Apparatus and methods for content transfer protection

• US 9,565,472 B2
• Filed: 12/10/2012
• Issued: 02/07/2017
• Est. Priority Date: 12/10/2012
• Status: Active Grant

• Current Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Original Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Inventors: Hybertson, Eric
• Primary Examiner(s): Mehedi, Morshed
• Assistant Examiner(s): Alata, Ayoub
• Application Number:
  US13/710,308
• Publication Number:
  US 20140164760A1
• Time in Patent Office: 1,520 Days
• Field of Search: 713/153
• US Class Current: 1/1
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 9/06 the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
• CPC Class Codes: H04N 21/4402 involving reformatting operations of video signals for household redistribution, storage or real-time display details of conversion of video standards at pixel level H04N7/01; video transcoding H04N19/40; adapting incoming signals to the display format of the display terminal G09G5/005; media handling at the source in data packet switching networks H04L65/764
• CPC Class Codes: H04N 21/440218 by transcoding between formats or standards, e.g. from MPEG-2 to MPEG-4 conversion of standards in analogue television systems H04N7/01
• CPC Class Codes: H04N 21/4408 involving video stream encryption, e.g. re-encrypting a decrypted video stream for redistribution in a home network
• CPC Class Codes: H04N 21/4627 Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08

Abstract

Methods and apparatus for ensuring protection of transferred content. In one embodiment, content is transferred while enabling a network operator (e.g., MSO) to control and change rights and restrictions at any time, and irrespective of subsequent transfers. This is accomplished in one implementation by providing a premises device configured to receive content in a first encryption format and encodes using a first codec, with an ability to transcrypt and/or transcode the content into an encryption format and encoding format compatible with a device which requests the content therefrom (e.g., from PowerKey/MPEG-2 content to DRM/MPEG-4 content). The premises device uses the same content key to encrypt the content as is used by the requesting device to decrypt the content.

Claims

1. A premises gateway apparatus configured to provide content to one or more client devices in communication therewith, said gateway apparatus comprising:

at least one first interface configured to permit communication between said gateway apparatus and a first network;

at least one second interface configured to communicate with said one or more client devices;

a storage apparatus; and

a digital processor apparatus configured to run at least one computer program thereon, said computer program comprising a plurality of instructions which are configured to, when executed by said digital processor apparatus;

request and receive said content and a content key from said first network via said first interface;

receive a request originated from at least one of said one or more client devices for said content;

in response to said received request for said content;

(i) decrypt said content via said content key;

(ii) transcode said content from a first encoding format to a second encoding format, said second encoding format being compatible with capabilities of said at least one of said one or more client devices;

(iii) re-encrypt said content via said content key; and

(iv) provide said content to said at least one of said one or more client devices via said second interface;

wherein said request for said content key comprises a request from a digital rights management (DRM) client running on said digital processor apparatus, and an identical DRM client is also configured to run on a digital processor apparatus of said at least one of said one or more client devices; and

wherein said request for said content key comprises a request for said content key from a DRM server of said first network, and said receipt of said content key comprises receipt of a content key generated based at least in part on a determination at said DRM server that said premises gateway apparatus is entitled to receive access thereto based at least in part on communication of said DRM server with at least one database for authentication of a user associated with said premises gateway apparatus, said determination comprising use of said cryptographic hash anonymously identifying said user.

2. The gateway apparatus of claim 1, wherein said request and receipt of said content and a content key from said first network via said first interface comprises a request for said content from a first entity of said first network.

3. The gateway apparatus of claim 2, wherein said receipt of said content key comprises receipt of a DRM license.

4. The gateway apparatus of claim 2, wherein said first entity comprises a content server.

5. The gateway apparatus of claim 1, wherein said first encoding format comprises an Moving Pictures Experts Group (MPEG)-2 format, and said second encoding format comprises an MPEG-4 format.

6. The gateway apparatus of claim 1, wherein said received content is encrypted according to one or more legacy encryption techniques.

7. The gateway apparatus of claim 6, wherein said re-encryption of said content comprises encryption according to one or more digital rights management (DRM) techniques.

8. A digital video recorder (DVR) apparatus configured to enable synchronization of content to one or more portable media devices (PMDs), said DVR comprising:

at least one first interface configured to communicate with one or more entities of a content delivery network;

a second interface configured to communicate with said one or more PMDs;

a storage entity configured to store a plurality of encrypted content received from a content server of said content delivery network; and

a processor apparatus configured to;

run at least a digital rights management (DRM) client application thereon, said DRM client application configured to request and receive a DRM license from a DRM server of said content delivery network, said request comprising a hash value anonymously identifying said DVR, said DRM license being created based at least in part on a determination that said DVR is entitled to receive access thereto, said determination based at least in part on communication of said DRM server with one or more entitlement entities of said content delivery network and comprising use of said hash value; and

run at least one second computer application, said at least one second computer application comprising a plurality of instructions which are configured to, when executed;

receive a request for first content from said one or more PMDs;

identify said first content among said plurality of encrypted content stored at said storage entity;

decrypt said first content via at least information contained in said DRM license;

determine whether said identified first content comprises a format compatible with said one or more PMDs;

when it is determined that said format is not compatible, transcode said first content to a format compatible with said one or more PMDs;

re-encrypt said first content according to DRM standards; and

provide said first content and said DRM license to said one or more PMDs.

9. The DVR of claim 8, wherein said plurality of encrypted content stored at said storage entity comprises content encrypted according to PowerKey content access standards.

10. The DVR of claim 8, wherein said at least one second computer application is further configured to, when it is determined that said format is compatible, provide said content to said one or more PMDs in said compatible format and without transcoding said content.

11. The DVR of claim 8, wherein playback of said content at said one or more PMDs comprises a transmitting a request using an identical DRM client application for said DRM license.

12. A method of synchronizing content from a first premises device to at least one portable device in communication therewith, said method comprising:

storing at least first content at a storage entity of said first premises device, said at least first content being stored in a first encrypted format;

requesting and storing a license via a client application running on said first premises device, said license received from a server in direct or indirect communication with said first premises device, said license based at least in part on communication between the server and a database to determine that said first premises device is associated with an authenticated user, said determination based at least in part on a hash value provided to said server that anonymously identifies said user, said authentication configured to authorize said first premises device to access said first content;

receiving a request at said first premises device for said first content stored at said storage entity, said request originated from said at least one portable device;

in response to said received request;

(i) using at least information contained in said license to decrypt said first content from said first encrypted format and re-encrypt said first content to a second encrypted format;

(ii) transcoding said first content from a first encoding format not compatible with said portable device to a second encoding format compatible with said portable device; and

(iii) providing said transcoded and re-encrypted first content to said portable device, said portable device also configured to run said client application configured to access said license from said server to enable said decryption of said re-encrypted first content.

13. The method of claim 12, wherein said client process of said portable device and said client application of said first premises device comprise client processes with common encryption/decryption capabilities.

18. The method of claim 12, wherein said first encrypted format comprises encryption according to PowerKey content access standards.

19. The method of claim 12, wherein said second encrypted format comprises encryption according to one or more digital rights management (DRM) techniques.

20. The method of claim 12, wherein said first encoding format comprises an Moving Pictures Experts Group (MPEG)-2 format, and said second encoding format comprises an MPEG-4 format.

14. A method of providing content to a client device in a premises network, said premises network in data communication with a managed content delivery network, said method comprising:

receiving said content at an intermediary entity of said premises network from a content server of said managed content delivery network, said content being encrypted according to a first access control standard;

in response to a determination that said intermediary entity is entitled to access said content, receiving a rights package from a DRM server of said managed content delivery network;

receiving a request for said content originated from said client device;

authenticating a user of said client device as a subscriber of said managed content delivery network;

identifying a current subscription or service level of said user;

determining one or more rights of said user based at least on said current subscription or service level; and

performing via at least said intermediary entity, in response to said request and based at least on said authenticating and said determined one or more rights;

decryption of said content via at least information received in said rights package;

transcoding of said content from a first encoding format to a second encoding format;

re-encryption of said content according to a second access control standard; and

provision of said content and said rights package for delivery to said client device;

wherein said determination comprises use of a cryptographic hash by said DRM server and a communication with at least one database, said cryptographic hash anonymously identifying said intermediary entity.

15. The method of claim 14, wherein said rights package comprises a digital rights management (DRM) license;

and wherein said request is made via a DRM client running on said intermediary entity which is configured to have identical protected content access functionality to a DRM client running on said client device.

16. The method of claim 14, wherein said second encoding format comprises a format compatible with capabilities of both said client device and at least one other client device in said premises network.

17. The method of claim 16, wherein said first encoding format comprises a Moving Pictures Experts Group (MPEG)-2 format, and said second encoding format comprises an MPEG-4 or H.264 format.

21. The method of claim 14, wherein said first access control standard comprises a PowerKey content access standard.

22. The method of claim 14, wherein said first encoding format comprises a Moving Pictures Experts Group (MPEG)-2 format, and said second encoding format comprises an MPEG-4 or H.264 format.