Method and system for secure over-the-top live video delivery

• US 9,313,178 B2
• Filed: 04/30/2014
• Issued: 04/12/2016
• Est. Priority Date: 06/23/2011
• Status: Active Grant

• Current Assignee: Ericsson AB (Telefonaktiebolaget LM Ericsson)
• Original Assignee: Ericsson AB (Telefonaktiebolaget LM Ericsson)
• Inventors: Ma, Kevin J., Hickey, Robert, Tweedale, Paul
• Primary Examiner(s): HOFFMAN, BRANDON S
• Application Number:
  US14/266,368
• Publication Number:
  US 20140237243A1
• Time in Patent Office: 713 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G11B 27/10 Indexing; Addressing; Timing or synchronising; Measuring tape travel
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/2387 Stream processing in response to a playback request from an end-user, e.g. for trick-play
• CPC Class Codes: H04N 21/2393 involving handling client requests scheduling or organising the servicing of application requests H04L67/60
• CPC Class Codes: H04N 21/2541 Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/42623 involving specific decryption arrangements
• CPC Class Codes: H04N 21/4627 Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/63345 by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 21/8456 by decomposing the content in the time domain, e.g. in time segments

Abstract

A method is provided for managing key rotation (use of series of keys) and secure key distribution in over-the-top content delivery. The method provided supports supplying a first content encryption key to a content packaging engine for encryption of a first portion of a video stream. Once the first content encryption key has expired, a second content encryption key is provided to the content packaging engine for encryption of a second portion of a video stream. The method further provides for notification of client devices of imminent key changes, as well as support for secure retrieval of new keys by client devices. A system is also specified for implementing a client and server infrastructure in accordance with the provisions of the method.

Claims

1. A method for handling secure distribution of content comprising:

initiating a media playback request and receiving a playback request response;

parsing content information from the playback request response, the content information including content encryption keys, content encryption key identifiers, and content encryption key expiration times;

retrieving content and manifest files from a content delivery server;

detecting content encryption key rotation boundaries between periods of use of different content encryption keys in decrypting retrieved content;

issuing requests to a license server ahead of a key rotation boundary to retrieve a second content encryption key to be used after a content encryption key rotation boundary is reached; and

applying the second key for content decryption after the key rotation boundary is reached.

2. The method of claim 1, wherein the content encryption keys and content encryption key identifiers returned in the playback request response include the content encryption key and associated identifier currently being applied as well as a future content encryption key and associated identifier yet to be applied.

3. The method of claim 1, wherein the content encryption key expiration returned in the playback request response is expressed as an expected minimum interval between periodic key rotation.

4. The method of claim 3, further comprising:

timing the prefetching of a next un-retrieved content encryption key based on an expected expiration of the content encryption key currently being used.

5. The method of claim 4, further comprising:

prefetching a next un-retrieved key a fixed duration before the expected expiration of the content encryption key currently being used.

6. The method of claim 4, further comprising:

prefetching a next un-retrieved key within a period of time after the expected expiration of the content encryption key currently being applied, the period of time beginning at the expected expiration of the content encryption key currently being used, and ending at a duration calculated as a fixed percentage of a fixed periodic content encryption key expiration interval.

7. The method of claim 1, wherein subsequent content encryption key identifiers are predictable based on a predetermined known progression.

8. The method of claim 7, further comprising:

the identifier being calculated as monotonically increasing sequential integer values based on the number of segments or video frames generated during a fixed periodic content encryption key expiration interval.

9. The method of claim 7, further comprising:

the identifier being calculated as an expected wall clock time for applying the next content encryption key based on a fixed periodic content encryption key expiration interval.

10. The method of claim 1, wherein license server communications are secured and authenticated using a selected one of Secure Sockets Layer and a token-based technique using a token encrypted with a symmetric key.

11. The method of claim 10, wherein the token-based technique employs white box encryption to encrypt the token.

12. The method of claim 1, wherein actual content encryption key rotation boundaries are detected based on real-time in-band notifications.

13. The method of claim 12, wherein content encryption key rotation boundaries are detected based on notifications in an unencrypted header portion of the encrypted content files.

14. The method of claim 12, wherein content encryption key rotation boundaries are detected based on notifications present in the content manifest file, the content manifest file being selected from an m3u8 file, an IIS Smooth Streaming manifest file, a DASH MPD file and a proprietary manifest file.

15. The method of claim 12, wherein content encryption key rotation boundaries are detected based on a notification embedded in the file name of the encrypted content file.

16. A computerized device operable as a client for handling secure distribution of content, comprising:

memory operative to store computer program instructions;

one or more processors;

input/output interface circuitry; and

interconnect circuitry coupling the memory, processors and input/output interface circuitry together,

wherein the processors are operative to execute the computer program instructions from the memory to cause the computerized device to;

initiate a media playback request and receive a playback request response;

parse content information from the playback request response, the content information including content encryption keys, content encryption key identifiers, and content encryption key expiration times;

retrieve content and manifest files from a content delivery server;

detect content encryption key rotation boundaries between periods of use of different content encryption keys in decrypting retrieved content;

issue requests to a license server ahead of a key rotation boundary to retrieve a second content encryption key to be used after a content encryption key rotation boundary is reached; and

apply the second key for content decryption after the key rotation boundary is reached.

17. The computerized device of claim 16, wherein the content encryption keys and content encryption key identifiers returned in the playback request response include the content encryption key and associated identifier currently being applied as well as a future content encryption key and associated identifier yet to be applied.

18. The computerized device of claim 17, wherein the computer program instructions further cause the computerized device to time the prefetching of a next un-retrieved content encryption key based on an expected expiration of the content encryption key currently being used.

19. The computerized device of claim 16, wherein subsequent content encryption key identifiers are predictable based on a predetermined known progression.

20. The computerized device of claim 16, wherein actual content encryption key rotation boundaries are detected based on real-time in-band notifications.