Use of generic (browser) encryption API to do key exchange (for media files and player)

• US 8,984,285 B1
• Filed: 12/12/2012
• Issued: 03/17/2015
• Est. Priority Date: 12/12/2011
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Dorwin, David Kimbal, Sleevi, Ryan David, Scherkus, Andrew Martin
• Primary Examiner(s): WILLIAMS, JEFFERY L
• Application Number:
  US13/712,764
• Time in Patent Office: 825 Days
• Field of Search: None
• US Class Current: 713/164
• CPC Class Codes: G06F 11/3003 Monitoring arrangements specially adapted to the computing system or computing system component being monitored
• CPC Class Codes: G06F 21/105 Arrangements for software license management or administration, e.g. for managing licenses at corporate level
• CPC Class Codes: G06F 21/1062 Editing
• CPC Class Codes: G06F 21/1073 Conversion
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 40/143 Markup, e.g. Standard Generalized Markup Language [SGML] or Document Type Definition [DTD]
• CPC Class Codes: G06T 11/00 2D [Two Dimensional] image generation
• CPC Class Codes: G11B 20/00086 Circuits for prevention of unauthorised reproduction or copying, e.g. piracy indicating unauthorised use of record carriers in general G11B23/28; scrambling for television signal recording H04N5/913; network architectures or network protocols for network security H04L63/00; cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management
• CPC Class Codes: H04L 2463/103 applying security measure for protecting copyright
• CPC Class Codes: H04L 47/801 Real time traffic
• CPC Class Codes: H04L 47/805 QOS or priority aware
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0876 : based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 65/1101 : Session protocols
• CPC Class Codes: H04L 65/1108 : Web based protocols, e.g. webRTC
• CPC Class Codes: H04L 65/613 : for the control of the source by the destination control signals issued by the client directed to the server or network components specially adapted for selective content distribution H04N21/637
• CPC Class Codes: H04L 65/762 : at the source reformatting of additional data in video distribution servers H04N21/2355
• CPC Class Codes: H04L 65/80 : Responding to QoS
• CPC Class Codes: H04L 9/0631 : Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms
• CPC Class Codes: H04L 9/0861 : Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/32 : including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04N 21/2347 : involving video stream encryption
• CPC Class Codes: H04N 21/24 : Monitoring of processes or resources, e.g. monitoring of server load, available bandwidth, upstream requests monitoring of server performance or load G06F11/34; arrangements for observation, testing or troubleshooting for broadcast or for distribution combined with broadcast H04H20/12
• CPC Class Codes: H04N 21/25825 : involving client display capabilities, e.g. screen resolution of a mobile phone optimising the visualisation of content during browsing in the Internet G06F16/9577; processing of terminal status or physical abilities in wireless networks H04W8/22; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/25833 : involving client hardware characteristics, e.g. manufacturer, processing or storage capabilities allocation of resources considering hardware capabilities in multiprogramming arrangements G06F9/5044; allocation of resources considering software capabilities in multiprogramming arrangements G06F9/5055
• CPC Class Codes: H04N 21/41407 : embedded in a portable device, e.g. video client on a mobile phone, PDA, laptop constructional details of equipment or arrangements specially adapted for portable computer application G06F1/1626; arrangements specially adapted for mobile receivers in broadcast systems H04H20/57
• CPC Class Codes: H04N 21/4405 : involving video stream decryption
• CPC Class Codes: H04N 21/4516 : involving client characteristics, e.g. Set-Top-Box type, software version or amount of memory available

Abstract

Embodiments are directed towards decrypting encrypted content. A key for decrypting the encrypted content may be provided to a web application executing within a browser. The application may employ a generic cryptography application program interface (GCAPI) to perform actions on the key, including, storing the key, decrypting an encrypted key, generating another key, converting the key to a different encryption type, or the like. The GCAPI may or may not be enabled to explicitly share the key with the browser'"'"'s media engine. In response to receiving encrypted content, the GCAPI may provide the key to the application, explicitly or inexplicitly to the browser'"'"'s media engine, or the like. The key may be utilized by the application, the browser, the media element, browser'"'"'s media engine, and/or the GCAPI to decrypt the encrypted content. The decrypted content may be displayed within the browser to a user of a client device.

Claims

1. A method for managing content with a computing device that is operative to perform actions, comprising:

providing a key to an application that is separately operating on a user agent which is executing on the computing device;

providing the key to at least one of the user agent and a generic cryptography application program interface (GCAPI) that is employed by the user agent, which includes;

employing the GCAPI to generate another key based on the key;

based on a media element, instructing the user agent to utilize a current key stored by the GCAPI, wherein the current key is the other key; and

in response to a key request that is both based on the media element and from the user agent to the GCAPI, employing the GCAPI to provide the other key to the user agent;

providing encrypted content based on the media element of a markup language that is operatively supported by the user agent;

decrypting the encrypted content based on both the other key and the media element; and

displaying the decrypted content with the user agent.

2. The method of claim 1, wherein employing the GCAPI to provide the other key to the user agent, further includes employing the GCAPI to provide a reference to the other key to the user agent.

3. The method of claim 1, wherein decrypting the encrypted content based on both the other key and the media element, further comprises:

employing a media engine of the user agent to perform the decryption of the encrypted content.

4. The method of claim 1, further comprising:

employing an encrypted media extension application program interface to access the other key stored by the GCAPI.

5. The method of claim 1, further comprising:

enabling the application to provide the encrypted content to the GCAPI;

employing the GCAPI to enable decryption of the encrypted content; and

enabling the GCAPI to provide the decrypted content to the application.

6. The method of claim 1, further comprising:

enabling the application to provide the encrypted content to the GCAPI, wherein the encrypted content includes a stream of content;

employing the GCAPI to enable decryption of the encrypted content; and

enabling the GCAPI to provide the decrypted content to the media element.

7. The method of claim 1, wherein providing the key to at least one of the user agent and the GCAPI, further comprises:

based on the media element, instructing the GCAPI that the other key is associated with the media element; and

in response to a key request both based on the media element and from the user agent, employing the GCAPI to determine if the media element is associated with the other key.

8. The method of claim 1, wherein providing the key to at least one of the user agent and the GCAPI, further includes:

based on the media element, providing the user agent with a key ID associated with the encrypted content and the other key; and

based on the media element, employing the user agent to request the other key from the GCAPI based on the key ID.

9. The method of claim 1, wherein decrypting the encrypted content based on both the other key and the media element, further comprises:

employing the application to perform the decryption of the encrypted content.

10. The method of claim 1, wherein the user agent is a browser application.

11. A computing device for managing content, comprising:

a memory for storing data and instructions; and

a processor that executes the instructions to enable actions, including;

providing a key to an application that is separately operating on a user agent which is executing on the computing device;

providing the key to at least one of the user agent and a generic cryptography application program interface (GCAPI) that is employed by the user agent, which includes;

employing the GCAPI to generate another key based on the key;

based on a media element, instructing the user agent to utilize a current key stored by the GCAPI, wherein the current key is the other key; and

in response to a key request that is both based on the media element and from the user agent to the GCAPI, employing the GCAPI to provide the other key to the user agent;

providing encrypted content based on the media element of a markup language that is operatively supported by the user agent;

decrypting the encrypted content based on both the key and the media element; and

displaying the decrypted content with the user agent.

12. The computing device of claim 11, wherein providing the key to at least one of the user agent and the GCAPI, further includes providing a reference to the other key to the user agent.

13. The computing device of claim 11, wherein decrypting the encrypted content based on both the other key and the media element, further comprises:

employing a media engine of the user agent to perform the decryption of the encrypted content.

14. The computing device of claim 11, further comprising:

employing an encrypted media extension application program interface to access the other-key stored by the GCAPI.

15. The computing device of claim 11, further comprising:

enabling the application to provide the encrypted content to the GCAPI;

employing the GCAPI to enable decryption of the encrypted content; and

enabling the GCAPI to provide the decrypted content to the application.

16. The computing device of claim 11, wherein providing the key to at least one of the user agent and the GCAPI, further comprises:

based on the media element, instructing the GCAPI that the other key is associated with the media element; and

in response to a key request both based on the media element and from the user agent, employing the GCAPI to determine if the media element is associated with the other key.

17. The computing device of claim 11, wherein providing the key to at least one of the user agent and the GCAPI, further includes:

based on the media element, providing the user agent with a key ID associated with the encrypted content and the other key; and

based on the media element, employing the user agent to request the other key from the GCAPI based on the key ID.

18. A system for managing content, comprising:

a server device that is operative to provide the content over the network;

a network device, including;

a memory for storing data and instructions;

a processor that is operative to execute the instructions that enable actions, including;

providing a key to an application that is separately operating on a user agent which is executing on the network device;

providing the key to at least one of the user agent and a generic cryptography application program interface (GCAPI) that is employed by the user agent, which includes;

employing the GCAPI to generate another key based on the key; and

based on a media element, instructing the user agent to utilize a current key stored by the GCAPI, wherein the current key is the other key; and

in response to a key request that is both based on the media element and from the user agent to the GCAPI, employing the GCAPI to provide the other key to the user agent;

providing encrypted content based on the media element of a markup language that is operatively supported by the user agent;

decrypting the encrypted content based on both the key and the media element; and

displaying the decrypted content with the user agent.

19. The system of claim 18, wherein decrypting the encrypted content based on both the other key and the media element, further comprises:

employing a media engine of the user agent to perform the decryption of the encrypted content.

20. The system of claim 18, further comprising:

enabling the application to provide the encrypted content to the GCAPI;

employing the GCAPI to enable decryption of the encrypted content; and

enabling the GCAPI to provide the decrypted content to the application.

21. The system of claim 18, wherein providing the key to at least one of the user agent and the GCAPI, further comprises:

based on the media element, instructing the GCAPI that the other key is associated with the media element; and

in response to a key request both based on the media element and from the user agent, employing the GCAPI to determine if the media element is associated with the other key.

22. The system of claim 18, wherein providing the key to at least one of the user agent and the GCAPI, further includes:

based on the media element, providing the user agent with a key ID associated with the encrypted content and the other key; and

based on the media element, employing the user agent to request the other key from the GCAPI based on the key ID.