Segmented encryption for content delivery

Patent metadata

Field	Value
Publication number	US-11310212-B2
Application number	US-201615221056-A
Country	US
Kind code	B2
Filing date	Jul 27, 2016
Priority date	Jul 27, 2016
Publication date	Apr 19, 2022
Grant date	Apr 19, 2022

Abstract

Techniques for encrypting content in a content distribution network are disclosed. The content distribution network may comprise a number of national and local sites, and a number of hubs at each local sites. A content segment encrypting device may be operative at a local site to encrypt and cache segments of content. The segment encrypting device may provide the segments to streaming devices that encode content for delivery downstream to network or user devices.

First claim

What is claimed is:

1. A method comprising:
receiving, from a streaming server associated with a content distribution network, a request for a content segment associated with a time period in a content stream;
determining an encryption format that is compatible with an endpoint device that is an intended recipient for the content segment, wherein the determining the encryption format that is compatible with the endpoint device comprises determining that the endpoint device possesses an encryption key that allows it to decrypt content when encrypted in the encryption format;
generating, for the content segment:
one or more encrypted portions of content that are encrypted in the encryption format, and
an unencrypted portion of content indicating timing information for the one or more encrypted portions of content;

storing, in a cache associated with the content distribution network, the unencrypted portion of content and the one or more encrypted portions of content; and
sending, to the streaming server, the unencrypted portion of content and the one or more encrypted portions of content to cause decryption and playback, by the endpoint device, of the requested content segment.

2. The method of claim 1 , further comprising:
sending, to the endpoint device, an encryption key usable to decrypt the one or more encrypted portions of content, wherein access to the encryption key is controlled by digital rights management.

3. The method of claim 2 , wherein the sending comprises sending, to the endpoint device via an in-band or out-of-band channel, the encryption key.

4. The method of claim 1 , further comprising:
receiving information indicative of an invalidated encryption key;
removing the one or more encrypted portions of content from the cache based on the receiving information indicative of the invalidated encryption key, wherein the at least one encrypted portion of content was encrypted using the invalidated encryption key.

5. The method of claim 1 , wherein the one or more encrypted portions of content comprise copies of a same portion of the content segment that are encrypted in the encryption format and at least one additional encryption format.

6. The method of claim 1 , wherein the timing information comprises at least one of a presentation timestamp, a decoding timestamp, or a packetized elementary stream (PES) header.

7. A device comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the device to:
receive, from a streaming server associated with a content distribution network, a request for a content segment associated with a time period in a content stream;
determine an encryption format that is compatible with an endpoint device that is an intended recipient for the content segment, wherein the determining the encryption format that is compatible with the endpoint device comprises determining that the endpoint device possesses an encryption key that allows it to decrypt content when encrypted in the encryption format;
generate, for the content segment:
one or more encrypted portions of content that are encrypted in the encryption format, and
an unencrypted portion of content indicating timing information for the one or more encrypted portions of content;

store, in a cache associated with the content distribution network, the unencrypted portion of content and the one or more encrypted portions of content; and
send, to the streaming server, the unencrypted portion of content and the one or more encrypted portions of content to cause decryption and playback, by the endpoint device, of the requested content segment.

8. The device of claim 7 , wherein the instructions, when executed by the one or more processors, further cause the device to:
send, to the endpoint device, an encryption key usable to decrypt the one or more encrypted portions of content, wherein access to the encryption key is controlled by digital rights management.

9. The device of claim 8 , wherein the sending comprises sending, to the endpoint device via an in-band or out-of-band channel, the encryption key.

10. The device of claim 7 , wherein the instructions, when executed by the one or more processors, further cause the device to:
receive information indicative of an invalidated encryption key;
remove the one or more encrypted portions of content from the cache based on the receiving information indicative of the invalidated encryption key, wherein the at least one encrypted portion of content was encrypted using the invalidated encryption key.

11. The device of claim 7 , wherein the one or more encrypted portions of content comprise copies of a same portion of the content segment that are encrypted in the encryption format and at least one additional encryption format.

12. The device of claim 7 , wherein the timing information comprises at least one of a presentation timestamp, a decoding timestamp, or a packetized elementary stream (PES) header.

13. A non-transitory computer-readable storage medium storing computer-readable instructions that, when executed by a processor, cause:
receiving, from a streaming server associated with a content distribution network, a request for a content segment associated with a time period in a content stream;
determining an encryption format that is compatible with an endpoint device that is an intended recipient for the content segment, wherein the determining the encryption format that is compatible with the endpoint device comprises determining that the endpoint device possesses an encryption key that allows it to decrypt content when encrypted in the encryption format;
generating, for the content segment:
one or more encrypted portions of content that are encrypted in the encryption format, and
an unencrypted portion of content indicating timing information for the one or more encrypted portions of content;

storing, in a cache associated with the content distribution network, the unencrypted portion of content and the one or more encrypted portions of content; and
sending, to the streaming server, the unencrypted portion of content and the one or more encrypted portions of content to cause decryption and playback, by the endpoint device, of the requested content segment.

14. The non-transitory computer-readable storage medium of claim 13 , further storing computer-readable instructions that, when executed by the processor cause:
sending, to the endpoint device, an encryption key usable to decrypt the one or more encrypted portions of content, wherein access to the encryption key is controlled by digital rights management.

15. The non-transitory computer-readable storage medium of claim 13 , further storing computer-readable instructions that, when executed by the processor cause:
receiving information indicative of an invalidated encryption key;
removing the one or more encrypted portions of content from the cache based on the receiving information indicative of the invalidated encryption key, wherein the at least one encrypted portion of content was encrypted using the invalidated encryption key.

16. The non-transitory computer-readable storage medium of claim 13 , wherein the one or more encrypted portions of content comprise copies of a same portion of the content segment that are encrypted in the encryption format and at least one additional encryption format.

17. The non-transitory computer-readable storage medium of claim 13 , wherein the timing information comprises at least one of a presentation timestamp, a decoding timestamp, or a packet

Assignees

• Comcast Cable Comm Llc

Inventors

• Gaydos Robert
• Mao Weidong
• Barkley James

Classifications

• H04N21/2347

  involving video stream encryption · CPC title

• H04N21/222

  Secondary servers, e.g. proxy server, cable television Head-end {(provisioning of proxy services in data packet switching networks H04L67/56)} · CPC title

• H04L67/568

  Storing data temporarily at an intermediate stage, e.g. caching · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L65/612

  for unicast · CPC title