Selective and renewable encryption for secure distribution of video on-demand

• US 6,415,031 B1
• Filed: 03/20/2000
• Issued: 07/02/2002
• Est. Priority Date: 03/12/1999
• Status: Expired due to Term

• Current Assignee: Comcast IP Holdings I LLC (Comcast Corporation)
• Original Assignee: DIVA Systems Corporation
• Inventors: Colligan, Michael R., Goode, Christopher, Son, Yong Ho
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US09/528,580
• Time in Patent Office: 834 Days
• Field of Search: 725/29, 725/31, 725/87, 380/200, 380/210, 380/211, 380/239, 713/153, 713/160, 713/162
• US Class Current: 380/200
• CPC Class Codes: H04N 21/23473 by pre-encrypting
• CPC Class Codes: H04N 21/23476 by partially encrypting, e.g. encrypting the ending portion of a movie
• CPC Class Codes: H04N 21/26609 using retrofitting techniques, e.g. by re-encrypting the control words used for pre-encryption
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58
• CPC Class Codes: H04N 7/17309 Transmission or handling of upstream communications

Abstract

Selective encryption is provided in a process which includes: determining whether a predetermined criterion is satisfied; setting a selective encryption status field if the predetermined criterion is satisfied; and encrypting an unencrypted payload to generate an encrypted payload, and constructing a packet with the encrypted payload, if the predetermined criterion is satisfied. The predetermined criterion may be one of several criteria, each of which reduce the required amount of encryption and decryption while maintaining a high level of security. Renewable encryption is provided in a process which includes: copying a first encrypted digital video program from a remote server to a video source; decrypting the first encrypted digital video program using a first key to generate an unencrypted digital video program; encrypting the unencrypted digital video program using a second key to generate a second encrypted digital video program; transmitting the second encrypted digital video program from the video source to the remote server; and deleting the first encrypted digital video program from the remote server.

Claims

1. A secure method for providing digital video programming, the method comprising:

determining whether a predetermined criterion for encryption is satisfied;

setting a selective encryption status field if the predetermined criterion is satisfied;

encrypting an unencrypted payload to generate an encrypted payload, and constructing a packet with the encrypted payload, if the predetermined criterion is satisfied;

resetting the selective encryption status field if the predetermined criterion is unsatisfied;

constructing the packet with the unencrypted payload, if the predetermined criterion is unsatisfied; and

transmitting the packet.

2. The method of claim 1, wherein the predetermined criterion comprises an indication that intra frame data is contained in the unencrypted payload.

3. The method of claim 1, wherein the predetermined criterion comprises an indication that the payload includes data from a group of data including intra frame data and predicted frame data.

4. The method of claim 1, wherein the predetermined criterion comprises an indication that the payload includes a time stamp.

5. The method of claim 1, wherein the predetermined criterion comprises a counter being incremented to a next periodic subset of counts.

6. The method of claim 1, wherein the predetermined criterion comprises a random number being selected within a predetermined subset of a set of possible random numbers.

7. The method of claim 1, wherein the predetermined criterion is always satisfied.

8. The method of claim 1, wherein the predetermined criterion comprises an indication that the unencrypted payload includes a new packetized elementary stream packet, and the selective encryption status field comprises a payload unit start indicator flag.

9. The method of claim 1, wherein the predetermined criterion comprises an indication that the unencrypted payload includes a new program specific information section, and the selective encryption status field comprises a payload unit start indicator flag.

10. The method of claim 1, further comprising:

receiving the packet;

scanning the selective encryption status field;

determining whether the selective encryption status field is set; and

decrypting the encrypted payload if the selective encryption status field is set.

11. The method of claim 1, wherein the payload comprises a transport stream payload, and the packet comprises a transport stream packet.

12. The method of claim 1, wherein the selective encryption status field is preappended to the transport stream packet.

13. The method of claim 1, wherein the digital video programming comprises video on-demand.

14. The method of claim 1, wherein the digital video programming comprises broadcast video.

15. An apparatus for securely providing digital video programming, the apparatus comprising:

a determining device configured to determine whether a predetermined criterion is satisfied;

a setting device configured to set a selective encryption status field if the predetermined criterion is satisfied;

an encrypting device configured to encrypt an unencrypted payload to generate an encrypted payload, and a first constructing device configured to construct a packet with the encrypted payload, if the predetermined criterion is satisfied;

a resetting device configured to reset the selective encryption status field if the predetermined criterion is unsatisfied;

a second constructing device configured to construct the packet with the unencrypted payload, if the predetermined criterion is unsatisfied; and

a transmitting device configured to transmit the packet.

16. A secure method for providing digital video programming, the method comprising:

copying a first encrypted digital video program from a remote server to a video source;

decrypting the first encrypted digital video program using a first key to generate an unencrypted digital video program;

encrypting the unencrypted digital video program using a second key to generate a second encrypted digital video program;

transmitting the second encrypted digital video program from the video source to the remote server; and

deleting the first encrypted digital video program from the remote server.

17. The method of claim 16, wherein the first key corresponds to a first time epoch during which the remote server provides the first encrypted digital video program to subscriber stations, and the second key corresponds to a second time epoch during which the remote server provides the second encrypted digital video program to the subscriber stations.

18. The method of claim 17, further comprising, prior to deleting the first encrypted digital video program from the server, transitioning from the first time epoch to the second time epoch.

19. The method of claim 18, wherein the first and second time epochs do not correspond to billing cycles.

20. The method of claim 16, further comprising, prior to decrypting the first encrypted digital video program, scheduling the first encrypted digital video program for renewal of encryption.

21. The method of claim 16, further comprising, prior to copying the first encrypted digital video program, a process for introducing an initial encrypted digital video program to the remote server.

22. An apparatus for securely providing digital video programming, the apparatus comprising:

an encryption coordinator configured to receive a first encrypted digital video program from a remote server;

an encryptor configured to decrypt the first encrypted digital video program using a first key to generate an unencrypted digital video program and to encrypt the unencrypted digital video program using a second key to generate a second encrypted digital video program,

wherein the encryption coordinator receives the second encrypted digital video program from the encryptor and transmits the second encrypted digital video program to the remote server.

23. The apparatus of claim 22, wherein, prior to decrypting the first encrypted digital video program, the encryption coordinator schedules the first encrypted digital video program for renewal of encryption.