Systems and methods for securely streaming media content

• US 9,510,035 B2
• Filed: 09/01/2015
• Issued: 11/29/2016
• Est. Priority Date: 07/01/2008
• Status: Active Grant

• Current Assignee: Sling Media LLC (Dish Network Corporation)
• Original Assignee: Sling Media Incorporated (Dish Network Corporation)
• Inventors: Rao, Padmanabha R.
• Primary Examiner(s): Chai, Longbit
• Application Number:
  US14/842,452
• Publication Number:
  US 20150373384A1
• Time in Patent Office: 455 Days
• Field of Search: 713/168
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 65/60 Network streaming of media packets
• CPC Class Codes: H04N 21/2396 characterized by admission policies admission control, resource allocation in open networks H04L12/5692; arrangements for network security using user profiles for access control H04L63/102; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/25816 involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/25841 involving the geographical location of the client retrieval from the Internet by querying based on geographical locations G06F16/9537; arrangements for identifying locations of receiving stations in broadcast systems H04H60/51; location of the user terminal in data switching networks H04L67/52; services making use of the location of users or terminals in wireless networks H04W4/02; locating users or terminals in wireless networks H04W64/00
• CPC Class Codes: H04N 21/25875 involving end-user authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; arrangements for secret or secure communication including means for verifying the identity or authority of a user of the system H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/41407 embedded in a portable device, e.g. video client on a mobile phone, PDA, laptop constructional details of equipment or arrangements specially adapted for portable computer application G06F1/1626; arrangements specially adapted for mobile receivers in broadcast systems H04H20/57
• CPC Class Codes: H04N 21/4227 Providing Remote input by a user located remotely from the client device, e.g. at work
• CPC Class Codes: H04N 21/4331 Caching operations, e.g. of an advertisement for later insertion during playback
• CPC Class Codes: H04N 21/4408 involving video stream encryption, e.g. re-encrypting a decrypted video stream for redistribution in a home network
• CPC Class Codes: H04N 21/63345 by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 7/17318 Direct or substantially direct transmission and handling of requests

Abstract

Systems and methods are provided for securely providing a media stream from a server device to a remote player via a communications network. A request for a connection is received from the remote player at the server device via the communications network. In response to the request for the connection, an authorization credential is requested from a central server via the communications network. Further, in response to the authorization credential received from the central server, the media stream between the server device and the remote player can be established over the communications network. At least a portion of the media stream may be encrypted based upon the authorization credential.

Claims

1. A method for securely providing a media stream from a server device to a remote player via a communications network, the method comprising:

receiving, at the server device, a request for a connection from the remote player via the communications network;

in response to the request for the connection, requesting an authorization credential from a separately located central server via the communications network to authorize a media streaming session, wherein the authorization credential is generated and provided by the central server to both of the remote player and the server device via the communications network; and

establishing the media streaming session between the server device and the remote player over the communications network in response to receipt of the authorization credential from the central server so as to securely provide the media stream from the server device to the remote player, wherein at least a portion of the media stream is encrypted based upon the authorization credential.

2. The method of claim 1 further comprising verifying that media streaming is approved between the server device and the remote player prior to requesting the authorization credential, wherein the verifying is based at least in part upon a geographical location of the remote player.

3. The method of claim 1 further comprising verifying that media streaming is approved between the server device and the remote player prior to requesting the authorization credential, wherein the verifying is based at least in part upon an approval received via a television distribution medium separate from the communications network.

4. The method of claim 1 wherein the authorization credential comprises a symmetric encryption key that is also provided to the remote player over the communications network in response to a request received from the remote player at the central server.

5. The method of claim 4 wherein the establishing of the media stream comprises negotiating encryption parameters for the media stream based at least in part upon the symmetric encryption key.

6. The method of claim 1 wherein broadcast media content is received at the server device via a distribution medium that is separate from the communications network, and wherein the broadcast media content is encoded by the server device to create the media stream for transmission to the media player via the communications network.

7. The method of claim 6 further comprising verifying that media streaming is approved between the server device and the remote player prior to requesting the authorization credential, wherein the verifying is based at least in part upon an approval received via the same distribution medium separate from the communications network that provides the media content.

8. The method of claim 7 wherein the medium separate from the communications network comprises a satellite link.

9. A server system for securely providing a media stream of media content to a remote player via a communications network, the system comprising:

a network interface to the communications network;

a transcoder configured to encode the received media content for transport over the communications network; and

a control circuit in communication with at least the network interface and the transcoder, wherein the control circuit is configured to receive a request for a connection from the remote player via the network interface, and in response to the connection request, to request an authorization credential from a separately located central server via the network interface, wherein the authorization credential is generated by the central server and provided by the central server to both of the remote player and the server system via the communications network to authorize a media streaming session between the remote device and the server system, and wherein the control circuit is further configured to direct the encoding of the media content to thereby create the encrypt media stream using the authentication credential, and to transmit the encrypted media stream to the remote player via the network interface.

10. The system of claim 9 wherein the control circuit is configured to use the authentication credential to negotiate encryption parameters for the media stream based at least in part upon the received authorization credential.

11. The system of claim 9 wherein the control circuit is further configured to use the authentication credential to encrypt at least a portion of the media stream.

12. The system of claim 9 wherein the control circuit is further configured to verify that streaming is approved between the system and the remote player prior to requesting the authorization credential, wherein the verification is based upon an approval received via a medium separate from the communications network.

13. A central computerized authentication system that allows a media stream to be provided to a user of a remote player device, wherein the media stream is provided from a media streaming device to the remote player device over a communications network, the authentication system comprising a hardware processor, a memory and a network interface, wherein the authentication system is separate from both the media streaming device and the remote player device, and wherein the processor of the authentication system is configured to:

receive, at the central computerized authentication system separate from both of the media streaming device and the remote player device, a first request from the media streaming device via the communications network after the remote player device sends a connection request to the media streaming device, wherein the first request comprises a user credential associated with the user;

verify the user credential by the central computerized authentication system and, in response to successful verification, transmit a first response to the media streaming device that identifies the remote player device on the communications network; and

in response to a second request received at the central computerized authentication system from the media streaming device that has received the first response, transmit a shared authentication credential from the central computerized authentication system to both of the remote player device and the media streaming device to thereby allow the remote player device and the media streaming device to establish the media stream communications encrypted by the shared authentication credential.

14. The central computerized authentication system of claim 13 wherein the media stream is encrypted at least in part based upon the authentication credential.

15. The central computerized authentication system of claim 13 wherein the authentication credential is transmitted to the media streaming device in response to a key request from the media streaming device.

16. The central computerized authentication system of claim 13 further comprising validating that the user is authorized to connect to the media streaming device.

17. The computerized authentication system of claim 16 wherein the validating comprises querying an account server having an entry associated with the user.

18. The computerized authentication system of claim 17 wherein the account server is associated with a service provider providing media content to the media streaming device via a medium separate from the communications network, wherein the media stream comprises the media content that is received from the service provider via the separate medium and encoded for transmission on the communications network by the media streaming device.

19. The computerized authentication system of claim 13 wherein the media stream comprises media content that is encoded by the media streaming device for transmission on the communications network, and wherein the media content is delivered to the media streaming device via a medium separate from the communications network, and wherein the shared authentication credential is transmitted to the media streaming device at least in part via the medium that delivers the media content to the media streaming device.

20. The computerized authentication system of claim 13 wherein the media stream comprises media content that is encoded by the media streaming device for transmission on the communications network, and wherein the media content is delivered to the media streaming device via a direct broadcast satellite medium separate from the communications network, and wherein the shared authentication credential is transmitted to the media streaming device at least in part via the direct broadcast satellite medium that delivers the media content to the media streaming device.