Application-driven playback of offline encrypted content with unaware DRM module

• US 9,110,902 B1
• Filed: 08/15/2012
• Issued: 08/18/2015
• Est. Priority Date: 12/12/2011
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Dorwin, David Kimbal
• Primary Examiner(s): Gelagay, Shewaye
• Assistant Examiner(s): LE, KHOI V
• Application Number:
  US13/586,664
• Time in Patent Office: 1,098 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/3003 Monitoring arrangements specially adapted to the computing system or computing system component being monitored
• CPC Class Codes: G06F 21/105 Arrangements for software license management or administration, e.g. for managing licenses at corporate level
• CPC Class Codes: G06F 21/1062 Editing
• CPC Class Codes: G06F 21/1073 Conversion
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 40/143 Markup, e.g. Standard Generalized Markup Language [SGML] or Document Type Definition [DTD]
• CPC Class Codes: G06T 11/00 2D [Two Dimensional] image generation
• CPC Class Codes: G11B 20/00086 Circuits for prevention of unauthorised reproduction or copying, e.g. piracy indicating unauthorised use of record carriers in general G11B23/28; scrambling for television signal recording H04N5/913; network architectures or network protocols for network security H04L63/00; cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 2463/103 applying security measure for protecting copy right protecting software against unauthorised usage in a vending or licensing environment, e.g. protection the software providers copyright G06F21/10; data processing systems or methods, specially adapted for payment schemes, architectures or protocols G06Q20/00; secrecy systems or subscription systems H04N7/16
• CPC Class Codes: H04L 47/801 Real time traffic
• CPC Class Codes: H04L 47/805 QOS or priority aware
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0876 : based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 65/1101 : Session protocols
• CPC Class Codes: H04L 65/1108 : Web based protocols, e.g. webRTC
• CPC Class Codes: H04L 65/613 : for the control of the source by the destination control signals issued by the client directed to the server or network components specially adapted for selective content distribution H04N21/637
• CPC Class Codes: H04L 65/762 : at the source reformatting of additional data in video distribution servers H04N21/2355
• CPC Class Codes: H04L 65/80 : Responding to QoS
• CPC Class Codes: H04L 9/0631 : Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms
• CPC Class Codes: H04L 9/0861 : Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/32 : including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04N 21/2347 : involving video stream encryption
• CPC Class Codes: H04N 21/24 : Monitoring of processes or resources, e.g. monitoring of server load, available bandwidth, upstream requests monitoring of server performance or load G06F11/34; arrangements for observation, testing or troubleshooting for broadcast or for distribution combined with broadcast H04H20/12
• CPC Class Codes: H04N 21/25825 : involving client display capabilities, e.g. screen resolution of a mobile phone optimising the visualisation of content during browsing in the Internet G06F16/9577; processing of terminal status or physical abilities in wireless networks H04W8/22; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/25833 : involving client hardware characteristics, e.g. manufacturer, processing or storage capabilities allocation of resources considering hardware capabilities in multiprogramming arrangements G06F9/5044; allocation of resources considering software capabilities in multiprogramming arrangements G06F9/5055
• CPC Class Codes: H04N 21/41407 : embedded in a portable device, e.g. video client on a mobile phone, PDA, laptop constructional details of equipment or arrangements specially adapted for portable computer application G06F1/1626; arrangements specially adapted for mobile receivers in broadcast systems H04H20/57
• CPC Class Codes: H04N 21/4405 : involving video stream decryption
• CPC Class Codes: H04N 21/4516 : involving client characteristics, e.g. Set-Top-Box type, software version or amount of memory available

Abstract

Application-driven interceptor module enables offline playback of Digital Rights Management (DRM) protected content to work in a same way as online playback. Communications with the DRM module are intercepted by the application-driven interceptor that is aware of the client device'"'"'s network connection status. When the interceptor application determines that the client device is offline, requests for the protected content, and license/key to the protected content may then be managed by the interceptor application. In one embodiment, the interceptor application may retrieve requests for the key/license from a locally protected data store, and provide the key/license to the DRM module. In this manner, the DRM module may be unaware that its messages are being intercepted, and may then operate the same, unaware of whether or not the client device is online or offline.

Claims

1. A client device, comprising:

a network interface to receive content over a network; and

one or more processors that perform actions, including;

installing onto the client device an interceptor application that is arranged to perform actions, including;

monitoring whether the client device is offline or online with respect to network communications with a remote key management device (KMD) that manages content decryption keys and licenses, wherein the client device is offline with the KMD if communications between the client device and the KMD are unable to occur and the client device is online with the KMD if communications between the client device and the KMD are able to occur;

when it is determined that the client device is online with the KMD;

obtaining a content decryption key or license for protected content from the KMD;

selectively providing the content decryption key or license obtained from the KMD to a digital rights management (DRM) module on the client device, such that the DRM module uses the content decryption key or license to decrypt at least a portion of the protected content for play by the client device;

securely storing in a local store of the client device the content decryption key or license; and

when it is determined that the client device is offline to the KMD;

intercepting, by the interceptor application, a request for the content decryption key or license from the DRM module to the KMD, the DRM module being unaware whether the client device is offline or online; and

selectively providing the stored content decryption key or license to the DRM module from the local store, such that the DRM module uses the content decryption key or license to decrypt at least a portion of the protected content for play by the client device.

2. The client device of claim 1, wherein selectively providing the stored decryption key or license further comprises:

determining an integrity of the client device;

when it is determined that the integrity of the client device is compromised, inhibiting access to the decryption key or license, such that the DRM module is inhibited from decrypting the portion of protected content; and

when it is determined that the integrity of the client device is uncompromised, providing access to the decryption key or license to the DRM module responsive to the intercepted request.

3. The client device of claim 1, wherein the interceptor application is arranged to intercept messages and other communications from the DRM module when the client device is offline or online, the DRM module being unaware of whether the messages and other communications are intercepted.

4. The client device of claim 1, wherein interceptor application initiates obtaining the decryption key or license for protected content from the KMD absent a request for the decryption key or license being received from the DRM module, a browser, or a media player.

5. The client device of claim 1, wherein the client device is configured to access the protected content online from a content provider device while the client device is offline to the KMD.

6. The client device of claim 1, wherein the interceptor application is further arranged to perform actions, including:

when the client device is online to a content provider, obtaining the protected content over a network; and

when the client device is offline to the content provider, obtaining the protected content from the local store on the client device.

7. A system, comprising:

one or more memory storage devices that store executable components, protected content, and one or more decryption keys or licenses that enable use of the protected content; and

one or more processors that execute the stored executable components, the executable components including;

a digital rights management (DRM) module that is configured to operate to perform actions, including;

sending a request for a content decryption key or license to a remote key management device (KMD) that manages content decryption keys and licenses;

receiving the content decryption key or license in response to the request; and

employing the content decryption key or license to decrypt and provide access to the protected content; and

an interceptor application configured to intercept messages from the DRM module to the KMD and to provide responses to the messages to the DRM module such that the DRM module is unaware whether the system is offline or online with the KMD, wherein the system is offline with the KMD if communications between the system and the KMD are unable to occur and the system is online with the KMD if communications between the system and the KMD are able to occur, the application further configured to operate to perform actions, including;

when it is determined that the system is online with the KMD;

intercepting a content decryption key or license for protected content received from the KMD;

selectively providing the content decryption key or license received from the KMD to the DRM module, such that the DRM module uses the content decryption key or license to decrypt at least a portion of the protected content for play by the system;

securely storing in the system the intercepted decryption key or license; and

when it is determined that the client device is offline to the KMD;

intercepting the request for the content decryption key or license from the DRM to the KMD module, and

selectively providing the securely stored content decryption key or license to the DRM module.

8. The system of claim 7, wherein selectively providing the securely stored content decryption key or license further comprises:

determining an integrity of the client device;

when it is determined that the integrity of the client device is compromised, inhibiting access to the decryption key or license, such that the DRM module is blocked from decrypting the portion of protected content; and

when it is determined that the integrity of the client device is uncompromised, providing access to the decryption key or license to the DRM module responsive to the intercepted request.

9. The system of claim 7, wherein interceptor application employs a private key to securely store the decryption key or license locally on the system.

10. The system of claim 7, wherein the interceptor application is further arranged to perform actions, including:

when the system is online to a content provider, obtaining the protected content over a network; and

when the system is offline to the content provider, obtaining the protected content from a local store on the system.

11. The system of claim 7, wherein the interceptor application is downloaded from a remote computing device and installed for execution on the system.

12. The system of claim 7, wherein access to the protected content and decryption key or license enables a reduced time to a first frame for playing of the protected content.

13. The system of claim 7, wherein the system is configured to access the protected content online from a content provider device while the system is offline to the KMD.

14. An apparatus comprising a non-transitory computer readable medium, having computer-executable instructions stored thereon, that in response to execution by a client device, cause the client device to perform operations, comprising:

installing onto the client device an interceptor application that is arranged to perform actions, including;

monitoring whether the client device is offline or online with respect to network communications with a remote key management device (KMD) that manages content decryption keys and licenses, wherein the client device is offline with the KMD if communications between the client device and the KMD are unable to occur and the client device is online with the KMD if communications between the client device and the KMD are able to occur;

when it is determined that the client device is online with the KMD;

intercepting a content decryption key or license for protected content from the KMD;

selectively providing the content decryption key or license intercepted from the KMD to a digital rights management (DRM) module on the client device, such that the DRM module uses the content decryption key or license to decrypt at least a portion of the protected content for play by the client device;

securely storing in a local store of the client device the intercepted content decryption key or license; and

when it is determined that the client device is offline to the KMD;

intercepting, by the interceptor application, a request for the content decryption key or license from the DRM module to the KMD, the DRM module being unaware whether the client device is offline or online; and

selectively providing the stored content decryption key or license to the DRM module from the local store, such that the DRM module uses the content decryption key or license to decrypt at least a portion of the protected content for play by the client device.

15. The apparatus of claim 14, wherein the interceptor application is further arranged to perform actions, including:

when the client device is online to a content provider, obtaining the protected content over a network; and

when the client device is offline to the content provider, obtaining the protected content from the local store on the client device.

16. The apparatus of claim 14, wherein interceptor application employs a private key to securely store the decryption key or license locally on the client device.

17. The apparatus of claim 14, wherein selectively providing the stored decryption key or license further comprises:

determining an integrity of the client device;

when it is determined that the integrity of the client device is compromised, inhibiting access to the decryption key or license, such that the DRM module is inhibited from decrypting the portion of protected content; and

when it is determined that the integrity of the client device is uncompromised, providing access to the decryption key or license to the DRM module responsive to the intercepted request.

18. The apparatus of claim 14, wherein the client device is configured to access the protected content online from a content provider device while the client device is offline to the KMD.

19. The apparatus of claim 14, wherein access to the protected content and decryption key or license enables a reduced time to a first frame for playing of the protected content.