Method and apparatus for protecting cached streams

• US 8,788,849 B2
• Filed: 12/20/2011
• Issued: 07/22/2014
• Est. Priority Date: 02/28/2011
• Status: Active Grant

• Current Assignee: SanDisk Technologies LLC (Western Digital Corporation)
• Original Assignee: Sandisk Technologies Incorporated (Western Digital Corporation)
• Inventors: Hahn, Judah Gamliel, Shmuel, Avraham
• Primary Examiner(s): GEORGANDELLIS, ANDREW C
• Application Number:
  US13/331,266
• Publication Number:
  US 20120221865A1
• Time in Patent Office: 945 Days
• Field of Search: 713/193
• US Class Current: 713/193
• CPC Class Codes: H04N 21/4331 Caching operations, e.g. of an advertisement for later insertion during playback
• CPC Class Codes: H04N 21/4334 Recording operations recording of a television signal H04N5/76; arrangements for recording or accumulating broadcast information or broadcast-related information H04H60/27
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/4408 involving video stream encryption, e.g. re-encrypting a decrypted video stream for redistribution in a home network
• CPC Class Codes: H04N 21/63345 by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 21/835 Generation of protective data, e.g. certificates protecting software against unauthorised usage in a vending or licensing environment G06F21/10

Abstract

A system and method for protecting cached streamed data is disclosed. The method may include the steps of generating an encryption key from the streamed data itself, encrypting the streamed data stored in the storage device and requesting the portion of the streamed data from the content server again when later playback is desired so as to allow the content server to enforce access limitations or takedown policies relating to the streamed data. The method may also include procedures for handling key generation over reliable or unreliable protocols.

Claims

1. A method for protecting streamed content stored locally on a storage device associated with a host, the method comprising:

in a processor of the host;

requesting content from a content server;

receiving a portion of the content streamed at a predefined bit rate from the content server;

creating an encryption key from the portion of the content streamed at the predefined bit rate;

receiving the content from the content server streamed at a second bit rate different from the predefined bit rate;

encrypting the content streamed at the second bit rate with the encryption key created from the portion of the content streamed at the predefined bit rate; and

storing the encrypted content on the storage device, wherein the encrypted content is cached for playback from the storage device and protected from unauthorized playback.

2. The method of claim 1, wherein the predefined bit rate is lower than the second bit rate.

3. The method of claim 1, wherein the predefined bit rate is higher than the second bit rate.

4. The method of claim 1, wherein creating the encryption key includes determining whether the portion of content streamed at the predefined rate has been streamed using an unreliable protocol and, responsive to determining that the portion of content has been streamed using an unreliable protocol, verifying an accuracy of the portion of content.

5. The method of claim 1, wherein creating the encryption key further comprises:

dividing the encryption key into a plurality of key portions;

retrieving a corresponding plurality of key segments at the pre-defined bit rate;

determining whether the corresponding plurality of retrieved key segments were retrieved using a reliable data protocol or the unreliable data protocol; and

when the processor determines that the plurality of retrieved key segments were sent with an unreliable data protocol, retrieving the corresponding plurality of key segments from the content server again to verify an accuracy of the plurality of key segments.

6. The method of claim 5, further comprising encrypting the encryption key with the corresponding plurality of key segments for storage with the encrypted content on the storage device.

7. The method of claim 6, further comprising discarding an unencrypted version of the encryption key after encrypting the content with the encryption key.

8. The method of claim 7, further comprising:

receiving a request to playback the content stored in the storage device and encrypted with the encryption key;

retrieving the encrypted encryption key from the storage device;

retrieving the plurality key segments from the content server;

decrypting the encrypted encryption key with the plurality of key segments retrieved from the content server;

retrieving from the storage device the content encrypted with the encryption key;

and

decrypting the encrypted content stored using the decrypted encryption key, wherein playback of the content stored on the storage device is dependent upon accessing the portion of the content again from the content server to recreate the encryption key that was used to encrypt the content when it was previously stored.

9. The method of claim 5, further comprising:

applying an overlay key to the plurality of retrieved key segments to create an overlaid plurality of key segments; and

encrypting the encryption key with the overlaid plurality of retrieved key segments, wherein decryption of the encryption key requires access to both the overlay key and the plurality of retrieved key segments.

10. The method of claim 9, wherein applying the overlay key comprises applying an overlay key provided by a network operator.

11. The method of claim 9, wherein applying the overlay key comprises applying a host-specific key to the plurality of retrieved key segments.

12. A host device for protecting streamed content stored locally on a storage device in communication with the host, the host device comprising:

an interface for communicating with a remotely located content server; and

a processor in communication with the interface, the processor configured to;

request content from the content server;

receive a portion of the content streamed at a predefined bit rate from the content server;

create an encryption key from a portion of the content streamed from the content server at the predefined bit rate;

receive the content streamed at a second bit rate different from the pre-defined bit rate;

encrypt the content streamed at the second bit rate with the encryption key created from the portion of the content streamed at the predefined bit rate; and

store the encrypted content on the storage device, wherein the encrypted content is cached for playback from the storage device and protected from unauthorized playback.

13. The host device of claim 12, wherein the predefined bit rate is less than the second bit rate.

14. The host device of claim 13, wherein the predefined bit rate is greater than the second bit rate.

15. The host device of claim 12, wherein to create the encryption key the processor is further configured to:

divide the encryption key into a plurality of portions;

retrieve a corresponding plurality of key segments at the predefined bit rate;

determine whether the corresponding plurality of retrieved key segments were sent with a reliable data protocol or an unreliable data protocol; and

when the processor determines that the corresponding plurality of retrieved key segments were sent with an unreliable data protocol, retrieve the corresponding plurality of key segments from the content server again to verify an accuracy of the plurality of key segments.

16. The host device of claim 15, wherein the processor is further configured to encrypt the encryption key with the corresponding plurality of key segments for storage with the content on the storage device.

17. The host device of claim 16, further comprising discarding an unencrypted version of the encryption key after encrypting the content with the encryption key.

18. The host device of claim 17, wherein the processor is further configured to:

receive a request to playback the content stored in the storage device and encrypted with the encryption key;

retrieve the encrypted encryption key from the storage device;

retrieve the plurality of key segments from the content server using an unreliable protocol;

decrypt the encrypted encryption key with the plurality of key segments retrieved from the content server;

retrieve from the storage device the content encrypted with the encryption key; and

decrypt the encrypted content retrieved from the storage device using the decrypted encryption key, wherein playback of the content stored on the storage device is dependent upon accessing the portion of the content again from the content server to recreate the encryption key that was used to encrypt the content when it was previously stored.

19. The host device of claim 15, wherein the processor is further configured to:

apply an overlay key to the plurality of retrieved key segments to create an overlaid plurality of key segments; and

encrypting the encryption key with the overlaid plurality of key segments, wherein decryption of the encryption key requires access to both the overlay key and the plurality of retrieved key segments.

20. The host device of claim 19, wherein the overlay key comprises an overlay key provided by a network operator.

21. The host device of claim 19, wherein the overlay key comprises applying a host-specific key to the plurality of retrieved key segments.

22. The host device of claim 21, wherein the host-specific key is based on at least one of a host serial number, chipset information for the host and international mobile equipment identity (IMEI) information.

23. A method for protecting streamed content stored locally on a storage device associated with a host, the method comprising:

in a processor of the host;

receiving a request to playback content stored on the storage device, wherein the content stored on the storage device was previously downloaded at a second bit rate and has been encrypted with an encryption key comprising a portion of the content previously downloaded at a predefined bit rate different than the second bit rate;

retrieving an encrypted version of the encryption key from the storage device;

receiving a plurality of key segments from a content server streamed at the predefined bit rate;

decrypting the encrypted encryption key with the plurality of key segments streamed from the content server at the predefined bit rate;

reconstituting the encryption key with a secret sharing algorithm;

retrieving from the storage device the content encrypted with the encryption key; and

decrypting the content stored on the storage device using the decrypted and reconstituted encryption key.

24. The method of claim 23, wherein the predefined bit rate is less than the second bit rate.

25. The method of claim 23, wherein the predefined bit rate is greater than the second bit rate.