System and method for using a streaming protocol

• US 8,284,931 B2
• Filed: 05/24/2010
• Issued: 10/09/2012
• Est. Priority Date: 12/22/2003
• Status: Active Grant

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Inventors: Pare, David F., Biderman, David L., Loomis, Stephen E., Brown, Scott K., Wise, Michael, Wexelblat, David, Cahill, Conor P., Bill, David S.
• Primary Examiner(s): Abrishamkar, Kaveh
• Application Number:
  US12/786,129
• Publication Number:
  US 20100228965A1
• Time in Patent Office: 869 Days
• Field of Search: None
• US Class Current: 380/37
• CPC Class Codes: H04L 65/762 at the source reformatting of additional data in video distribution servers H04N21/2355
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/065 Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/12 Transmitting and receiving encryption devices synchronised or initially set up in a particular manner

Abstract

An initialization vector (IV) is employed to decrypt a block of a stream that has been encrypted with Cypher Block Chaining (CBC) encryption, without requiring decryption of previous blocks within the stream. For example, a listener who accesses a distribution point to retrieve encrypted content authenticates himself to an application server that regulates access to encrypted content on the distribution point, and responsively receives a key. The listener then requests access to a reference point within the encrypted content stream somewhere after its beginning (e.g., using preview clips). The distribution point relates the reference point to a corresponding block of the encrypted stream, and identifies an IV previously used for encryption of that block. The distribution point provides the associated encrypted block of content and the IV to the listener to enable mid-stream rendering of the encrypted content, without requiring the listener to decrypt previous blocks within the encrypted stream.

Claims

1. A method of distributing content using a distribution point, the method comprising:

providing a stream of content to the distribution point;

receiving a sequence of initialization vectors for the stream of content, the initialization vectors representing settings associated with corresponding portions of content, the settings enabling a decryption engine to decrypt the corresponding content portions using a key;

receiving, from an application server, an indication that a request from a client device to access the stream of content is supported;

receiving, from the client device and across a communications network, the request to access the stream of content;

enabling, based on receiving the indication, the client device to access the stream of content in a connection between the client device and the distribution point;

accessing, from within the request, a time mark with a temporal description of a portion of the stream of content should be requested by the user;

relating the time mark to the sequence of initialization vectors; and

generating an instruction to transmit at least one of the initialization vectors to the client device in a first metadata message.

2. The method of claim 1, further comprising providing an update to the transmitted initialization vector in a subsequent metadata message.

3. The method of claim 1, further comprising receiving time shifting commands across the connection as a metadata command.

4. The method of claim 1, further comprising providing a key update to a subscriber community that includes the client device using a broadcast metadata message that is transmitted across the connection.

5. The method of claim 1, wherein receiving the instruction to distribute the stream of content on the distribution point includes receiving the request from the client device to access the stream of content.

6. The method of claim 1, further comprising associating the sequence of initialization vectors with the stream of content in a table that indicates that a particular initialization vector should be used with a particular block of content.

7. The method of claim 1, further comprising storing the stream of content with a delimiter indicating where the distribution device should segment the stream of content into different packets.

8. The method of claim 7, further comprising storing the sequence of initialization vectors in association with the delimiter so that the distribution point is configured to transmit the initialization vector in association with a block of content within the stream of content.

9. The method of claim 1, further comprising receiving, from a stream manager a path identifier that is configured to specify a directory structure where the stream of content may be accessed, and storing the stream of content in the directory structure as specified by the path identifier.

10. The method of claim 1, further comprising receiving a host identifier indicating an alternative location where the stream of content is accessible.

11. The method of claim 1, further comprising transmitting the host identifier in a redirect command.

12. The method of claim 1, further comprising receiving a user-agent identifier configured to describe the client device.

13. The method of claim 12, further comprising using the user-agent identifier to authenticate the client device with the application server.

14. The method of claim 1, further comprising receiving an instruction to distribute the stream of content on the distribution point.

15. The method of claim 14, wherein the providing further comprises providing the stream of content to the distribution point in response to the instruction.

16. The method of claim 14, wherein receiving the instruction to distribute the stream of content on the distribution point includes receiving the request from a stream manager to enable the client device to access the stream of content.

17. The method of claim 14, wherein receiving the instruction to distribute the stream of content on the distribution point includes receiving a response to a redirect command from the client device to access the stream of content.

18. The method of claim 1, wherein the indication further comprises information authenticating the client device with the application server.

19. An apparatus, comprising:

a storage device; and

at least one processor coupled to the storage device, wherein the storage device stores a program for controlling the at least one processor, and wherein the at least one processor, being operative with the program, is configured to;

provide a stream of content to a distribution point;

receive a sequence of initialization vectors for the stream of content, the initialization vectors representing settings associated with corresponding portions of content, the settings enabling a decryption engine to decrypt the corresponding portions of content using a key;

receive, from an application server, an indication that a request from a client device to access the stream of content is supported;

receive, from the client device and across a communications network, the request to access the stream of content;

enable, based on receiving the indication, the client device to access the stream of content in a connection between the client device and the distribution point;

access, from within the request, a time mark with a temporal description of a portion of the stream of content requested by the user;

relate the time mark to the sequence of initialization vectors; and

generate an instruction to transmit at least one of the initialization vectors to the client device in a first metadata message.

20. A tangible, non-transitory computer-readable medium storing instructions that, when executed by at least one processor, cause the at least one processor to perform a method, comprising:

providing a stream of content to a distribution point;

receiving a sequence of initialization vectors for the stream of content, the initialization vectors representing settings associated with corresponding portions of content, the settings enabling a decryption engine to decrypt the corresponding portions of content using a key;

receiving, from an application server, an indication that a request from a client device to access the stream of content is supported;

receiving, from the client device and across a communications network, the request to access the stream of content;

enabling, based on receiving the indication, the client device to access the stream of content in a connection between the client device and the distribution point;

accessing, from within the request, a time mark with a temporal description of a portion of the stream of content requested by the user;

relating the time mark to the sequence of initialization vectors; and

generating an instruction to transmit at least one of the initialization vectors to the client device in a first metadata message.