Self-keyed protection of anticipatory content

• US 9,405,924 B2
• Filed: 08/02/2013
• Issued: 08/02/2016
• Est. Priority Date: 01/18/2010
• Status: Active Grant

• Current Assignee: ViaSat Incorporated
• Original Assignee: ViaSat Incorporated
• Inventors: Sebastian, William B., Newman, Dan
• Primary Examiner(s): Lewis, Lisa
• Assistant Examiner(s): Tsang, Henry
• Application Number:
  US13/958,254
• Publication Number:
  US 20130326217A1
• Time in Patent Office: 1,096 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords

Abstract

Systems and methods are provided to facilitate anticipatory pushing of content to clients of a communications network in such a way that the content is unusable by the anticipatory clients until explicitly requested. Embodiments apply one or more self-keying techniques to a content dataset to generate an anticipatory dataset, such that the anticipatory dataset cannot be used to reconstruct the content dataset without a keying dataset that also can only be generated using the content dataset. The anticipatory dataset is pre-pushed to a client in anticipation of a future request for the content. If and when the client subsequently issues a request for the content dataset, the server intercepts the new copy of the content dataset received in response to the request, uses the content dataset to generate the keying dataset, and communicates the keying dataset to the client for local reconstruction of the content dataset by the client.

Claims

1. A method comprising:

determining, by a server optimizer of a communications network, to pre-position a content dataset at a first client terminal in anticipation of a future request for the content dataset by the first client terminal;

in response to the determination and prior to any request for the content dataset by the first client terminal;

calculating, by the server optimizer, an anticipatory dataset as a function of the content dataset, such that the anticipatory dataset represents at least a portion of the content dataset but cannot be used to reconstruct the content dataset without a keying dataset, the keying dataset being deterministically calculable from the content dataset; and

communicating the anticipatory dataset to the first client terminal from the server optimizer over the communications network for anticipatory storage of the anticipatory dataset local to the first client terminal without communicating the keying dataset from the server optimizer and without maintaining the keying dataset at the server optimizer;

receiving a content request at the server optimizer issued by the first client terminal for the content dataset, the receiving being subsequent to the communicating the anticipatory dataset to the first client terminal; and

in response to the receiving;

calculating the keying dataset as a function of the content dataset at the server optimizer; and

communicating the keying dataset from the server optimizer to the client terminal for use by the first client terminal in locally reconstructing the content dataset as a function of the keying dataset and the anticipatory dataset.

2. The method of claim 1, wherein calculating the anticipatory dataset as a function of the content dataset comprises:

encrypting the content dataset to generate the anticipatory dataset in such a way that the anticipatory dataset cannot be used to reconstruct the content dataset without decrypting the anticipatory dataset as a function of the keying dataset.

3. The method of claim 1, wherein:

calculating the anticipatory dataset as a function of the content dataset comprises encrypting the content dataset to generate the anticipatory dataset in such a way that the content dataset is reconstructable by decrypting the anticipatory dataset as a function of the keying dataset.

4. The method of claim 1, wherein the determining is in response to receiving the content dataset at the server optimizer of the communications network in accordance with the content dataset being communicated to a second client terminal in response to a content request issued by the second client terminal for the content dataset.

5. The method of claim 4, further comprising:

calculating the keying dataset as a function of the content dataset at the server optimizer; and

communicating the anticipatory dataset and the keying dataset to the second client terminal from the server optimizer over the communications network for local reconstruction at the second client terminal of the content dataset as a function of the keying dataset and the anticipatory dataset in response to the content request issued by the second client terminal for the content dataset.

6. The method of claim 5, wherein communicating the anticipatory dataset and the keying dataset to the second client terminal from the server optimizer over the communications network comprises:

multicasting the anticipatory dataset to at least the first client terminal and the second client terminal; and

unicasting the keying dataset only to the second client terminal.

7. The method of claim 5, further comprising:

removing the content dataset and the keying dataset from the server optimizer subsequent to communicating the anticipatory dataset and the keying dataset to the second client terminal and prior to receiving a content request issued by the first client terminal for the content dataset.

8. The method of claim 1, further comprising:

removing the content dataset from the server optimizer subsequent to communicating the anticipatory dataset to the first client terminal.

9. The method of claim 1, wherein calculating the anticipatory dataset is performed without calculating the keying dataset.

10. The method of claim 1, further comprising in response to the receiving:

determining whether the client optimizer is authorized to receive the content dataset,

wherein the calculating the keying dataset step and the communicating the keying dataset step are performed only when the client terminal is authorized to receive the content dataset.

11. A server system disposed at a server side of a communications network and in operative communications with a plurality of client terminals disposed at respective client sides of the communications network, the server system comprising:

a server optimizer, implemented by hardware, configured to;

determine to pre-position a content dataset at a first client terminal in anticipation of a future request for the content dataset by the first client terminal; and

in response to the determination and prior to any request for the content dataset by the first client terminal;

calculate an anticipatory dataset as a function of the content dataset, such that the anticipatory dataset represents at least a portion of the content dataset but cannot be used to reconstruct the content dataset without a keying dataset, the keying dataset being deterministically calculable from the content dataset; and

communicate the anticipatory dataset to the first client terminal from the server optimizer over the communications network for anticipatory storage of the anticipatory dataset local to the first client terminal without communicating the keying dataset from the server optimizer and without maintaining the keying dataset at the server optimizer;

receiving a content request at the server optimizer issued by the first client terminal for the content dataset, the receiving being subsequent to communicating the anticipatory dataset to the first client terminal; and

in response to the receiving;

calculate the keying dataset as a function of the content dataset at the server optimizer; and

communicate the keying dataset from the server optimizer to the client terminal for use by the first client terminal in locally reconstructing the content dataset as a function of the keying dataset and the anticipatory dataset.

12. The server system of claim 11, wherein the server optimizer is configured to calculating the anticipatory dataset as a function of the content dataset by:

encrypting the content dataset to generate the anticipatory dataset in such a way that the anticipatory dataset cannot be used to reconstruct the content dataset without decrypting the anticipatory dataset as a function of the keying dataset.

13. The server system of claim 11, wherein:

calculating the anticipatory dataset as a function of the content dataset comprises encrypting the content dataset to generate the anticipatory dataset in such a way that the content dataset is reconstructable by decrypting the anticipatory dataset as a function of the keying dataset.

20. The server system of claim 11, wherein the server optimizer is further configured, in response to the receiving, to:

determine whether the client optimizer is authorized to receive the content dataset,

wherein the server optimizer is configured to calculate the keying dataset and to communicate the keying dataset only when the client terminal is authorized to receive the content dataset.

14. A method comprising:

prior to a client terminal issuing a request for a content dataset;

receiving an anticipatory dataset at the client terminal from a server optimizer over a communications network, the anticipatory dataset calculated by the server optimizer as a function of the content dataset, such that the anticipatory dataset represents at least a portion of the content dataset but cannot be used to reconstruct the content dataset without a keying dataset, the keying dataset being deterministically calculable from the content dataset and not being maintained by the server optimizer, the anticipatory dataset received without the client terminal receiving the keying dataset; and

storing the anticipatory dataset local to the client terminal;

issuing the request for the content dataset from the client terminal over the communications network subsequent to storing the anticipatory dataset;

receiving the keying dataset from the server optimizer over the communications network in response to issuing the request for the content dataset, the keying dataset calculated by the server optimizer as a function of the content dataset intercepted at the server optimizer in response to the server optimizer receiving the request for the content dataset; and

reconstructing the content dataset at the client terminal as a function of the anticipatory dataset and the keying dataset.

15. The method of claim 14, wherein:

the anticipatory dataset is calculated by the server optimizer as a function of the content dataset by encrypting the content dataset to generate the anticipatory dataset in such a way that the anticipatory dataset cannot be used to reconstruct the content dataset without decrypting the anticipatory dataset as a function of the keying dataset; and

reconstructing the content dataset at the client terminal as a function of the anticipatory dataset and the keying dataset comprises decrypting the anticipatory dataset as a function of the keying dataset at the client terminal.

16. The method of claim 14, wherein:

the keying dataset is calculated by the server optimizer as a function of the content dataset by extracting a hold-back portion of the content dataset to use as the keying dataset;

the anticipatory dataset is calculated by the server optimizer as a function of the content dataset by removing the hold-back portion of the content dataset to generate the anticipatory dataset, so that the anticipatory dataset cannot be used to reconstruct the content dataset without the keying dataset; and

reconstructing the content dataset at the client terminal as a function of the anticipatory dataset and the keying dataset comprises filling in missing portions of the anticipatory dataset with the keying dataset at the client terminal.

17. A client system disposed at a client side of a communications network and in operative communications with a server optimizer disposed at a server side of the communications network, the client system comprising:

a client optimizer, implemented by hardware, configured to;

prior to a client terminal issuing a request for a content dataset;

receive an anticipatory dataset from the server optimizer over the communications network, the anticipatory dataset calculated by the server optimizer as a function of the content dataset, such that the anticipatory dataset represents at least a portion of the content dataset but cannot be used to reconstruct the content dataset without a keying dataset, the keying dataset being deterministically calculable from the content dataset and not being maintained by the server optimizer, the anticipatory dataset received without the client terminal receiving the keying dataset; and

store the anticipatory dataset local to the client optimizer;

issue the request for the content dataset over the communications network subsequent to storing the anticipatory dataset;

receive the keying dataset from the server optimizer over the communications network in response to issuing the request for the content dataset, the keying dataset calculated by the server optimizer as a function of the content dataset intercepted at the server optimizer in response to the server optimizer receiving the request for the content dataset; and

reconstructing the content dataset as a function of the anticipatory dataset and the keying dataset.

18. The client system of claim 17, wherein:

the anticipatory dataset is calculated by the server optimizer as a function of the content dataset by encrypting the content dataset to generate the anticipatory dataset in such a way that the anticipatory dataset cannot be used to reconstruct the content dataset without decrypting the anticipatory dataset as a function of the keying dataset; and

reconstructing the content dataset as a function of the anticipatory dataset and the keying dataset comprises decrypting the anticipatory dataset as a function of the keying dataset.

19. The client system of claim 17, wherein:

the keying dataset is calculated by the server optimizer as a function of the content dataset by extracting a hold-back portion of the content dataset to use as the keying dataset;

the anticipatory dataset is calculated by the server optimizer as a function of the content dataset by removing the hold-back portion of the content dataset to generate the anticipatory dataset, so that the anticipatory dataset cannot be used to reconstruct the content dataset without the keying dataset; and

reconstructing the content dataset as a function of the anticipatory dataset and the keying dataset comprises filling in missing portions of the anticipatory dataset with the keying dataset.