Systems and methods for protecting alternative streams in adaptive bitrate streaming systems

• US 8,918,636 B2
• Filed: 12/30/2011
• Issued: 12/23/2014
• Est. Priority Date: 09/01/2011
• Status: Active Grant

• Current Assignee: Sonic IP Incorporated (Endeavor Group Holdings Inc.)
• Original Assignee: Sonic IP Incorporated (Endeavor Group Holdings Inc.)
• Inventors: Kiefer, Michael George, Grab, Eric William, Braness, Jason
• Primary Examiner(s): Hailu, Teshome
• Assistant Examiner(s): Getachew, Abiy
• Application Number:
  US13/341,265
• Publication Number:
  US 20130061040A1
• Time in Patent Office: 1,089 Days
• Field of Search: 713/155, 713/150
• US Class Current: 713/155
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/2541 Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/4408 involving video stream encryption, e.g. re-encrypting a decrypted video stream for redistribution in a home network
• CPC Class Codes: H04N 21/4627 Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/6334 for authorisation, e.g. by transmitting a key wireless communications network key management H04W12/04; wireless communications network access security H04W12/08
• CPC Class Codes: H04N 21/64715 Protecting content from unauthorized alteration within the network verifying the information received for network security in communication control or processing H04L63/12; integrity in wireless network security H04W12/10

Abstract

Systems and methods for performing adaptive bitrate streaming using alternative streams of protected content in accordance with embodiments of the invention are described. One embodiment includes a processor, and non-volatile storage containing an encoding application. In addition, the encoding application configures the processor to: receive source content; obtain common cryptographic information; encode the source content as a plurality of streams including a plurality of alternative streams of content; and protect the plurality of alternative streams of content using the common cryptographic information.

Claims

1. A source encoder, comprising:

a processor;

non-volatile storage containing an encoding application for encoding and protecting frames of video to create a plurality of alternative streams of protected content;

wherein the encoding application configures the processor to;

receive a source content;

obtain a common set of frame keys comprising a plurality of frame keys;

encode the source content as a plurality of streams including a plurality of alternative streams of content, wherein each alternative stream of content comprises a plurality of encoded video frames;

encrypt portions of several encoded video frames from each alternative stream of content using keys from the same common set of frame keys;

after encrypting the portions of encoded video frames, write the encoded video frames of each alternative stream of protected content to a separate container file from a plurality of container files and, for each encoded video frame with an encrypted portion that is written to a given container file, write a DRM information to the given container file that identifies (i) an encrypted portion of the encoded video frame and (ii) a frame key from the common set of frame keys that can be utilized by a playback device to access the encrypted portion of the encoded video frame; and

store an encrypted copy of the common set of frame keys in each container file, wherein each encrypted copy of the common set of frame keys has been encrypted with at least one encryption key.

2. The source encoder of claim 1, wherein the encoding application configures the processor to obtain common cryptographic information by configuring the processor to:

send a request to a DRM server for common set of frame keys; and

receive the common set of frame keys from the DRM server.

3. The source encoder of claim 1, wherein a title ID is associated with the common set of frame keys and the plurality of alternative streams of protected content.

4. The source encoder of claim 1, wherein the container files are Matroska container files.

5. The source encoder of claim 4, wherein the encoding application configures the processor to write a DRMHeader element to a TracksData element in a Tracks element within each of the Matroska container files, where the DRMHeader element includes the encrypted copy of the common set of frame keys.

6. The source encoder of claim 5, wherein:

the common set of frame keys is a part of a frame key table;

the encoding application configures the processor to;

encrypt the frame key table using the at least one encryption key; and

write the encrypted frame key table to the DRMHeader element of each of the Matroska container files.

7. The source encoder of claim 6, wherein:

the source content includes a stream of video;

the encoding application configures the processor to;

write a BlockGroup element to a Matroska container file including the DRM information that identifies the encrypted portions of the encoded video frames and the frame keys used to access the encrypted portions of the encoded video frames.

8. The source encoder of claim 4, wherein the encoding application further configures the processor to:

generate an index for each Matroska container file during the encoding of each of the alternative streams of protected content; and

write a Cues element containing the index to the indexed Matroska container file.

9. A method of encoding and protecting source content as a plurality of alternative streams of protected content, comprising:

receiving a source content using a source encoder;

obtaining a common set of frame keys comprising a plurality of frame keys using the source encoder;

encoding the source content as a plurality of streams including a plurality of alternative streams of content using the source encoder, wherein each alternative stream of content comprises a plurality of encoded video frames;

encrypting portions of several encoded video frames from each alternative stream of content using keys from the same common set of frame keys and the source encoder;

after encrypting the portions of encoded video frames, writing the encoded video frames of each given alternative stream of protected content to a separate container file from a plurality of container files using the source encoder and, for each encoded video frame with an encrypted portion that is written to a given container file, writing a DRM information to the given container file that identifies (i) an encrypted portion of the encoded video frame and (ii) a frame key from the common set of frame keys that can be utilized by a playback device to access the encrypted portion of the encoded video frame; and

storing an encrypted copy of the common set of frame keys in each container file using the source encoder, wherein each encrypted copy of the common set of frame keys has been encrypted with at least one encryption key.

10. The method of claim 9, wherein obtaining the common set of frame keys comprises:

sending a request to a DRM server for the common set of frame keys using the source encoder; and

receiving the common set of frame keys from the DRM server.

11. The method of claim 9, further comprising associating a title ID with the common set of frame keys and the plurality of alternative streams of protected content.

12. The method of claim 9, wherein the container files are Matroska container files.

13. The method of claim 12, further comprising writing a DRMHeader element to a TracksData element in a Tracks element within each of the Matroska container files using the source encoder, where the DRMHeader element includes the encrypted copy of the common set of frame keys.

14. The method of claim 13, wherein the common set of frame keys is a part of a frame key table and the method further comprises:

encrypting the frame key table using the at least one encryption key using the source encoder; and

writing the encrypted frame key table to the DRMHeader element of each of the Matroska container files using the source encoder.

15. The method of claim 14, wherein the source content includes a stream of video and the method further comprises:

writing a BlockGroup element to a Matroska container file including the DRM information that identifies the encrypted portions of the encoded video frames and the frame keys used to access the encrypted portions of the encoded video frames using the source encoder.

16. The method of claim 12, further comprising:

generating an index for each Matroska container file using the source encoder during the encoding of each of the alternative streams of protected content; and

writing a Cues element containing the index to the indexed Matroska container file using the source encoder.

17. A non-transitory machine readable medium containing processor instructions, where execution of the instructions by a processor causes the processor to perform a process comprising:

receiving a source content;

obtaining a common set of frame keys comprising a plurality of frame keys;

encoding the source content as a plurality of streams including a plurality of alternative streams of content, wherein each alternative stream of content comprises a plurality of encoded video frames;

encrypting portions of several encoded video frames from each alternative stream of content using keys from the same common set of frame keys;

after encrypting the portions of encoded video frames, writing the encoded video frames of each given alternative stream of protected content to a separate container file and, for each encoded video frame with an encrypted portion that is written to a given container file, writing a DRM information to the given container file that identifies an encrypted portion of the encoded video frame and a frame key from the common set of frame keys that can be utilized by a playback device to access the encrypted portion of the encoded video frame; and

storing an encrypted copy of the common set of frame keys in each container file, wherein each encrypted copy of the common set of frame keys has been encrypted with at least one encryption key.

18. A content distribution system, comprising:

a DRM server;

a content distribution server;

a source encoder configured to;

receive source content;

obtain a common set of frame keys comprising a plurality of frame keys from the DRM server;

encode the source content as a plurality of streams including a plurality of alternative streams of content associated with a title, wherein each alternative stream of content comprises a plurality of encoded video frames;

encrypt portions of several encoded video frames from each alternative stream of content using keys from the same common set of frame keys;

after encrypting the portions of encoded video frames, write the encoded video frames of each alternative stream of protected content to a separate container file from a plurality of container files and, for each encoded video frame with an encrypted portion that is written to a given container file, write a DRM information to the given container file that identifies (i) an encrypted portion of the encoded video frame and (ii) a frame key from the common set of frame keys that can be utilized by a playback device to access the encrypted portion of the encoded video frame;

store an encrypted copy of the common set of frame keys in each container file, wherein each encrypted copy of the common set of frame keys has been encrypted with at least one encryption key;

provide the plurality of container files containing the plurality of alternative streams of protected content associated with the title to the content distribution server;

wherein the DRM server is configured to;

receive a request for access to the alternative streams of protected content associated with the title from a playback device;

securely provide a copy of the at least one encryption key used to encrypt the common set of frame keys to the playback device; and

wherein the content distribution server is configured to grant the playback device access to the alternative streams of protected content associated with the title.

19. The content distribution system of claim 18, wherein the DRM server is configured to associate a title ID with the title.

20. The content distribution system of claim 19, wherein the DRM server is configured to associate the common set of frame keys with the title ID.

21. The content distribution system of claim 19, wherein the request for access to the alternative streams of protected content associated with the title comprises a request identifying a title ID.

22. The content distribution system of claim 18, wherein the content distribution server is further configured to:

receive requests for portions of at least one container file from the playback device; and

provide the requested portions of the at least one container file to the playback device.

23. The content distribution system of claim 18, wherein the plurality of container files are Matroska container files.

24. The content distribution system of claim 23, wherein the source encoder is configured to write a DRMHeader element to a TracksData element in a Tracks element within each of the Matroska container files, where the DRMHeader element includes the encrypted copy of the common set of frame keys.

25. The source encoder of claim 24, wherein:

the common set of frame keys is a part of a frame key table;

the source encoder is configured to;

encrypt the frame key table using the at least one encryption key; and

write the encrypted frame key table to the DRMHeader element of each of the Matroska container files.

26. The content distribution system of claim 25, wherein

the source content includes a stream of video;

and

the source encoder is configured to;

write a BlockGroup element to a Matroska container file including the DRM information that identifies the encrypted portions of the encoded video frames used to access the encrypted portions of the encoded video frames.

27. The content distribution system of claim 23, wherein the source encoder is configured to:

generate an index for each Matroska container file during the encoding of each of the alternative streams of protected content; and

write a Cues element containing the index to the indexed Matroska container file.

28. A method of distributing content encoded as a plurality of alternative streams of protected content, the method comprising:

receiving a source content using a source encoder;

obtaining a common set of frame keys from a DRM server using the source encoder, wherein the common set of frame keys comprises a plurality of frame keys;

encoding the source content as a plurality of streams including a plurality of alternative streams of content using the source encoder, wherein each alternative stream of content comprises a plurality of encoded video frames;

encrypting portions of several encoded video frames from each alternative stream of content using keys from the same common set of frame keys and the source encoder;

after encrypting the portions of encoded video frames, writing the encoded video frames of each given alternative stream of protected content to a separate container file from a plurality of container files using the source encoder and, for each encoded video frame with an encrypted portion that is written to a given container file, writing a DRM information to the given container file that identifies (i) an encrypted portion of the encoded video frame and (ii) a frame key from the common set of frame keys that can be utilized by a playback device to access the encrypted portion of the encoded video frame;

storing an encrypted copy of the common set of frame keys in each container file using the source encoder, wherein each encrypted copy of the common set of frame keys has been encrypted with at least one encryption key;

providing the plurality of container files containing the plurality of alternative streams of protected content to a content distribution server;

receiving a request for access to the alternative streams of protected content from a playback device using the DRM server, wherein the plurality of alternative streams of protected content are associated with a title;

securely providing to the playback device at least one encryption key using the DRM server, where the at least one encryption keys is used to access the encrypted common cryptographic information; and

granting the playback device access to the alternative streams of protected content using the content distribution server.

29. The method of claim 28, wherein the title is identified using a title ID.

30. The method of claim 29, wherein the common set of frame keys is associated with the title ID.

31. The method of claim 29, wherein the request for access to the alternative streams of protected content associated with the title comprises a request identifying a title ID.

32. The method of claim 28, further comprising:

receiving requests for portions of at least one container file from the playback device using the content distribution server; and

providing the requested portions of the at least one container file to the playback device using the content distribution server.

33. The method of claim 28, wherein the plurality of container files are Matroska container files.

34. The method of claim 28, wherein the container files are Matroska container files.

35. The method of claim 34, further comprising writing a DRMHeader element to a TracksData element in a Tracks element within each of the Matroska container files using the source encoder, where the DRMHeader element includes the encrypted copy of the common set of frame keys.

36. The method of claim 35, wherein the common set of frame keys is a part of a frame key table, the method further comprising:

encrypting the frame key table using the at least one encryption key; and

writing the encrypted frame key table to the DRMHeader element of each of the Matroska container files using the source encoder.

37. The method of claim 36, wherein the source content includes a stream of video, the method further comprising:

writing a BlockGroup element to a Matroska container file including the DRM information that identifies the encrypted portions of the encoded video frames and the frame keys used to access the encrypted portions of the encoded video frames using the source encoder.

38. The method of claim 34, further comprising:

generating an index for each Matroska container file during the encoding of each of the alternative streams of protected content using the source encoder; and

writing a Cues element containing the index to the indexed Matroska container file using the source encoder.