Selective and persistent application level encryption for video provided to a client

• US 8,526,612 B2
• Filed: 01/03/2007
• Issued: 09/03/2013
• Est. Priority Date: 01/06/2006
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: MacLean, Charles Duncan, Inskip, Thomas
• Primary Examiner(s): Patel, Ashok
• Assistant Examiner(s): Lagor, Alexander
• Application Number:
  US11/619,337
• Publication Number:
  US 20070160208A1
• Time in Patent Office: 2,435 Days
• Field of Search: None
• US Class Current: 380/210
• CPC Class Codes: H04L 2209/30 Compression, e.g. Merkle-Damgard construction
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 9/065 Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
• CPC Class Codes: H04N 21/23476 by partially encrypting, e.g. encrypting the ending portion of a movie
• CPC Class Codes: H04N 21/235 Processing of additional data, e.g. scrambling of additional data or processing content descriptors
• CPC Class Codes: H04N 21/26266 for determining content or additional data repetition rate, e.g. of a file in a DVB carousel according to its importance arrangements for broadcast or for distribution of identical information repeatedly in broadcast distribution systems H04H20/16
• CPC Class Codes: H04N 21/26606 for generating or managing entitlement messages, e.g. Entitlement Control Message [ECM] or Entitlement Management Message [EMM] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/435 Processing of additional data, e.g. decrypting of additional data, reconstructing software from modules extracted from the transport stream
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

A system, apparatus, and method are directed towards allowing ingestion of encrypted content into such as a VOD server, or PVR, or the like by selectively encrypting portions of a content stream based on various selection rules. In one embodiment, the selection rules include leaving selected portions of the content stream unencrypted, including packets that include a PES header; or video packets that include various trick play data such as picture start, GOP start, sequence start, sequence end data; PIDs associated with a PAT, PMT, or the like; while other portions of the content stream may be encrypted, including video and/or audio PIDs, or other video and/or audio portions. In still another embodiment, Entitlement Control Messages (ECMs) may be inserted that employ an encryption/decryption key rotation scheme, such as odd and/or even scrambling control bit structures, which may also be rotated based on a variety of conditions.

Claims

1. A server device for managing content encryption, comprising:

a transceiver for receiving and sending information between another computing device;

a processor in communication with the transceiver; and

a memory in communication with the processor and for use in storing data and machine instructions that causes the processor to perform a plurality of operations, including;

receiving an unencrypted content stream;

buffering a plurality of packets of the unencrypted content stream;

determining for selective encryption at least a portion of the unencrypted content stream based on the plurality of buffered packets;

encrypting the plurality of buffered packets;

encrypting at least the portion of the unencrypted content stream, while leaving at least another portion of the unencrypted content stream unencrypted based on a selection rule that leaves at least trick play data comprising a Program Association Table in the content stream unencrypted;

if a Program Map Table header is determined to be present in a portion of the unencrypted content stream, modifying at least that portion of the unencrypted content stream by at least inserting further information into the Program Map Table; and

inserting an Entitlement Control Message (ECM) within the encrypted content stream, and wherein the ECM includes at least two encryption keys, wherein at least one encryption key is associated with a first cryptoperiod and at least a second encryption key is associated with a second cryptoperiod.

2. The server device of claim 1, wherein the selection rule further comprises indicating that if a portion of the unencrypted content stream includes at least one of picture start data, group of pictures start data, a sequence start, or sequence end data, then leaving that portion of the unencrypted content stream as unencrypted within the encrypted content stream.

3. The server device of claim 1, wherein the selection rule further comprises at least one rule indicating that at least a portion of a video payload or an audio payload is encrypted within the encrypted content stream.

4. The server device of claim 1, wherein the plurality of operations, further including:

employing the unencrypted trick play data within the encrypted content stream to generate at least one trick play index file indicating a location of a content frame for the trick play data in the encrypted content stream.

5. The server device of claim 1, wherein encrypting at least a portion of the unencrypted content stream further comprises employing a key rotation mechanism, wherein at least a first portion of the encrypted content stream is encrypted using a first encryption key, while, at least a second portion of the encrypted content stream is encrypted using a second encryption key.

6. The server device of claim 1, wherein the selection rule further comprises an indication that a content stream packet that includes at least a portion of an PES header remains unencrypted.

7. The server device of claim 1, wherein the further information inserted into the Program Map Table further comprises conditional access information that includes at least one of a system identifier associated with a Certification Authority, a system identifier associated with a content provider, a system identifier associated with a VOD selective encryption server, a PID associated with a ECM stream, or a stream descriptor.

8. A system for managing content encryption over a network, comprising:

a content server that is configured to provide unencrypted content over the network;

an encryption server that is configured to receive unencrypted content from the content server, and to perform actions, including;

buffering a plurality of packets of the unencrypted content stream;

determining for selective encryption at least a portion of the unencrypted content stream based on the plurality of buffered packets;

encrypting the plurality of buffered packets;

encrypting at least the portion of the unencrypted content, wherein at least another portion of the unencrypted content having trick play data comprising a Program Association Table remains unencrypted;

if a Program Map Table header is determined to be present in a portion of the unencrypted content stream, modifying at least that portion of the unencrypted content stream by at least inserting further information into the Program Map Table; and

inserting an Entitlement Control Message (ECM) within the encrypted content stream, wherein the ECM includes at least two encryption keys associated with the encrypted portion of the content, and wherein at least one encryption key is associated with a first cryptoperiod and at least a second encryption key is associated with a second cryptoperiod.

9. The system of claim 8, wherein at least a portion of trick play data remains unencrypted further comprises leaving at least one of picture start data, or sequence data unencrypted.

10. The system of claim 8, wherein encrypting further comprises leaving unencrypted a Packetized Elementary Stream (PES) header.

11. The system of claim 8, wherein encrypting further comprises randomly encrypting at least some video or audio payloads, while leaving other video or audio payloads unencrypted in the encrypted content.

12. The system of claim 8, the actions of the encryption server further comprising:

generating a trick index file based on the unencrypted trick play data within the encrypted content; and

employing the trick index file to enable a client device to perform at least one of a fast forward, or a fast reverse of the content.

13. The system of claim 8, wherein the further information inserted into the Program Map Table further comprises conditional access information that includes at least one of a system identifier associated with a Certification Authority, a system identifier associated with a content provider, a system identifier associated with a VOD selective encryption server, a PID associated with a ECM stream, or a stream descriptor.

14. A method of protecting a media content stream over a network, comprising:

receiving unencrypted media content stream;

buffering a plurality of packets of the unencrypted content stream;

determining for selective encryption at least a portion of the unencrypted content stream based on the plurality of buffered packets;

encrypting the plurality of buffered packets;

encrypting at least the portion of the unencrypted media content stream, while leaving unencrypted each portion of the media content stream having media trick play data comprising a Program Map Table in the media content stream;

if a Program Map Table header is determined to be present in a portion of the unencrypted content stream, modifying at least that portion of the unencrypted content stream by at least inserting further information into the Program Map Table;

inserting an Entitlement Control Message (ECM) within the encrypted content stream, and wherein the ECM includes at least two encryption keys, wherein at least one encryption key is associated with a first cryptoperiod and at least a second encryption key is associated with a second cryptoperiod; and

sending the encrypted media content stream over the network to at least one client device.

15. The method of claim 14, wherein encrypting further comprising employing at least two encryption keys, and randomly switching between the at least two encryption keys for encrypting at least the portion of the unencrypted media content stream.

16. The method of claim 14, wherein encrypting further comprising modifying a transport packet header to indicate whether a type of encryption control bit.

17. A non-transient computer readable storage medium configured to include program instructions for performing the method of claim 14.

18. The method of claim 14, wherein the further information inserted into the Program Map Table further comprises conditional access information that includes at least one of a system identifier associated with a Certification Authority, a system identifier associated with a content provider, a system identifier associated with a VOD selective encryption server, a PID associated with a ECM stream, or a stream descriptor.

19. A non-transitory computer-readable storage medium having computer-executable instructions stored thereon for managing content securely, the computer-executable instructions when installed onto a computing device enable the computing device to perform actions, comprising:

receiving unencrypted content stream;

buffering a plurality of packets of the unencrypted content stream;

determining for selective encryption at least a portion of the unencrypted content stream based on the plurality of buffered packets;

encrypting the plurality of buffered packets;

encrypting at least the portion of the unencrypted content stream, while leaving unencrypted each portion of the content stream having media trick play data comprising a Program Map Table in the media content stream;

if a Program Map Table header is determined to be present in a portion of the unencrypted content stream, modifying at least that portion of the unencrypted content stream by at least inserting further information into the Program Map Table;

inserting an Entitlement Control Message (ECM) within the encrypted content stream, and wherein the ECM includes at least two encryption keys, wherein at least one encryption key is associated with a first cryptoperiod and at least a second encryption key is associated with a second cryptoperiod; and

storing the encrypted content stream.

20. The non-transitory computer-readable storage medium of claim 19, wherein the non-transitory computer-readable storage medium resides within a client computing device.

21. The non-transitory computer-readable storage medium of claim 19, wherein leaving the media trick play data unencrypted further comprises leaving at least one of picture start data, group of pictures start data, a sequence start, or sequence end data unencrypted within the encrypted content stream.

22. The non-transitory computer-readable storage medium of claim 19, wherein the further information inserted into the Program Map Table further comprises conditional access information that includes at least one of a system identifier associated with a Certification Authority, a system identifier associated with a content provider, a system identifier associated with a VOD selective encryption server, a PID associated with a ECM stream, or a stream descriptor.