encrypted first and second segments of the media file to a device communicatively coupled with the media caching server.

25. The system for securely communicating, with the network, the media file as recited in claim 24 configured such that the media caching server will not send the requests for a segment of the media file via the network to the processing server if the media caching server has the segment of the media file stored in the memory.