Segmented encryption for content delivery

Patent metadata

Field	Value
Publication number	US-11863540-B2
Application number	US-202217655053-A
Country	US
Kind code	B2
Filing date	Mar 16, 2022
Priority date	Jul 27, 2016
Publication date	Jan 2, 2024
Grant date	Jan 2, 2024

Abstract

Techniques for encrypting content in a content distribution network are disclosed. The content distribution network may comprise a number of national and local sites, and a number of hubs at each local sites. A content segment encrypting device may be operative at a local site to encrypt and cache segments of content. The segment encrypting device may provide the segments to streaming devices that encode content for delivery downstream to network or user devices.

First claim

The invention claimed is:

1. A method comprising:
receiving, by a computing device associated with a content distribution network, a request for a content segment associated with an item of content;
generating, by the computing device, for the content segment:
one or more encrypted portions of the content segment that are encrypted in an encryption format compatible with a user device that is an intended recipient for the content segment, wherein the encryption format is determined to be compatible with the user device based on the user device being associated with a key enabling the user device to decrypt the one or more encrypted portions of the content segment when encrypted in the encryption format, and
an unencrypted portion of content indicating timing information for the one or more encrypted portions of the content segment; and

sending, by the computing device and to the user device, the unencrypted portion of content and the one or more encrypted portions of the content segment.

2. The method of claim 1 , further comprising:
storing, in a cache associated with the content distribution network, the unencrypted portion of content and the one or more encrypted portions of the content segment.

3. The method of claim 1 , further comprising:
sending, by the computing device and to the user device, the key, wherein access to the key is controlled by digital rights management.

4. The method of claim 3 , wherein the sending comprises:
sending, by the computing device and to the user device, via an in-band or out-of-band channel, the key.

5. The method of claim 1 , wherein the one or more encrypted portions of the content segment comprise copies of a same portion of the content segment that are encrypted in the encryption format and at least one additional encryption format.

6. The method of claim 1 , wherein the timing information comprises at least one of: a presentation timestamp, a decoding timestamp, or a packetized elementary stream (PES) header.

7. The method of claim 1 , further comprising:
receiving information indicative of an invalidated key; and
removing the one or more encrypted portions of the content segment from the cache based on the receiving information indicative of the invalidated key, wherein the one or more encrypted portions of the content segment were encrypted using the invalidated key.

8. A non-transitory computer-readable medium storing instructions that, when executed, cause:
receiving, by a computing device associated with a content distribution network, a request for a content segment associated with an item of content;
generating, by the computing device, for the content segment:
one or more encrypted portions of the content segment that are encrypted in an encryption format compatible with a user device that is an intended recipient for the content segment, wherein the encryption format is determined to be compatible with the user device based on the user device being associated with a key enabling the user device to decrypt the one or more encrypted portions of the content segment when encrypted in the encryption format, and
an unencrypted portion of content indicating timing information for the one or more encrypted portions of the content segment; and

sending, by the computing device and to the user device, the unencrypted portion of content and the one or more encrypted portions of the content segment.

9. The non-transitory computer-readable medium of claim 8 , wherein the instructions, when executed, further cause:
storing, in a cache associated with the content distribution network, the unencrypted portion of content and the one or more encrypted portions of the content segment.

10. The non-transitory computer-readable medium of claim 8 , wherein the instructions, when executed, further cause:
sending, by the computing device and to the user device, the key, wherein access to the key is controlled by digital rights management.

11. The non-transitory computer-readable medium of claim 10 , wherein the sending comprises:
sending, by the computing device and to the user device, via an in-band or out-of-band channel, the key.

12. The non-transitory computer-readable medium of claim 8 , wherein the one or more encrypted portions of the content segment comprise copies of a same portion of the content segment that are encrypted in the encryption format and at least one additional encryption format.

13. The non-transitory computer-readable medium of claim 8 , wherein the timing information comprises at least one of: a presentation timestamp, a decoding timestamp, or a packetized elementary stream (PES) header.

14. The non-transitory computer-readable medium of claim 8 , wherein the instructions, when executed, further cause:
receiving information indicative of an invalidated key; and
removing the one or more encrypted portions of the content segment from the cache based on the receiving information indicative of the invalidated key, wherein the one or more encrypted portions of the content segment were encrypted using the invalidated key.

15. A system comprising:
a first computing device, associated with a content distribution network, configured to:
receive a request for a content segment associated with an item of content; generate for the content segment:
one or more encrypted portions of the content segment that are encrypted in an encryption format compatible with a user device that is an intended recipient for the content segment, wherein the encryption format is determined to be compatible with the user device based on the user device being associated with a key enabling the user device to decrypt the one or more encrypted portions of the content segment when encrypted in the encryption format, and
an unencrypted portion of content indicating timing information for the one or more encrypted portions of the content segment; and

send the unencrypted portion of content and the one or more encrypted portions of the content segment; and

a second computing device configured to:
send the request.

16. The system of claim 15 , wherein the first computing device is further configured to:
store, in a cache associated with the content distribution network, the unencrypted portion of content and the one or more encrypted portions of the content segment.

17. The system of claim 15 , wherein the first computing device is further configured to:
sending, by the computing device and to the user device, the key, wherein access to the key is controlled by digital rights management,
wherein the sending comprises sending, by the computing device and to the user device, via an in-band or out-of-band channel, the key.

18. The system of claim 15 , wherein the one or more encrypted portions of the content segment comprise copies of a same portion of the content segment that are encrypted in the encryption format and at least one additional encryption format.

19. The system of claim 15 , wherein the timing information comprises at least one of: a presentation timestamp, a decoding timestamp, or a packetized elementary stream (PES) header.

20. The system of claim 15 , wherein the first computing device is further configured to:
receive information indicative of an invalidated key; and
remove the one or more encrypted portions of the content segment from the cache based on the receiving information indicative of the invalidated key, wherein the one or more encrypted portions of the content segment were encrypted using the invalidated key.

Assignees

• Comcast Cable Comm Llc

Inventors

• Gaydos Robert
• Mao Weidong
• Barkley James

Classifications

• H04L63/0471 Primary

  applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding · CPC title

• H04L63/0281

  Proxies · CPC title

• H04L63/062

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title

• H04L63/068

  using time-dependent keys, e.g. periodically changing keys (cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088) · CPC title

• H04L27/34

  Amplitude- and phase-modulated carrier systems, e.g. quadrature-amplitude modulated carrier systems · CPC title