Method and system for unified mobile content protection

• US 9,858,396 B2
• Filed: 12/08/2014
• Issued: 01/02/2018
• Est. Priority Date: 08/14/2009
• Status: Active Grant

• Current Assignee: Ericsson AB (Telefonaktiebolaget LM Ericsson)
• Original Assignee: Ericsson AB (Telefonaktiebolaget LM Ericsson)
• Inventors: Nair, Raj, Mikhailov, Mikhail
• Primary Examiner(s): SIMITOSKI, MICHAEL J
• Application Number:
  US14/563,642
• Publication Number:
  US 20150095646A1
• Time in Patent Office: 1,121 Days
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06Q 50/184 Intellectual property management
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 65/612 for unicast
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/0631 Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms
• CPC Class Codes: H04L 9/0656 Pseudorandom key sequence combined element-for-element with data sequence, e.g. one-time-pad [OTP] or Vernam's cipher
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/2351 involving encryption of additional data arrangements using cryptography for the use of broadcast information or broadcast-related information H04H60/23
• CPC Class Codes: H04N 21/25816 involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/26613 for generating or managing keys in general key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04
• CPC Class Codes: H04N 21/41407 embedded in a portable device, e.g. video client on a mobile phone, PDA, laptop constructional details of equipment or arrangements specially adapted for portable computer application G06F1/1626; arrangements specially adapted for mobile receivers in broadcast systems H04H20/57
• CPC Class Codes: H04N 21/42684 Client identification by a unique number or address, e.g. serial number, MAC address, socket ID network arrangements, protocols or services for addressing or naming H04L61/00
• CPC Class Codes: H04N 21/4353 involving decryption of additional data arrangements using cryptography for the use of broadcast information or broadcast-related information H04H60/23
• CPC Class Codes: H04N 21/4405 : involving video stream decryption
• CPC Class Codes: H04N 21/4627 : Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/6125 : involving transmission via Internet transmission by internet of broadcast information H04H60/82
• CPC Class Codes: H04N 21/63345 : by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 21/6582 : Data stored in the client, e.g. viewing habits, hardware capabilities, credit card number arrangements where receivers interact with the broadcast H04H20/38
• CPC Class Codes: H04N 21/835 : Generation of protective data, e.g. certificates protecting software against unauthorised usage in a vending or licensing environment G06F21/10
• CPC Class Codes: H04N 21/8456 : by decomposing the content in the time domain, e.g. in time segments
• CPC Class Codes: H04N 7/1675 : Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58
• CPC Class Codes: H04N 7/17318 : Direct or substantially direct transmission and handling of requests

Abstract

Media content is delivered to a variety of mobile devices in a protected manner based on client-server architecture with a symmetric (private-key) encryption scheme. A media preparation server (MPS) encrypts media content and publishes and stores it on a content delivery server (CDS), such as a server in a content distribution network (CDN). Client devices can freely obtain the media content from the CDS and can also freely distribute the media content further. They cannot, however, play the content without first obtaining a decryption key and license. Access to decryption keys is via a centralized rights manager, providing a desired level of DRM control.

Claims

1. A method for secure over-the-top delivery of content to client devices, comprising:

ingesting content in the form of media item files containing respective distinct user-selected media items, each user-selected media item being a media title specifically requested for playback by requesting users of respective client devices, the ingesting including receiving the media item files from a content publisher and performing media preparation for each media item file, including;

(i) transcoding the user-selected media item contained in the media item file to a plurality of transcoded media items of respective distinct media encoding formats,

(ii) segmenting each transcoded media item into a respective plurality of fixed-size segments for segment-based delivery of the transcoded media item to the client devices;

(iii) obtaining a media-item-specific media encryption key for the specifically requested user-selected media item from a digital rights management server and encrypting each segment of each of the transcoded media items using the media encryption key and a respective encryption cipher for the specifically requested user-selected media item, the encrypting producing respective encrypted segments, and

(iv) publishing a plurality of distinct transcoded media item files to a content delivery network from which the client devices retrieve the transcoded media item files, each transcoded media item file including the encrypted segments for the respective transcoded media item; and

in response to respective requests for playback of a user-selected media item by the requesting users of the client devices, delivering respective client-device-specific rights objects to the client devices wherein a client-device-specific rights object is formed responsive to a device identifier, a media identifier of the user-selected media item and a user identifier of the requesting user, each rights object containing the media-item-specific media encryption key for the user-selected media item and an identification of the encryption cipher for the user-selected media item, each rights object being securely delivered to the respective requesting client device in a respective client-device-specific manner to be usable by only the respective requesting client device in decrypting a respective transcoded media item file retrieved from the content delivery network,

and further wherein each requesting client device engages in a respective device registration process including sending device and user identification information encrypted with a respective secret domain key built-in to the client device and establishing a device-specific secure channel as well as a device-specific rights encryption key, the device-specific rights encryption key being shared with the client device and generated using the device information and the respective domain key, each requesting client device sending a media rights request that is encrypted with the respective domain key and generated relative to requesting playback of the user-selected media item.

2. The method according to claim 1, wherein the user-selected media items are respective distinct complete movies.

3. The method according to claim 1, wherein the encryption cipher is one of a plurality of distinct encryption ciphers, and wherein encrypting each segment of a user-selected media item includes identifying the one encryption cipher as distinct from others of the encryption ciphers for use in encrypting the segments of the respective user-selected media item.

4. The method according to claim 3, further including maintaining respective distinct media preparation profiles for the user-selected media items, the media preparation profiles including respective media-item-specific identifications of respective ones of the encryption ciphers to be used in encrypting the segments of the respective user-selected media items.

5. The method according to claim 4, wherein the encryption ciphers include one or more stream ciphers for which a key length is also per-media-item configurable, and wherein the media preparation profiles include respective distinct key length values for different key lengths to be used in the encrypting of the respective user-selected media items.

6. The method according to claim 1, wherein each rights object is securely delivered to the respective requesting client device by encrypting the rights object with a respective client-device-specific rights encryption key.

7. The method according to claim 1, wherein encrypting the segments includes performing an encryption operation using a key of a certain length combined with data of protected content, the encryption operation including:

randomly generating the media encryption keys on a per-media-item basis at the time of the ingesting of the respective media item files;

establishing distinct initialization vectors for the segments as respective sequence numbers of the segments; and

performing an encryption algorithm on each segment using the respective initialization vector, the encryption algorithm including cipher block chaining within each segment and not spanning multiple segments.

8. The method according to claim 1, wherein the ingesting of the media item files includes receiving the media item files from the content publisher using a secure file transfer method.

9. The method according to claim 1, wherein the requests are media rights requests each including an identifier of a respective requesting client device, an identifier of a respective user-selected media item being requested, and a respective current play count maintained at the requesting client device for the user-selected media item being requested.

10. The method according to claim 1, wherein each delivered rights object is accompanied by a (i) pointer to a respective transcoded media file in the content delivery network, and (ii) an identifier of the encryption cipher used to encrypt the transcoded media file.

11. A computer system including one or more computers coupled together and executing respective computer program instructions causing the computers to co-operatively provide secure over-the-top delivery of content to client devices by:

ingesting content in the form of media item files containing respective distinct user-selected media items, each user-selected media item being a media title specifically requested for playback by requesting users of respective client devices, the ingesting including receiving the media item files from a content publisher and performing media preparation for each media item file, including;

(i) transcoding the user-selected media item contained in the media item file to a plurality of transcoded media items of respective distinct media encoding formats,

(ii) segmenting each transcoded media item into a respective plurality of fixed-size segments for segment-based delivery of the transcoded media item to the client devices;

(iii) obtaining a media-item-specific media encryption key for the specifically requested user-selected media item from a digital rights management server and encrypting each segment of each of the transcoded media items using the media encryption key and a respective encryption cipher for the specifically requested user-selected media item, the encrypting producing respective encrypted segments, and

(iv) publishing a plurality of distinct transcoded media item files to a content delivery network from which the client devices retrieve the transcoded media item files, each transcoded media item file including the encrypted segments for the respective transcoded media item; and

in response to respective requests for playback of a user-selected media item by the requesting users of the client devices, delivering respective client-device-specific rights objects to the client devices wherein a client-device-specific rights object is formed responsive to a device identifier, a media identifier of the user-selected media item and a user identifier of the requesting user, each rights object containing the media-item-specific media encryption key for the user-selected media item and an identification of the encryption cipher for the user-selected media item, each rights object being securely delivered to the respective requesting client device in a respective client-device-specific manner to be usable by only the respective requesting client device in decrypting a respective transcoded media item file retrieved from the content delivery network,

and further wherein each requesting client device engages in a respective device registration process including sending device and user identification information encrypted with a respective secret domain key built-in to the client device and establishing a device-specific secure channel as well as a device-specific rights encryption key, the device-specific rights encryption key being shared with the client device and generated using the device information and the respective domain key, each requesting client device sending a media rights request that is encrypted with the respective domain key and generated relative to requesting playback of the user-selected media item.

12. The computer system according to claim 11, wherein the user-selected media items are respective distinct complete movies.

13. The computer system according to claim 11, wherein the encryption cipher is one of a plurality of distinct encryption ciphers, and wherein encrypting each segment of a user-selected media item includes identifying the one encryption cipher as distinct from others of the encryption ciphers for use in encrypting the segments of the respective user-selected media item.

14. The computer system according to claim 13, wherein the secure delivery of content further includes maintaining respective distinct media preparation profiles for the user-selected media items, the media preparation profiles including respective media-item-specific identifications of respective ones of the encryption ciphers to be used in encrypting the segments of the respective user-selected media items.

15. The computer system according to claim 14, wherein the encryption ciphers include one or more stream ciphers for which a key length is also per-media-item configurable, and wherein the media preparation profiles include respective distinct key length values for different key lengths to be used in the encrypting of the respective user-selected media items.

16. The computer system according to claim 11, wherein each rights object is securely delivered to the respective requesting client device by encrypting the rights object with a respective client-device-specific rights encryption key.

17. The computer system according to claim 11, wherein encrypting the segments includes performing an encryption operation using a key of a certain length combined with data of protected content, the encryption operation including:

randomly generating the media encryption keys on a per-media-item basis at the time of the ingesting of the respective media item files;

establishing distinct initialization vectors for the segments as respective sequence numbers of the segments; and

performing an encryption algorithm on each segment using the respective initialization vector, the encryption algorithm including cipher block chaining within each segment and not spanning multiple segments.

18. The computer system according to claim 11, wherein the ingesting of the media item files includes receiving the media item files from the content publisher using a secure file transfer method.

19. The computer system according to claim 11, wherein the requests are media rights requests each including an identifier of a respective requesting client device, an identifier of a respective user-selected media item being requested, and a respective current play count maintained at the requesting client device for the user-selected media item being requested.

20. The computer system according to claim 11, wherein each delivered rights object is accompanied by a (i) pointer to a respective transcoded media file in the content delivery network, and (ii) an identifier of the encryption cipher used to encrypt the transcoded media file.