# US 10,771,843 B2 · Media distribution with sample variants for normalized encryption > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,843 B2 - Document ID: US10771843B2 - Status: Granted - Kind: B2 - Application number: 15/379,009 - Filed: 2016-12-14 - Published: 2017-07-06 - Granted: 2020-09-08 - Earliest claimed: 2015-12-15 - Assignees: Telefonaktiebolaget LM Ericsson (publ) - Applicants: Telefonaktiebolaget Lm Ericsson (Publ) - Inventors: Raj Nair; Prabhudev Navali; Mikhail Mikhailov; David Alexander; Pablo Argon - Web page: https://patentgrep.com/patent/US10771843B2 ## CPC - H04N 21/4408: involving video stream encryption, e.g. re-encrypting a decrypted video stream for redistribution in a home network - G06F 21/602: {Providing cryptographic facilities or services} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 65/65: Network streaming protocols, e.g. real-time transport protocol [RTP] or real-time control protocol [RTCP] - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/568: Storing data temporarily at an intermediate stage, e.g. caching - H04N 21/23439: {for generating different versions} - H04N 21/2347: involving video stream encryption - H04N 21/23476: {by partially encrypting, e.g. encrypting the ending portion of a movie} - H04N 21/2351: {involving encryption of additional data (arrangements using cryptography for the use of broadcast information or broadcast-related information H04H60/23)} - H04N 21/2362: Generation or processing of Service Information [SI] - H04N 21/2381: Adapting the multiplex stream to a specific network, e.g. an Internet Protocol [IP] network {(transmission of MPEG streams over ATM H04L12/5601)} - H04N 21/4343: {Extraction or processing of packetized elementary streams [PES]} - H04N 21/435: Processing of additional data, e.g. decrypting of additional data, reconstructing software from modules extracted from the transport stream - H04N 21/4353: {involving decryption of additional data (arrangements using cryptography for the use of broadcast information or broadcast-related information H04H60/23)} - H04N 21/4384: {involving operations to reduce the access time, e.g. fast-tuning for reducing channel switching latency} - H04N 21/43853: {involving multiplex stream decryption (arrangements using cryptography for the use of broadcast information or broadcast-related information H04H60/23)} - H04N 21/4405: involving video stream decryption - H04N 21/44055: {by partially decrypting, e.g. decrypting a video stream that has been partially encrypted} - H04N 21/4622: {Retrieving content or additional data from different sources, e.g. from a broadcast channel and the Internet (web site content organization and management for information retrieval from the Internet G06F16/958; transmission by internet of broadcast information H04H60/82; stock exchange data over packet-switching network H04L12/1804; push services including data channel over packet-switching network H04L12/1859)} - H04N 21/4627: Rights management {associated to the content (security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08)} - H04N 21/6334: for authorisation, e.g. by transmitting a key {(wireless communications network key management H04W12/04; wireless communications network access security H04W12/08)} - H04N 21/84: Generation or processing of descriptive data, e.g. content descriptors {(systems specially adapted for using meta-information in broadcast systems H04H60/73)} - H04N 21/8456: {by decomposing the content in the time domain, e.g. in time segments} - H04N 21/854: Content authoring - H04N 21/85406: {involving a specific file format, e.g. MP4 format} - H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] - H04N 21/2541: {Rights Management (protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08)} - H04N: PICTORIAL COMMUNICATION, e.g. TELEVISION - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A media distribution system and method with sample variants for normalized encryption involves encrypting a main track of a media content asset using a first encryption scheme and encrypting a sample variant track of the media content asset using a second encryption scheme, and performing at least one of: storing the encrypted main track and encrypted sample variant track of the media content asset packaged in a storage format, and transmitting the encrypted main track and the encrypted sample variant track in a distribution container format to an edge media router (EMR) device configured to repackage the media content asset into a delivery container format without reencrypting the media content asset. ## Claims ### Claim 1 A method for distributing media content with end-to-end encryption, the method comprising: processing a media content asset for distribution with end-to-end encryption, the processing comprising: (i) encrypting a main track of the media content asset using a first encryption scheme, the main track comprising a plurality of samples and each sample of the main track encrypted using the first encryption scheme, and (ii) encrypting a sample variant track of the media content asset using a second encryption scheme, the sample variant track comprising a plurality of variants respectively corresponding to the plurality of samples of the main track and each of the variants of the sample variant track encrypted using the second encryption scheme, wherein the second encryption scheme is different from the first encryption scheme used for encrypting the main track of the media content asset; and transmitting the encrypted main track containing the plurality of samples and the encrypted sample variant track containing the corresponding plurality of variants in a distribution container format to an edge media router (EMR) device configured to repackage the media content asset into a delivery container format without reencrypting the media content asset, the delivery container format comprising a format compatible for processing by at least one of a premises gateway node, a set-top-box (STB), and a user equipment (UE) device. ### Claim 2 (depends on 1) The method as recited in claim 1, wherein the distribution container format comprises at least one of an ISO Base Media File Format (ISOBMFF) container format, an ISOBMFF carried in a Packetized Elementary Stream (PES) payload of an MPEG-TS elementary stream, an MPEG-TS elementary stream container format, and an MPEG-TS elementary stream with media content asset sample variants track data and track metadata in the PES payload. ### Claim 3 (depends on 2) The method as recited in claim 2, further comprising defining one or more PES streams, each having a separate Packet Identifier (PID), for carrying stream types of at least one of the ISOBMFF track and track metadata data objects in the PES payload and the sample variants track data and track metadata objects in the PES payload. ### Claim 4 (depends on 1) The method as recited in claim 1, wherein the first and second encryption schemes comprise at least one of a Common Encryption (CENC and CENS-TS) protection scheme using Advanced Encryption Standard (AES) 128-bit keys in Counter mode (CTR), a CENC protection scheme using AES 128-bit keys in Cipher-block chaining mode (CBC), a CENC CTR mode using a sub-sample pattern of unencrypted bytes and encrypted bytes of the media content asset's audio/visual (A/V) data (‘cens’ scheme), a CENC CBC mode using a sub-sample pattern of unencrypted bytes and encrypted bytes of the media content asset's A/V data (‘cbcs’ scheme), a CENC-TS mode “cf” using a sub-sample pattern encryption scheme with AES 128-bit keys in CBC mode, a CENC-TS mode “cf” using a sub-sample pattern encryption scheme with AES-128 bit keys In CTR mode, a CENC CTR mode using a sub-sample encryption of the media content asset's audiovisual (A/V) data (tend) scheme, and a CENC-TS mode “ce” using a sub-sample encryption scheme with AES 128 bit keys in CTR mode (‘cenc’) scheme. ### Claim 5 (depends on 1) The method as recited in claim 1, wherein the media content asset comprises at least one of live TV content, IPTV content, time-shifted (TS) TV content, place-shifted (PS) TV content, gaming content, and Video on Demand (VOD) content, ABR content, Virtual Reality (VR) content, and user equipment (UE) device metadata content. ### Claim 6 (depends on 1) The method as recited in claim 1, wherein the first and second encryption schemes are selected from a plurality of encryption schemes responsive to a selection process based on at least one of an on-demand user control and an on-demand network operator control. ### Claim 7 (depends on 1) The method as recited in claim 1, wherein the main track and the sample variant track are encrypted using, respectively, the first and second encryption schemes having a same Key Identifier (KID). ### Claim 8 (depends on 1) The method as recited in claim 1, wherein the main track and the sample variant track are encrypted using, respectively, the first and second encryption schemes having different Key Identifiers (KIDs). ### Claim 9 (depends on 1) The method as recited in claim 1, wherein the encrypted main track and encrypted sample variant track of the media content asset are stored in at least one of a media server and an origin server. ### Claim 10 (depends on 1) The method as recited in claim 1, further comprising storing the encrypted main track and the encrypted sample variant track of the media content asset in a storage format. ### Claim 11 An apparatus, comprising: one or more processors; a plurality of network interfaces configured to receive media content assets from one or more content sources; an encoder for generating a plurality of bitrate representations for each media content asset; and one or more persistent memory modules having program instructions stored thereon which, when executed by the one or more processors, perform the following: processing a media content asset for distribution with end-to-end encryption, the processing comprising: (i) encrypting a main track of the media content asset using a first encryption scheme, the main track comprising a plurality of samples and each sample of the main track encrypted using the first encryption scheme, and (ii) encrypting a sample variant track of the media content asset using a second encryption scheme, the sample variant track comprising a plurality of variants respectively corresponding to the plurality of samples of the main track and each of the variants of the sample variant track encrypted using the second encryption scheme, wherein the second encryption scheme is different from the first encryption scheme used for encrypting the main track of the media content asset; and transmitting the encrypted main track containing the plurality of samples and the encrypted sample variant track containing the corresponding plurality of variants in a distribution container format to an edge media router (EMR) device configured to repackage the media content asset into a delivery container format without reencrypting the media content asset, the delivery container format comprising a format compatible for processing by at least one of a premises gateway node, a set-top-box (STB), and a user equipment (UE) device. ### Claim 12 (depends on 11) The apparatus as recited in claim 11, wherein the distribution container format comprises at least one of an ISO Base Media File Format (ISOBMFF) container format, an ISOBMFF carried in a Packetized Elementary Stream (PES) payload of an MPEG-TS elementary stream, an MPEG-TS elementary stream container format, and an MPEG-TS elementary stream with media content asset sample variants track data and track metadata in the PES payload. ### Claim 13 (depends on 12) The apparatus as recited in claim 12, wherein the one or more persistent memory modules further comprise program instructions for defining one or more PES streams, each having a separate Packet Identifier (PID), for carriage of at least one of the ISOBMFF track and track metadata data objects in the PES payload and the sample variants track data and track metadata objects in the PES payload. ### Claim 14 (depends on 11) The apparatus as recited in claim 11, wherein the first and second encryption schemes comprise at least one of a Common Encryption (CENC and CENS-TS) protection scheme using Advanced Encryption Standard (AES) 128-bit keys in Counter mode (CTR), a CENC protection scheme using AES 128-bit keys in Cipher-block chaining mode (CBC), a CENC CTR mode using a sub-sample pattern of unencrypted bytes and encrypted bytes of the media content asset's audio/visual (A/V) data (‘cens’ scheme), a CENC CBC mode using a sub-sample pattern of unencrypted bytes and encrypted bytes of the media content asset's A/V data (‘cbcs’ scheme), a CENC-TS mode “cf” using a sub-sample pattern encryption scheme with AES 128-bit keys in CBC mode, a CENC-TS mode “cf” using a sub-sample pattern encryption scheme with AES-128 bit keys In CTR mode, a CENC CTR mode using a sub-sample encryption of the media content asset's audiovisual (A/V) data (‘cenc’) scheme, and a CENC-TS mode “ce” using a sub-sample encryption scheme with AES 128 bit keys in CTR mode (‘cenc’) scheme. ### Claim 15 (depends on 11) The apparatus as recited in claim 11, wherein the media content asset comprises at least one of live TV content, IPTV content, time-shifted (TS) TV content, place-shifted (PS) TV content, gaming content, and Video on Demand (VOD) content, ABR content, Virtual Reality (VR) content, and user equipment (UE) device metadata content. ### Claim 16 (depends on 11) The apparatus as recited in claim 11, wherein the first and second encryption schemes are selected from a plurality of encryption schemes responsive to a selection process based on at least one of an on-demand user control and an on-demand network operator control. ### Claim 17 (depends on 11) The apparatus as recited in claim 11, wherein the main track and the sample variant track are encrypted using, respectively, the first and second encryption schemes having a same Key Identifier (KID). ### Claim 18 (depends on 11) The apparatus as recited in claim 11, wherein the main track and the sample variant track are encrypted using, respectively, the first and second encryption schemes having different Key Identifiers (KIDs). ### Claim 19 (depends on 11) The apparatus as recited in claim 11, wherein the program instructions further comprise instructions for storing the encrypted main track and the encrypted sample variant track of the media content asset in a storage format. ### Claim 20 A non-transitory machine-readable storage medium having program instructions thereon that are configured to perform following acts when executed by one or more processors of a media packaging system: processing a media content asset for distribution with end-to-end encryption, the processing comprising: (i) encrypting a main track of the media content asset using a first encryption scheme, the main track comprising a plurality of samples and each sample of the main track encrypted using the first encryption scheme, and (ii) encrypting a sample variant track of the media content asset using a second encryption scheme, the sample variant track comprising a plurality of variants respectively corresponding to the plurality of samples of the main track and each of the variants of the sample variant track encrypted using the second encryption scheme, wherein the second encryption scheme is different from the first encryption scheme used for encrypting the main track of the media content asset; and transmitting the encrypted main track containing the plurality of samples and the encrypted sample variant track containing the corresponding plurality of variants in a distribution container format to an edge media router (EMR) device configured to repackage the media content asset into a delivery container format without reencrypting the media content asset, the delivery container format comprising a format compatible for processing by at least one of a premises gateway node, a set-top-box (STB), and a user equipment (UE) device. ### Claim 21 (depends on 20) The non-transitory machine-readable storage medium as recited in claim 20, wherein the distribution container format comprises at least one of an ISO Base Media File Format (ISOBMFF) container format, an ISOBMFF carried in a Packetized Elementary Stream (PES) payload of an MPEG-TS elementary stream, an MPEG-TS elementary stream container format, and an MPEG-TS elementary stream with media content asset sample variants track data and track metadata in the PES payload. ### Claim 22 (depends on 21) The non-transitory machine-readable storage medium as recited in claim 21, wherein the program instructions further comprise instructions for defining one or more PES streams, each having a separate Packet Identifier (PID), for carriage of at least one of the ISOBMFF track and track metadata data objects in the PES payload and the sample variants track data and track metadata objects in the PES payload. ### Claim 23 (depends on 20) The non-transitory machine-readable storage medium as recited in claim 20, wherein the program instructions further comprise instructions for storing the encrypted main track and the encrypted sample variant track of the media content asset in a storage format. ### Claim 24 (depends on 20) The non-transitory machine-readable storage medium as recited in claim 20, wherein the first and second encryption schemes comprise at least one of a Common Encryption (CENC and CENS-TS) protection scheme using Advanced Encryption Standard (AES) 128-bit keys in Counter mode (CTR), a CENC protection scheme using AES 128-bit keys in Cipher-block chaining mode (CBC), a CENC CTR mode using a sub-sample pattern of unencrypted bytes and encrypted bytes of the media content asset's audio/visual (A/V) data (‘cens’ scheme), a CENC CBC mode using a sub-sample pattern of unencrypted bytes and encrypted bytes of the media content asset's A/V data (‘cbcs’ scheme), a CENC-TS mode “cf” using a sub-sample pattern encryption scheme with AES 128-bit keys in CBC mode, a CENC-TS mode “cf” using a sub-sample pattern encryption scheme with AES-128 bit keys In CTR mode, a CENC CTR mode using a sub-sample encryption of the media content asset's audiovisual (A/V) data (‘cenc’) scheme, and a CENC-TS mode “ce” using a sub-sample encryption scheme with AES 128 bit keys in CTR mode (tend) scheme. ### Claim 25 (depends on 20) The non-transitory machine-readable storage medium as recited in claim 20, wherein the media content asset comprises at least one of live TV content, IPTV content, time-shifted (TS) TV content, place-shifted (PS) TV content, gaming content, and Video on Demand (VOD) content, ABR content, Virtual Reality (VR) content, and user equipment (UE) device metadata content. ### Claim 26 (depends on 20) The non-transitory machine-readable storage medium as recited in claim 20, wherein the first and second encryption schemes are selected from a plurality of encryption schemes responsive to a selection process based on at least one of an on-demand user control and an on-demand network operator control. ### Claim 27 (depends on 20) The non-transitory machine-readable storage medium as recited in claim 20, wherein the main track and the sample variant track are encrypted using, respectively, the first and second encryption schemes having a same Key Identifier (KID). ### Claim 28 (depends on 20) The non-transitory machine-readable storage medium as recited in claim 20, wherein the main track and the sample variant track are encrypted using, respectively, the first and second encryption schemes having different Key Identifiers (KIDs).