Method and system for secure over-the-top live video delivery

• US 8,751,807 B2
• Filed: 06/22/2012
• Issued: 06/10/2014
• Est. Priority Date: 06/23/2011
• Status: Active Grant

• Current Assignee: Ericsson AB (Telefonaktiebolaget LM Ericsson)
• Original Assignee: Azuki Systems, Inc (Telefonaktiebolaget LM Ericsson)
• Inventors: Hickey, Robert, Tweedale, Paul, Ma, Kevin J
• Primary Examiner(s): HOFFMAN, BRANDON S
• Application Number:
  US13/530,997
• Publication Number:
  US 20120331293A1
• Time in Patent Office: 718 Days
• Field of Search: None
• US Class Current: 713/168
• CPC Class Codes: G11B 27/10 Indexing; Addressing; Timing or synchronising; Measuring tape travel
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/2387 Stream processing in response to a playback request from an end-user, e.g. for trick-play
• CPC Class Codes: H04N 21/2393 involving handling client requests scheduling or organising the servicing of application requests H04L67/60
• CPC Class Codes: H04N 21/2541 Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/42623 involving specific decryption arrangements
• CPC Class Codes: H04N 21/4627 Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/63345 by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 21/8456 by decomposing the content in the time domain, e.g. in time segments

Abstract

A method is provided for managing key rotation (use of series of keys) and secure key distribution in over-the-top content delivery. The method provided supports supplying a first content encryption key to a content packaging engine for encryption of a first portion of a video stream. Once the first content encryption key has expired, a second content encryption key is provided to the content packaging engine for encryption of a second portion of a video stream. The method further provides for notification of client devices of imminent key changes, as well as support for secure retrieval of new keys by client devices. A system is also specified for implementing a client and server infrastructure in accordance with the provisions of the method.

Claims

1. A method for managing secure distribution of content, comprising:

generating a series of content encryption keys and providing them serially to a packaging server for encrypting a content item, each content encryption key provided upon expiration of a period of use of a serially preceding content encryption key, the packaging server generating packaged content for delivery to client devices via a content delivery network, the packaged content including or accompanied by key expiration information usable by the client devices to identify transitions between sections of the packaged content encrypted by different ones of the content encryption keys; and

providing the content encryption keys to a license server for delivery to the client devices for use in decrypting the content item, the license server being operative to establish that a requesting client device is authorized to access the content item, the license server being further operative to securely deliver the content encryption keys to a requesting client device whose authorization to access the content item has been established.

2. The method of claim 1, wherein the content is audio/video content.

3. The method of claim 1, wherein the content is encrypted using an encryption algorithm selected from AES128, HC128, and RC4.

4. The method of claim 3, further comprising:

resetting an initialization vector of the encryption algorithm when transitioning to use of each successive content encryption key.

5. The method of claim 1, wherein the content encryption keys are provided to the packaging server through a secure interface secured using Secure Sockets Layer or other security protocol.

6. The method of claim 1, wherein a next content encryption key is pushed to the packaging server when it is determined that a current content encryption key should be expired as a security precaution.

7. The method of claim 1, wherein providing the content encryption keys includes pushing a content encryption key and a suggested expiration time to the packaging server.

8. The method of claim 7, wherein the content encryption key and suggested expiration time are pushed only in response to a request for a new content encryption key from the packaging server.

9. The method of claim 8, wherein the packaging server requests a new key in anticipation of expiration of a current key.

10. The method of claim 7, further including receiving a notification from the packaging server of an exact expiration time at which a new content encryption key took effect.

11. The method of claim 10, wherein the new content encryption key is provided to the license server only upon receiving the notification from the packaging server.

12. The method of claim 1, wherein the client device is notified at session initiation of a target fixed period for content key expiration.

13. The method of claim 1, wherein the client device is notified in real time of content key expiration.

14. The method of claim 13, wherein the packaging server provides the key expiration information by inserting a key change notification into a content encryption metadata header as part of the unencrypted portion of the encrypted file, the content encryption metadata header.

15. The method of claim 13, wherein the packaging server provides the key expiration information by inserting a key change notification into a content manifest file accessible to the client devices, the content manifest file being selected from an m3u8 file, an IIS Smooth Streaming manifest file, a DASH MPD file and a proprietary manifest file.

16. The method of claim 13, wherein the packaging server provides the key expiration information by inserting a key change notification into the file name of the segment files being generated.

17. The method of claim 1, wherein the content encryption key is provided to the license server through a secure interface secured using Secure Sockets Layer or other security protocol.

18. The method of claim 1, wherein the series of content encryption keys are versioned using monotonically increasing integer values while maintaining a direct correlation between an encryption key version and a segment number or segment duration associated with segments of the packaged content.

19. The method of claim 18, wherein the license server is operative to allow client devices to request previously used content encryption keys and key expiration information.

20. The method of claim 1, wherein the license server distributes content encryption keys and content encryption key expiration information to client devices using a secure channel.

21. The method of claim 20, wherein the secure channel is secured using a selected one of Secure Sockets Layer and a token-based technique using a token encrypted with a symmetric key.

22. The method of claim 21, wherein the token-based technique employs white box encryption to encrypt the token.

23. The method of claim 1, wherein the license server sends content encryption keys and expiration information only in response to requests from the client devices.

24. The method of claim 1, wherein the license server is operative when establishing that a requesting client device is authorized to access the content item to verify client device identity and content access rights before returning content encryption key or expiration information.

25. A computerized device operable as a workflow manager for managing secure distribution of content, comprising:

memory operative to store computer program instructions;

one or more processors;

input/output interface circuitry; and

interconnect circuitry coupling the memory, processors and input/output interface circuitry together,

wherein the processors are operative to execute the computer program instructions from the memory to cause the computerized device to;

generate a series of content encryption keys and providing them serially to a packaging server for encrypting a content item, each content encryption key provided upon expiration of a period of use of a serially preceding content encryption key, the packaging server generating packaged content for delivery to client devices via a content delivery network, the packaged content including or accompanied by key expiration information usable by the client devices to identify transitions between sections of the packaged content encrypted by different ones of the content encryption keys; and

provide the content encryption keys to a license server for delivery to the client devices for use in decrypting the content item, the license server being operative to establish that a requesting client device is authorized to access the content item, the license server being further operative to securely deliver the content encryption keys to a requesting client device whose authorization to access the content item has been established.

26. A method for packaging content for secure distribution, comprising:

receiving a series of content encryption keys and using them to encrypt a content item, each content encryption key provided upon expiration of a period of use of a serially preceding content encryption key, the content encryption keys being provided separately to a license server for delivery to client devices for use in decrypting the content item, the license server being operative to establish that a requesting client device is authorized to access the content item, the license server being further operative to securely deliver the content encryption keys to a requesting client device whose authorization to access the content item has been established; and

generating packaged content and providing it to a content delivery network for delivery to the client devices, the packaged content including the content item as encrypted and being accompanied by key expiration information usable by the client devices to identify transitions between sections of the packaged content encrypted by different ones of the content encryption keys.

27. The method of claim 26, wherein a next content encryption key is pushed to the packaging server when it is determined that a current content encryption key should be expired as a security precaution.

28. The method of claim 26, wherein providing the content encryption keys includes pushing a content encryption key and a suggested expiration time to the packaging server.

29. The method of claim 28, wherein the content encryption key and suggested expiration time are pushed only in response to a request for a new content encryption key from the packaging server.

30. The method of claim 29, wherein the packaging server requests a new key in anticipation of expiration of a current key.

31. The method of claim 28, wherein the content encryption keys are received from a workflow manager, and further including sending a notification to the workflow manager of an exact expiration time at which a new content encryption key took effect.

32. The method of claim 26, wherein the client device is notified in real time of content key expiration.

33. The method of claim 32, wherein the packaging server provides the key expiration information by inserting a key change notification into a content encryption metadata header as part of the unencrypted portion of the encrypted file, the content encryption metadata header.

34. The method of claim 32, wherein the packaging server provides the key expiration information by inserting a key change notification into a content manifest file accessible to the client devices, the content manifest file being selected from an m3u8 file, an IIS Smooth Streaming manifest file, a DASH MPD file and a proprietary manifest file.

35. The method of claim 26, wherein the series of content encryption keys are versioned using monotonically increasing integer values while maintaining a direct correlation between an encryption key version and a segment number or segment duration associated with segments of the packaged content.

36. The method of claim 26, wherein the license server is operative when establishing that a requesting client device is authorized to access the content item to verify client device identity and content access rights before returning content encryption key or expiration information.

37. A computerized device operable as a packaging server for packaging content for secure distribution, comprising:

memory operative to store computer program instructions;

one or more processors;

input/output interface circuitry; and

interconnect circuitry coupling the memory, processors and input/output interface circuitry together,

wherein the processors are operative to execute the computer program instructions from the memory to cause the computerized device to;

receive a series of content encryption keys and using them to encrypt a content item, each content encryption key provided upon expiration of a period of use of a serially preceding content encryption key, the content encryption keys being provided separately to a license server for delivery to client devices for use in decrypting the content item, the license server being operative to establish that a requesting client device is authorized to access the content item, the license server being further operative to securely deliver the content encryption keys to a requesting client device whose authorization to access the content item has been established; and

generate packaged content and providing it to a content delivery network for delivery to the client devices, the packaged content including the content item as encrypted and being accompanied by key expiration information usable by the client devices to identify transitions between sections of the packaged content encrypted by different ones of the content encryption keys.

38. A system for ingestion of content and packaging and delivery of the content to client devices via a content delivery network, comprising:

a set of one or more server computers collectively coupled to a source of the content and to the content delivery network and including a packaging server, a workflow manager and a license server;

the packaging server being operative to (i) receive a series of content encryption keys from the workflow manager and use them to encrypt a content item, each content encryption key provided upon expiration of a period of use of a serially preceding content encryption key, and (ii) generate packaged content and providing it to the content delivery network for delivery to the client devices, the packaged content including the content item as encrypted and being accompanied by key expiration information usable by the client devices to identify transitions between sections of the packaged content encrypted by different ones of the content encryption keys;

the workflow manager being operative to (i) generate the series of content encryption keys and provide them serially to the packaging server for encrypting the content item, each content encryption key provided upon expiration of a period of use of a serially preceding content encryption key, and (ii) provide the content encryption keys to the license server for delivery to the client devices for use in decrypting the content item; and

the license server being operative to (i) establish that a requesting client device is authorized to access the content item, and (ii) securely deliver the content encryption keys to a requesting client device whose authorization to access the content item has been established by the license server, the content encryption keys being delivered for use by the requesting client device in decrypting the content item.