Method and system for secure over-the-top live video delivery

Patent metadata

Field	Value
Publication number	US-9912975-B2
Application number	US-201615067219-A
Country	US
Kind code	B2
Filing date	Mar 11, 2016
Priority date	Jun 23, 2011
Publication date	Mar 6, 2018
Grant date	Mar 6, 2018

Abstract

A method is provided for managing key rotation (use of series of keys) and secure key distribution in over-the-top content delivery. The method provided supports supplying a first content encryption key to a content packaging engine for encryption of a first portion of a video stream. Once the first content encryption key has expired, a second content encryption key is provided to the content packaging engine for encryption of a second portion of a video stream. The method further provides for notification of client devices of imminent key changes, as well as support for secure retrieval of new keys by client devices. A system is also specified for implementing a client and server infrastructure in accordance with the provisions of the method.

First claim

What is claimed is:

1. A method in a client for detecting a rotation of content encryption keys for content, the method comprising:
issuing a playback request for content;
receiving content location;
retrieving a next available segment of the content from a content delivery network;
determining if a content encryption key change is signaled, wherein the content encryption key change indicates (1) an earlier expiration is to be used rather than a normal period-based expiration of a current content encryption key and (2) a content encryption key identifier of a new content encryption key; and,
in response to determining a content encryption key change is signaled, rotating the current content encryption key to the new content encryption key, and decrypting the next available segment with the new content encryption key.

2. The method according to claim 1 , further comprising:
in response to determining the content encryption key change is not signaled, decrypting the next available segment with the current content encryption key.

3. The method according to claim 1 , further comprising:
in response to determining that expiration of the current content encryption key is imminent, requesting the new content encryption key.

4. The method according to claim 1 , wherein the receiving step further comprises receiving content encryption keys, and content encryption key expiration times.

5. The method according to claim 1 , wherein the content encryption key change is signaled in a header of the content which contains a flag that indicates (1) the earlier expiration is to be used rather than the normal period-based expiration of the current content encryption key and (2) the content encryption key identifier of the new content encryption key.

6. The method according to claim 1 , wherein the content encryption key change is signaled in manifest file that describes the content with a flag that indicates (1) the earlier expiration is to be used rather than the normal period-based expiration of the current content encryption key and (2) the content encryption key identifier of the new content encryption key.

7. The method according to claim 1 , wherein the content encryption key change is signaled in a file name of the content which has a flag appended thereto that indicates (1) the earlier expiration is to be used rather than the normal period-based expiration of the current content encryption key and (2) the content encryption key identifier of the new content encryption key.

8. A client for detecting rotation of content encryption keys for content, the client comprising:
at least one microprocessor; and
a non-transitory computer-readable storage medium, coupled to the at least one microprocessor, further comprising computer-readable instructions, when executed by the at least one microprocessor, are configured to:
issue a playback request for content,
receive content location,
retrieve a next available segment of the content from a content delivery network,
determine if a content encryption key change is signaled, wherein the content encryption key change indicates (1) an earlier expiration is to be used rather than a normal period-based expiration of a current content encryption key and (2) a content encryption key identifier of a new content encryption key, and,
responsive to determining a content encryption key change is signaled, rotate the current content encryption key to the new content encryption key, and decrypt the next available segment with the new content encryption key.

9. The client according to claim 8 , wherein the computer-readable instructions are further configured to:
in responsive to determining the content encryption key change is not signaled, decrypt the next available segment with the current content encryption key.

10. The client according to claim 8 , wherein the computer-readable instructions are further configured to:
responsive to determining that expiration of the current content encryption key is imminent, request the new content encryption key.

11. The client according to claim 8 , wherein the receive operation further comprises receipt of content encryption keys, and content encryption key expiration times.

12. The client according to claim 8 , wherein the content encryption key change is signaled in a header of the next available segment which contains a flag that indicates (1) the earlier expiration is to be used rather than the normal period-based expiration of the current content encryption key and (2) the content encryption key identifier of the new content encryption key.

13. The client according to claim 8 , wherein the content encryption key change is signaled in manifest file that describes the content with a flag that indicates (1) the earlier expiration is to be used rather than the normal period-based expiration of the current content encryption key and (2) the content encryption key identifier of the new content encryption key.

14. The client according to claim 8 , wherein the content encryption key change is signaled in a file name of the content which has a flag appended thereto that indicates (1) the earlier expiration is to be used rather than the normal period-based expiration of the current content encryption key and (2) the content encryption key identifier of the new content encryption key.

15. A method in a client for detecting a rotation of content encryption keys and retrieving updated content encryption keys, the method comprising:
issuing a playback request for content;
receiving content location;
retrieving a next available segment of the content from a content delivery network;
checking whether a content encryption key change is signaled, wherein the content encryption key change indicates (1) an earlier expiration is to be used rather than a normal period-based expiration of a current content encryption key and (2) a content encryption key identifier of a new content encryption key;
checking an expiration of the current content encryption key to determine if the new content encryption key is to be applied;
in response to determining that the new content encryption key is to be applied, rotating the current content encryption key to the new content encryption key, and decrypting the next available segment with the new content encryption key;
in response to determining that the new content encryption key is not to be applied, decrypting the next available segment with the current content encryption key;
upon decrypting the next available segment with either the new content encryption key or the current content encryption key, determining that the current content encryption key or the new content encryption key which was used to decrypt the next available segment is expiring within a predetermined time;
in response to determining that the current content encryption key or the new content encryption key is expiring within a predetermined time, requesting another new content encryption key; and
in response to determining that the current content encryption key or the new content encryption key is not expiring within a predetermined time, retrieving a subsequent available segment of the content.

16. A client for detecting rotation of content encryption keys and retrieving updated content encryption keys, the client comprising:
at least one microprocessor; and
a non-transitory computer-readable storage medium, coupled to the at least one microprocessor, further comprising computer-readable instructions, when executed by the at least one microprocessor, are configured to:
issue a playback request for content;
receive con

Assignees

• Ericsson Ab

Inventors

• Ma Kevin J
• Hickey Robert
• Tweedale Paul

Classifications

• H04L9/0819

  Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062) · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title

• H04L2209/24

  Key scheduling, i.e. generating round keys or sub-keys for block encryption · CPC title

• H04N21/8456

  by decomposing the content in the time domain, e.g. in time segments · CPC title

• H04N21/2541 Primary

  Rights Management (protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08) · CPC title