Method and system for secure over-the-top live video delivery

Patent metadata

Field	Value
Publication number	US-11483604-B2
Application number	US-202117388389-A
Country	US
Kind code	B2
Filing date	Jul 29, 2021
Priority date	Jun 23, 2011
Publication date	Oct 25, 2022
Grant date	Oct 25, 2022

Abstract

A method is provided for managing key rotation (use of series of keys) and secure key distribution in over-the-top content delivery. The method provided supports supplying a first content encryption key to a content packaging engine for encryption of a first portion of a video stream. Once the first content encryption key has expired, a second content encryption key is provided to the content packaging engine for encryption of a second portion of a video stream. The method further provides for notification of client devices of imminent key changes, as well as support for secure retrieval of new keys by client devices. A system is also specified for implementing a client and server infrastructure in accordance with the provisions of the method.

First claim

What is claimed is:

1. A method for handling secure distribution of live video content comprising:
sending a first request to a first server for playback of a live media content;
receiving from the first server a first manifest file comprising a location of a plurality of sequential segments that form the live media content;
sending a content encryption key request to a second server;
receiving a first content encryption key from the second server, the first content encryption key associated with a first segment;
retrieving encrypted live media content from the location, wherein the encrypted live media content comprises a plurally of segments and is decrypted using a plurality of content encryption keys wherein at least two segments of the encrypted live media content are decrypted using two different content encryption keys;
decrypting the live media content, wherein decrypting the live media content comprises:
decrypting a first segment of the encrypted live media content using the first content encryption key;
proactively receiving a second content encryption key from the second server, the second content encryption key retrieved proactively to prevent disruption of the decryption of the live media content; and
decrypting a second segment of the encrypted live media content using the second content encryption key.

2. The method of claim 1 wherein each content encryption key is associated with a plurality of segments.

3. The method of claim 1 wherein the second segment comprises one or more frames of the live media content that occur immediately after a last frame of one or more frames of the live media content associated with the first segment.

4. The method of claim 1 wherein each segment of the plurality of segments comprises at least one key frame.

5. The method of claim 1 wherein proactively receiving the second content encryption key from the second server comprises receiving the second content encryption key before the decryption of the first segment is finished.

6. The method of claim 1 wherein decrypting the second segment of the encrypted live media content comprises decrypting the second segment of the encrypted live media content immediately after finishing the decryption of the first segment of the encrypted live media content.

7. The method of claim 1 wherein the manifest file comprises an indication of when to stop decrypting the live media content with the first content encryption key and start decrypting the live media content with the second content encryption key.

8. The method of claim 1 , wherein the first server comprises a content delivery server and the second server comprises a license server.

9. A computerized device operable as a client for handling secure distribution of content, comprising:
memory operative to store computer program instructions;
one or more processors;
input/output interface circuitry; and
interconnect circuitry coupling the memory, processors and input/output interface circuitry together,
wherein the processors are operative to execute the computer program instructions from the memory to cause the computerized device to:
send a first request to a first server for playback of a live media content;

receive from the first server a first manifest file comprising a location of a plurality of sequential segments that form the live media content;
send a content encryption key request to a second server;
receive a first content encryption key from the second server, the first content encryption key associated with a first segment;
retrieve encrypted live media content from the location, wherein the encrypted live media content comprises a plurally of segments and is decrypted using a plurality of content encryption keys wherein at least two segments of the encrypted live media content are decrypted using two different content encryption keys; and
decrypt the live media content, wherein to decrypt the live media content the processors are operative to execute the computer program instructions from the memory to further cause the computerized device to:
decrypt a first segment of the encrypted live media content using the first content encryption key;
proactively receive a second content encryption key from the second server, the second content encryption key retrieved proactively to prevent disruption of the decryption of the live media content; and
decrypt a second segment of the encrypted live media content using the second content encryption key.

10. The computerized device of claim 9 wherein each content encryption key is associated with a plurality of segments.

11. The computerized device of claim 9 wherein the second segment comprises one or more frames of the live media content that occur immediately after a last frame of one or more frames of the live media content associated with the first segment.

12. The computerized device of claim 9 wherein each segment of the plurality of segments comprises at least one key frame.

13. The computerized device of claim 9 wherein the processors operative to execute the computer program instructions from the memory to cause the computerized device to proactively receive the second content encryption key from the second server are further operative to cause the computerized device to receive the second content encryption key before the decryption of the first segment is finished.

14. The computerized device of claim 9 wherein the processors operative to execute the computer program instructions from the memory to cause the computerized device to decrypt the second segment of the encrypted live media content is further operateive to cause the computerized device to decrypt the second segment of the encrypted live media content immediately after finishing the decryption of the first segment of the encrypted live media content.

15. The computerized device of claim 9 wherein the manifest file comprises an indication of when to stop decrypting the live media content with the first content encryption key and start decrypting the live media content with the second content encryption key.

16. The computerized device of claim 9 , wherein the first server comprises a content delivery server and the second server comprises a license server.

Assignees

• Ericsson Ab

Inventors

• Ma Kevin J
• Hickey Robert
• Tweedale Paul

Classifications

• H04L9/0891 Primary

  Revocation or update of secret information, e.g. encryption key update or rekeying · CPC title

• G11B27/10

  Indexing; Addressing; Timing or synchronising; Measuring tape travel · CPC title

• H04L2209/60

  Digital content management, e.g. content distribution · CPC title

• H04N21/42623

  involving specific decryption arrangements · CPC title

• H04N21/2393

  involving handling client requests (scheduling or organising the servicing of application requests H04L67/60) · CPC title