# US 11,310,212 B2 · Segmented encryption for content delivery > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,212 B2 - Document ID: US11310212B2 - Status: Granted - Kind: B2 - Application number: 15/221,056 - Filed: 2016-07-27 - Published: 2018-02-01 - Granted: 2022-04-19 - Earliest claimed: 2016-07-27 - Assignees: Comcast Cable Communications, LLC - Applicants: Comcast Cable Communications, LLC - Inventors: Robert Gaydos; Weidong Mao; James Barkley - Web page: https://patentgrep.com/patent/US11310212B2 ## CPC - H04L 63/0471: {applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding} - H04L 63/0281: {Proxies} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 63/068: {using time-dependent keys, e.g. periodically changing keys (cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088)} - H04L 27/34: Amplitude- and phase-modulated carrier systems, e.g. quadrature-amplitude modulated carrier systems - H04L 65/612: for unicast - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/568: Storing data temporarily at an intermediate stage, e.g. caching - H04N 21/222: Secondary servers, e.g. proxy server, cable television Head-end {(provisioning of proxy services in data packet switching networks H04L67/56)} - H04N 21/2347: involving video stream encryption - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04N: PICTORIAL COMMUNICATION, e.g. TELEVISION ## Abstract Techniques for encrypting content in a content distribution network are disclosed. The content distribution network may comprise a number of national and local sites, and a number of hubs at each local sites. A content segment encrypting device may be operative at a local site to encrypt and cache segments of content. The segment encrypting device may provide the segments to streaming devices that encode content for delivery downstream to network or user devices. ## Claims ### Claim 1 A method comprising: receiving, from a streaming server associated with a content distribution network, a request for a content segment associated with a time period in a content stream; determining an encryption format that is compatible with an endpoint device that is an intended recipient for the content segment, wherein the determining the encryption format that is compatible with the endpoint device comprises determining that the endpoint device possesses an encryption key that allows it to decrypt content when encrypted in the encryption format; generating, for the content segment: one or more encrypted portions of content that are encrypted in the encryption format, and an unencrypted portion of content indicating timing information for the one or more encrypted portions of content; storing, in a cache associated with the content distribution network, the unencrypted portion of content and the one or more encrypted portions of content; and sending, to the streaming server, the unencrypted portion of content and the one or more encrypted portions of content to cause decryption and playback, by the endpoint device, of the requested content segment. ### Claim 2 (depends on 1) The method of claim 1, further comprising: sending, to the endpoint device, an encryption key usable to decrypt the one or more encrypted portions of content, wherein access to the encryption key is controlled by digital rights management. ### Claim 3 (depends on 2) The method of claim 2, wherein the sending comprises sending, to the endpoint device via an in-band or out-of-band channel, the encryption key. ### Claim 4 (depends on 1) The method of claim 1, further comprising: receiving information indicative of an invalidated encryption key; removing the one or more encrypted portions of content from the cache based on the receiving information indicative of the invalidated encryption key, wherein the at least one encrypted portion of content was encrypted using the invalidated encryption key. ### Claim 5 (depends on 1) The method of claim 1, wherein the one or more encrypted portions of content comprise copies of a same portion of the content segment that are encrypted in the encryption format and at least one additional encryption format. ### Claim 6 (depends on 1) The method of claim 1, wherein the timing information comprises at least one of a presentation timestamp, a decoding timestamp, or a packetized elementary stream (PES) header. ### Claim 7 A device comprising: one or more processors; and memory storing instructions that, when executed by the one or more processors, cause the device to: receive, from a streaming server associated with a content distribution network, a request for a content segment associated with a time period in a content stream; determine an encryption format that is compatible with an endpoint device that is an intended recipient for the content segment, wherein the determining the encryption format that is compatible with the endpoint device comprises determining that the endpoint device possesses an encryption key that allows it to decrypt content when encrypted in the encryption format; generate, for the content segment: one or more encrypted portions of content that are encrypted in the encryption format, and an unencrypted portion of content indicating timing information for the one or more encrypted portions of content; store, in a cache associated with the content distribution network, the unencrypted portion of content and the one or more encrypted portions of content; and send, to the streaming server, the unencrypted portion of content and the one or more encrypted portions of content to cause decryption and playback, by the endpoint device, of the requested content segment. ### Claim 8 (depends on 7) The device of claim 7, wherein the instructions, when executed by the one or more processors, further cause the device to: send, to the endpoint device, an encryption key usable to decrypt the one or more encrypted portions of content, wherein access to the encryption key is controlled by digital rights management. ### Claim 9 (depends on 8) The device of claim 8, wherein the sending comprises sending, to the endpoint device via an in-band or out-of-band channel, the encryption key. ### Claim 10 (depends on 7) The device of claim 7, wherein the instructions, when executed by the one or more processors, further cause the device to: receive information indicative of an invalidated encryption key; remove the one or more encrypted portions of content from the cache based on the receiving information indicative of the invalidated encryption key, wherein the at least one encrypted portion of content was encrypted using the invalidated encryption key. ### Claim 11 (depends on 7) The device of claim 7, wherein the one or more encrypted portions of content comprise copies of a same portion of the content segment that are encrypted in the encryption format and at least one additional encryption format. ### Claim 12 (depends on 7) The device of claim 7, wherein the timing information comprises at least one of a presentation timestamp, a decoding timestamp, or a packetized elementary stream (PES) header. ### Claim 13 A non-transitory computer-readable storage medium storing computer-readable instructions that, when executed by a processor, cause: receiving, from a streaming server associated with a content distribution network, a request for a content segment associated with a time period in a content stream; determining an encryption format that is compatible with an endpoint device that is an intended recipient for the content segment, wherein the determining the encryption format that is compatible with the endpoint device comprises determining that the endpoint device possesses an encryption key that allows it to decrypt content when encrypted in the encryption format; generating, for the content segment: one or more encrypted portions of content that are encrypted in the encryption format, and an unencrypted portion of content indicating timing information for the one or more encrypted portions of content; storing, in a cache associated with the content distribution network, the unencrypted portion of content and the one or more encrypted portions of content; and sending, to the streaming server, the unencrypted portion of content and the one or more encrypted portions of content to cause decryption and playback, by the endpoint device, of the requested content segment. ### Claim 14 (depends on 13) The non-transitory computer-readable storage medium of claim 13, further storing computer-readable instructions that, when executed by the processor cause: sending, to the endpoint device, an encryption key usable to decrypt the one or more encrypted portions of content, wherein access to the encryption key is controlled by digital rights management. ### Claim 15 (depends on 13) The non-transitory computer-readable storage medium of claim 13, further storing computer-readable instructions that, when executed by the processor cause: receiving information indicative of an invalidated encryption key; removing the one or more encrypted portions of content from the cache based on the receiving information indicative of the invalidated encryption key, wherein the at least one encrypted portion of content was encrypted using the invalidated encryption key. ### Claim 16 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the one or more encrypted portions of content comprise copies of a same portion of the content segment that are encrypted in the encryption format and at least one additional encryption format. ### Claim 17 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the timing information comprises at least one of a presentation timestamp, a decoding timestamp, or a packetized elementary stream (PES) header.