Systems and methods for securely place shifting media content

• US 8,667,279 B2
• Filed: 07/01/2008
• Issued: 03/04/2014
• Est. Priority Date: 07/01/2008
• Status: Active Grant

• Current Assignee: Sling Media LLC (Echostar Corporation)
• Original Assignee: Sling Media Incorporated (Echostar Corporation)
• Inventors: Rao, Padmanabha R.
• Primary Examiner(s): Chai, Longbit
• Application Number:
  US12/166,039
• Publication Number:
  US 20100005483A1
• Time in Patent Office: 2,072 Days
• Field of Search: 713/168
• US Class Current: 713/168
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 65/60 Network streaming of media packets
• CPC Class Codes: H04N 21/2396 characterized by admission policies admission control, resource allocation in open networks H04L12/5692; arrangements for network security using user profiles for access control H04L63/102; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/25816 involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/25841 involving the geographical location of the client retrieval from the Internet by querying based on geographical locations G06F16/9537; arrangements for identifying locations of receiving stations in broadcast systems H04H60/51; location of the user terminal in data switching networks H04L67/52; services making use of the location of users or terminals in wireless networks H04W4/02; locating users or terminals in wireless networks H04W64/00
• CPC Class Codes: H04N 21/25875 involving end-user authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; arrangements for secret or secure communication including means for verifying the identity or authority of a user of the system H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/41407 embedded in a portable device, e.g. video client on a mobile phone, PDA, laptop constructional details of equipment or arrangements specially adapted for portable computer application G06F1/1626; arrangements specially adapted for mobile receivers in broadcast systems H04H20/57
• CPC Class Codes: H04N 21/4227 Providing Remote input by a user located remotely from the client device, e.g. at work
• CPC Class Codes: H04N 21/4331 Caching operations, e.g. of an advertisement for later insertion during playback
• CPC Class Codes: H04N 21/4408 involving video stream encryption, e.g. re-encrypting a decrypted video stream for redistribution in a home network
• CPC Class Codes: H04N 21/63345 by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 7/17318 Direct or substantially direct transmission and handling of requests

Abstract

Systems and methods are provided for securely providing a place-shifted media stream from a place shifting device to a remote player via a communications network. A request for a connection is received from the remote player at the place shifting device via the communications network. In response to the request for the connection, an authorization credential is requested from a central server via the communications network. Further, in response to the authorization credential received from the central server, the place-shifted media stream between the place shifting device and the remote player can be established over the communications network. At least a portion of the place-shifted media stream may be encrypted based upon the authorization credential.

Claims

1. A method executable by a place shifting device for securely providing a place-shifted media stream from the place shifting device to a remote player via a communications network, the method comprising:

receiving a request for a connection from the remote player at the place shifting device via the communications network;

in response to the request for the connection, requesting an authorization credential from a remotely located central server via the communications network wherein the remotely-located central server is separate from both the remote player and the place shifting device, wherein the authorization credential is generated by the central server to authorize a placeshifting session between the remote device and the place shifting device, and wherein the authorization credential is provided from the central server to both the remote player and the place shifting device via the communications network; and

establishing the placeshifting session between the place shifting device and the remote player over the communications network using the authorization credential received from the remotely located central server to thereby securely provide the place-shifted media stream from the place shifting device to the remote device.

2. The method of claim 1 wherein at least a portion of the place-shifted media stream is encrypted based upon the authorization credential that is received from the remotely-located central server.

3. The method of claim 1 further comprising verifying that placeshifting is approved between the place shifting device and the remote player prior to requesting the authorization credential.

4. The method of claim 3 wherein the verifying is based at least in part upon a location of the remote player.

5. The method of claim 3 wherein the verifying is based at least in part upon an approval received via a medium separate from the communications network.

6. The method of claim 1 further comprising authenticating a user of the remote player at the place-shifting device prior to establishing the place-shifted media stream.

7. The method of claim 1 wherein the authorization credential comprises a symmetric encryption key that is also provided from the remotely located central server to the remote player.

8. The method of claim 7 wherein the symmetric encryption key is provided from the remotely located central server to the remote player over the communications network in response to a request received from the remote player at the remotely located central server.

9. The method of claim 8 wherein the establishing of the place-shifted media stream comprises negotiating encryption parameters for the place-shifted media stream between the remote player and the placeshifting device based at least in part upon the symmetric encryption key received from the remotely located central server.

10. The method of claim 1 further comprising selecting one of a plurality of available encryption levels for the place-shifted media stream, and wherein at least a portion of the place-shifted media stream is encrypted based upon the authorization credential.

11. The method of claim 10 wherein the selected encryption level is determined at least in part upon a quality of the place-shifted media stream.

12. The method of claim 10 wherein the selected encryption level is determined at least in part upon a processing capability of the remote player.

13. The method of claim 10 wherein the selected encryption level is determined at least in part upon a bandwidth of the communications network.

14. The method of claim 1 wherein the place-shifted media stream is provided based upon media content received via a medium separate from the communications network and decoded at the place-shifting device.

15. The method of claim 14 further comprising verifying that placeshifting is approved between the place shifting device and the remote player prior to requesting the authorization credential, wherein the verifying is based at least in part upon an approval received via the medium separate from the communications network.

16. The method of claim 14 wherein the medium separate from the communications network comprises a satellite link.

17. A system for securely providing a place-shifted media stream to a remote player via a communications network, the system comprising:

a network interface to the communications network;

a receiver configured to receive media content from a medium separate from the communications network;

a transcoder configured to packetize the received media content for transport over the communications network; and

control circuitry in communication with at least the network interface and the transcoder, wherein the control circuitry is configured to receive a request for a connection from the remote player via the network interface, to request an authorization credential from a remotely-located central server via the network interface in response to the request for the connection, and to establish a placeshifting session with the remote player via the network interface after receiving the authorization credential from the remotely located central server to thereby provide the place-shifted media stream to the remote device, wherein the remotely-located central server is separate from both the remote player and the system, wherein the authorization credential is generated by the remotely-located central server, wherein the authorization credential is provided from the remotely-located central server to both the remote player and to the system via the communications network to authorize the placeshifting session between the remote device and the system.

18. The system of claim 17 wherein the control circuitry is further configured to negotiate encryption parameters for the place-shifted media stream with the remote player based at least in part upon the authorization credential received from the remotely located central server.

19. The system of claim 17 wherein the control circuitry is further configured to encrypt at least a portion of the place-shifted media stream based upon the authorization credential received from the remotely located central server.

20. The system of claim 19 wherein the control circuitry is further configured to encrypt only a portion of the place-shifted media stream.

21. The system of claim 20 wherein the size of the portion is determined at least in part upon a quality of the place-shifted media stream.

22. The system of claim 20 wherein the encrypted portion corresponds to selected blocks of video frames contained within the place-shifted media stream.

23. The system of claim 22 wherein the blocks are randomly selected.

24. The system of claim 17 wherein the receiver is a direct broadcast satellite receiver, wherein the medium separate from the communications network is a satellite broadcast receivable by the direct broadcast satellite receiver, and wherein the control circuitry is further configured to verify that placeshifting is approved between the place shifting device and the remote player prior to requesting the authorization credential from the remotely located central server, wherein the verification is performed at the placeshifting device based upon an approval received at the placeshifting device via the satellite broadcast receivable by the direct broadcast satellite receiver.

25. The system of claim 17 wherein the receiver is configured to decode the media content and to provide the decoded media content to the transcoder.

26. A method of presenting a place-shifted media stream to a user of a remote device, wherein the place-shifted media stream is provided from a place shifting device to the remote device over a communications network, the method comprising:

authenticating the user to a central server via the communications network;

after successful authentication with the central server, requesting a connection to the place shifting device;

after receiving a response from the place shifting device, requesting authorization to connect to the place shifting device from the central server via the communications network, wherein the central server is separate from both the remote device and the place shifting device;

receiving an authorization response from the central server via the communications network, wherein the authorization response comprises an authorization credential generated by the central server to authorize a placeshifting session between the remote device and the place shifting device, and wherein the authorization credential is provided from the central server to both the remote device and to the place shifting device via the communications network; and

establishing the place shifting session with the place shifting device over the communications network using the authorization credential to thereby securely receive the place-shifted media stream from the place shifting device at the remote device.

27. The method of claim 26 wherein at least a portion of the place-shifted media stream is encrypted based at least in part upon the authorization credential.

28. The method of claim 26 further comprising authenticating the user to the place shifting device via the communications network.

29. The method of claim 26 wherein the authorization credential comprises a symmetric encryption key that is also provided from the central server to the place shifting device.

30. The method of claim 29 further comprising negotiating encryption parameters for the place-shifted media stream with the place shifting device based at least in part upon the received authorization credential.

31. The method of claim 27 further comprising decrypting only a portion of the place-shifted media stream.

32. The method of claim 31 wherein the size of the portion is determined at least in part upon a quality of the place-shifted media stream.

33. A method executable by a central server to securely allow a place-shifted media stream to be provided to a user of a remote device, wherein the place-shifted media stream is provided from a remotely located place shifting device to the remote device over a communications network, the method comprising:

receiving a first request from the remote device via the communications network at the central server, wherein the first request comprises a user credential associated with the user, and wherein the central server is separate from the place shifting device and from the remote device;

verifying the user credential at the central server and, in response to successful verification, transmitting a first response from the central server to the remote device that identifies the remotely located place shifting device; and

in response to a second request from the remote device received at the central server, the central server generating an authentication credential that authorizes a video streaming session between the remote device and the place shifting device, and transmitting the authorization credential generated by the central server to both the remote device and the remotely located place shifting device to thereby allow the remote device and the remotely located place shifting device to establish the place-shifted media stream from the place shifting device to the remote device using the authorization credential generated by the central server.

34. The method of claim 33 wherein the place-shifted media stream is encrypted at least in part based upon the authentication credential.

35. The method of claim 33 wherein the authentication credential is transmitted to the remotely located place shifting device in response to a key request from the place shifting device.

36. The method of claim 33 further comprising validating that the user is authorized to connect to the remotely located place shifting device.

37. The method of claim 36 wherein the validating comprises querying an account server having an entry associated with the user.

38. The method of claim 37 wherein the account server is associated with a service provider providing media content to the remotely located place shifting device via a medium separate from the communications network.