Non-blocking of head end initiated revocation and delivery of entitlements non-addressable digital media network

• US 8,621,093 B2
• Filed: 05/21/2008
• Issued: 12/31/2013
• Est. Priority Date: 05/21/2007
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Tinker, Jeffrey Lee, MacLean, Charles Duncan, Ali, Hamid Shaheed, Hiar, Edward Charles, Rutman, Michael, Morten, Glenn A.
• Primary Examiner(s): Mejia, Anthony
• Application Number:
  US12/125,032
• Publication Number:
  US 20080294786A1
• Time in Patent Office: 2,050 Days
• Field of Search: 709/229, 709/232, 709/230, 713/158, 725/29, 725/31
• US Class Current: 709/229
• CPC Class Codes: H04L 61/256 NAT traversal
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/126 the source of the received data

Abstract

A system, apparatus, and method are directed towards managing entitlement/right revocation and delivery to be performed within a non-addressable media network. Such networks may include for example a client device behind a network address translation (NAT) device, employs non-addressable satellite components, or so forth. A server notifies clients that entitlements, revocations, or the like are available by sending a request for communications with the client. The client initiates a connection to receive the entitlements, or the like, and then disconnects from the server. If the client fails to initiate a connection, the server may continue to send a request for a connection, or even change encryption keys to the content to prevent access by the client. In one embodiment, failure to receive an acknowledgement response from the server of a connection with the client, or from the client, may result in invocation of a revocation failure action.

Claims

1. A network device for managing access to content over a network, comprising:

a transceiver for receiving and sending information over the network;

a processor in communication with the display and the transceiver; and

a memory in communication with the processor and for use in storing data and machine instructions that causes the processor to perform a plurality of actions, including;

broadcasting a notification to a client device indicating an availability of an entitlement or revocation message;

determining a time period for the client device to respond to the notification, wherein a length of the time period is based on at least one of a network characteristic, an urgency of the notification, or a round trip time (RTT) for communication between the network device and the client device;

tuning the length of the time period for the client device to respond based at least on historical failure data;

in response to the broadcast notification the client device initiates a connection with the network device prior to expiration of the time period, sending the entitlement or revocation message by the network device to the client device over the connection initiated by the client device, and disconnecting from the client device;

in response to the receipt of the entitlement or revocation message is positively acknowledged, removing the client device from a multicast list of client devices;

in response to the client device fails to initiate a connection to receive the message within the time period, performing at least one retry attempt comprising sending another request for a connection; and

in response to after the at least one retry attempt the client device fails to initiate a connection within at least another time period, performing a revocation failure action.

2. The network device of claim 1, wherein the revocation failure action further comprises performing at least one of changing an encryption/decryption key associated with the secure content, or a service key.

3. The network device of claim 1, wherein sending the notification further comprises sending a notification using a broadcasting protocol.

4. The network device of claim 1, wherein the revocation failure action further comprises performing a network failure detection analysis.

5. The network device of claim 1, wherein the entitlement message or the revocation message is sent within an Entitlement Management Message (EMM).

6. The network device of claim 1, wherein the client device resides behind a network address translation device (NAT).

7. The network device of claim 1, wherein historical acknowledgment failure data is used to adjust at least one of the time period or the other time period.

8. The network device of claim 1, wherein the notification to the client device indicating the availability of the entitlement or revocation message is broadcasted to a plurality of client devices.

9. A non-transitory computer-readable storage medium that includes data and instructions, wherein the execution of the instructions on a computing device provides for managing access to content over a network by enabling actions, comprising:

broadcasting a notification to a client device indicating an availability of an entitlement or revocation message;

determining a time period for the client device to respond to the notification, wherein a length of the time period is based on at least one of a network characteristic, an urgency of the notification, or a round trip time (RTT) for communication between the network device and the client device;

tuning the length of the time period for the client device to respond based at least on historical failure data;

in response to the broadcast notification the client device initiates a connection with the network device prior to expiration of the time period, sending the entitlement or revocation message by the network device to the client device over the connection initiated by the client device, and disconnecting from the client device;

in response to the receipt of the entitlement or revocation message is positively acknowledged, removing the client device from a multicast list of client devices;

in response to the client device fails to initiate a connection and receive the entitlement message within the time period, performing at least one retry attempt comprising sending another request for a connection; and

in response to after the at least one retry attempt the client device fails to receive the entitlement message within at least another time period, performing a revocation failure action.

10. The non-transitory computer-readable storage medium of claim 9, wherein failure to receive the entitlement message is determined based on failure to receive an acknowledgment message.

11. The non-transitory computer-readable storage medium of claim 9, wherein receipt of the entitlement message is determined based on receipt of an acknowledgement message.

12. The non-transitory computer-readable storage medium of claim 11, wherein the acknowledgement message further comprises at least one of a nonce, a hash value, or a digital authentication message.

13. The non-transitory computer-readable storage medium of claim 9, wherein the failure action further comprises at least one of performing a network analysis to determine if a network failure is detected.

14. A method for managing access to content over a network, comprising:

broadcasting by a network device a notification over the network indicating an availability of an entitlement message for the client device, wherein the client device is situated on one side of a network address translation (NAT) device, and the network device is on another side of the NAT, and wherein the entitlement message is associated with access to content;

determining a time period for the client device to respond to the notification, wherein a length of the time period is based on at least one of a network characteristic, an urgency of the notification, or a round trip time (RTT) for communication between the network device and the client device;

tuning the length of the time period for the client device to respond based at least on historical failure data;

in response to the broadcast notification the client device initiates a connection with the network device prior to expiration of the time period, sending the entitlement or revocation message by the network device to the client device over the connection initiated by the client device, and disconnecting from the client device;

in response to the receipt of the entitlement or revocation message is positively acknowledged, removing the client device from a multicast list of client devices;

in response to the client device fails to receive the entitlement message within the time period, performing at least one retry attempt comprising sending another request for a connection by the network device; and

in response to after the at least one retry attempt an acknowledgement message is undetected from the client device within at least another time period, performing a revocation failure action.

15. The method of claim 14, wherein sending the notification further comprising using a multicasting protocol to send the notification.

16. The method of claim 14, wherein the revocation failure action further comprises preventing access to at least a portion of content that is encrypted based on an encryption key by employing a different encryption key to encrypt the at least portion of the content.

17. The method of claim 14, wherein upon receiving the entitlement message over the client initiated connection, terminating the client initiated connection.

18. A system for managing access to content over a network, comprising:

a network device sending encrypted content over the network to a client device; and

another network device that performs actions, including;

broadcasting a notification over a network indicating an availability of an entitlement message for the client device;

determining a time period for the client device to respond to the notification, wherein a length of the time period is based on at least one of a network characteristic, an urgency of the notification, or a round trip time (RTT) for communication between the other network device and the client device;

tuning the length of the time period for the client device to respond based at least on historical failure data;

in response to the broadcast notification the client device initiates a connection with the network device prior to expiration of the time period, sending the entitlement or revocation message by the network device to the client device over the connection initiated by the client device, and disconnecting from the client device;

in response to the receipt of the entitlement or revocation message is positively acknowledged, removing the client device from a multicast list of client devices;

in response to the client device fails to receive the entitlement message within the time period, performing at least one retry attempt comprising sending another request for a connection; and

in response to after the at least one retry attempt an acknowledgement message is undetected from the client device within at least another time period, performing a revocation failure action.

19. The system of claim 18, wherein the time period or the other time period are determined, in part, based on analysis of historical acknowledgement failure data for the client device.

20. The system of claim 18, wherein the acknowledgement message further comprises data useable to determine if the acknowledgement message is from the client device.

21. The system of claim 18, wherein the network device and the other network device are the same network device.