# US 12,531,745 B2 · Content transmission protection method and related device thereof

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,531,745 B2
- Document ID: US12531745B2
- Status: Granted
- Kind: B2
- Application number: 18/183,998
- Filed: 2023-03-15
- Published: 2023-07-20
- Granted: 2026-01-20
- Earliest claimed: 2020-09-16
- Assignees: Huawei Technologies Co., Ltd.
- Applicants: Huawei Technologies Co., Ltd.
- Inventors: Zhijian Liang; Conger Chen; Yongwei Guo; Zhigui Wei
- Web page: https://patentgrep.com/patent/US12531745B2

## CPC

- H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC}
- H04N 21/25816: {involving client authentication (restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06)}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 9/0844: {with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys}
- H04L 9/3247: {involving digital signatures}
- H04L 9/3265: {using certificate chains, trees or paths; Hierarchical trust model}
- H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]}
- H04N 21/2347: involving video stream encryption
- H04N 21/6334: for authorisation, e.g. by transmitting a key {(wireless communications network key management H04W12/04; wireless communications network access security H04W12/08)}
- H04N 21/63775: {for uploading keys, e.g. for a client to communicate its public key to the server (key management H04L9/08; network support of key management H04L63/06)}
- H04L 2209/60: Digital content management, e.g. content distribution
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04N: PICTORIAL COMMUNICATION, e.g. TELEVISION

## Abstract

The technology of this application relates to a content transmission protection method and a related device, to avoid leakage of an audio/video stream when a transmit end and a receive end perform authentication. The method includes, in a process of establishing a transmission link between a transmit end and a receive end, the transmit end performs authentication key exchange with the receive end to obtain an authentication key. The transmit end performs session key agreement with the receive end based on the authentication key to obtain a session key. The transmit end performs authorization control on the receive end after establishment of the transmission link between the transmit end and the receive end is completed. The transmit end sends an encrypted audio/video stream to the receive end after the transmit end completes authorization control on the receive end. The encrypted audio/video stream is encrypted based on the session key.

## Claims

### Claim 1

A content transmission protection method, comprising:
in a process of establishing a transmission link between a transmit end and a receive end, obtaining, by the transmit end, an authentication key by performing authentication key exchange with the receive end;
obtaining, by the transmit end, a session key by performing session key agreement with the receive end based on the authentication key;
performing, by the transmit end, authorization control on the receive end after establishing the transmission link between the transmit end and the receive end; and
sending, by the transmit end, an encrypted audio/video stream to the receive end after the transmit end completes authorization control on the receive end, wherein the audio/video stream is encrypted based on the session key, wherein obtaining, by the transmit end, the authentication key comprise:
sending, by the transmit end, a first message to the receive end, wherein the first message is used to request authentication;
receiving, by the transmit end, a second message from the receive end, wherein the second message comprises a signature and a hash-based message authentication code (hmac) for authentication calculated by the receive end, and the signature indicates an identity of the receive end;
calculating by the transmit end, the authentication key,
calculating on hmac for authentication based on the authentication key calculated by the transmit end;
verifying the signature in association with the transmit end determining that the hmac for authentication calculated by the transmit end is the same as the hmac for authentication calculated by the receive end,
in association with the transmit end successfully verifying the signature, calculating an authentication key authentication code based on the authentication key calculated by the transmit end; and
sending, by the transmit end, a third message to the receive end, wherein the third message includes the authentication key authentication code calculated by the transmit end.

### Claim 2 (depends on 1)

The method according to claim 1, wherein the first message comprises a version number list, the second message further comprises a version number of the receive end and an update time of a revocation list of the receive end, the version number of the receive end is included in the version number list, and calculating the hmac for authentication based on the authentication key calculated by the transmit end comprises:
calculating the hmac for authentication based on: the version number of the receive end, the update time of the revocation list of the receive end, and the authentication key calculated by the transmit end; and
calculating the authentication key authentication code based on the authentication key calculated by the transmit end comprises:
calculating the authentication key authentication code based on the version number of the receive end and the authentication key calculated by the transmit end.

### Claim 3 (depends on 2)

The method according to claim 2, wherein after a successful authentication key exchange between the transmit end and the receive end, the method further comprises:
sending, by the transmit end, a revocation list update message to the receive end in association with determining that an update time of a revocation list of the transmit end is different from the update time of the revocation list of the receive end, wherein the revocation list update message includes the revocation list of the transmit end.

### Claim 4 (depends on 1)

The method according to claim 1, wherein
the first message further includes a current session identifier, a transmit end identifier, a public key list, and a fast authentication identifier, and
the fast authentication identifier indicates the receive end to enter a fast authentication process or a common authentication process.

### Claim 5 (depends on 1)

The method according to claim 1, wherein the second message further includes a current session identifier, a public key of the receive end, a device certificate authority (CA) certificate of the receive end, and a device certificate of the receive end.

### Claim 6 (depends on 1)

The method according to claim 1, wherein the session key includes an odd key for content encryption and an even key for content encryption, wherein the odd key for content encryption or the even key for content encryption is used to encrypt the audio/video stream.

### Claim 7 (depends on 1)

The method according to claim 1, wherein performing, by the transmit end, the authorization control on the receive end comprises:
obtaining, by the transmit end, authorization control information corresponding to the audio/video stream; and
performing, by the transmit end based on the authorization control information corresponding to the audio/video stream, authorization control on the receive end in a unit of the audio/video stream, wherein the authorization control information comprises a security level, a copy limit, a retention time, a maximum cascading depth, and a maximum number of connected devices supported by a device of each level.

### Claim 8 (depends on 7)

The method according to claim 7, wherein after the performing, by the transmit end, the authorization control of the audio/video stream on the receive end, the method further comprises:
sending, by the transmit end, a fourth message to the receive end, wherein
the fourth message includes an identifier of an audio/video stream transmission channel corresponding to the audio/video stream and the authorization control information corresponding to the audio/video stream,
the identifier of the audio/video stream transmission channel indicates the audio/video stream transmission channel corresponding to the audio/video stream, and
the fourth message indicates the receive end to perform, based on the audio/video stream transmission channel corresponding to the audio/video stream and the authorization control information corresponding to the audio/video stream, authorization control on a lower-level device of the receive end in the unit of the audio/video stream.

### Claim 9 (depends on 8)

The method according to claim 8, wherein sending, by the transmit end, the encrypted audio/video stream to the receive end comprises:
sending, by the transmit end, encrypted data to the receive end, wherein
the encrypted data includes an encryption information header and at least one encrypted audio/video stream,
the at least one encrypted audio/video stream is set in a unit of the audio/video stream transmission channel, and
the encryption information header includes a version of the encryption information header, an encryption method indication value, an encryption algorithm indication value, an encryption mode, a reserved field, and a counter.

### Claim 10

A content transmission protection method, comprising:
in a process of establishing a transmission link between a transmit end and a receive end, obtaining, by the receive end, an authentication key by performing authentication key exchange with the transmit end;
obtaining, by the receive end, a session key by performing session key agreement with the transmit end based on the authentication key;
responding, by the receive end, to authorization control of the transmit end after establishing the transmission link between the transmit end and the receive end; and
after the transmit end completes authorization control on the receive end, receiving, by the receive end, an encrypted audio/video stream from the transmit end, wherein the audio/video stream is encrypted based on the session key, wherein obtaining the authentication key comprises:
calculating, by the receive end, a signature and the authentication key;
calculating on hash-based message authentication code (hmac) for authentication based on the authentication key calculated by the receive end;
sending, by the receive end, a second message to the transmit end, wherein the second message includes the signature and the hmac for authentication calculated by the receive end, and the signature indicates an identity of the receive end;
receiving, by the receive end, a third message from the transmit end, wherein the third message includes an authentication key authentication code calculated by the transmit end;
calculating, by the receive end, an authentication key authentication code based on the authentication key calculated by the receive end; and
in association with the receive end determining that the authentication key authentication code calculated by the transmit end is the same as the authentication key authentication code calculated by the receive end, caching the authentication key calculated by the receive end.

### Claim 11 (depends on 10)

The method according to claim 10, wherein the first message includes a version number list, and calculating, by the receive end, the signature comprises:
in association with the receive end determining that a version number of the receive end is included in the version number list, calculating the signature based on the version number of the receive end and an update time of a revocation list of the receive end.

### Claim 12 (depends on 11)

The method according to claim 11, wherein calculating the hmac for authentication based on the authentication key calculated by the receive end comprises:
calculating the hmac for authentication based on: the version number of the receive end, the update time of the revocation list of the receive end, and the authentication key calculated by the receive end; and
calculating the authentication key authentication code based on the authentication key calculated by the receive end comprises:
calculating the authentication key authentication code based on the version number of the receive end and the authentication key calculated by the receive end.

### Claim 13 (depends on 11)

The method according to claim 11, wherein after successful authentication key exchange between the transmit end and the receive end, the method further comprises:
receiving, by the receive end, a revocation list update message from the transmit end, wherein the revocation list update message includes a revocation list of the transmit end;
replacing, by the receive end, the revocation list of the receive end with the revocation list of the transmit end; and
verifying, by the receive end, a certificate of a lower-level device of the receive end by using the revocation list of the transmit end.

### Claim 14

A system, comprising:
a processor; and
a memory configured to store computer readable instructions that, when executed by the processor, cause the system to:
obtain an authentication key by performing authentication key exchange with a receive end;
obtain a session key by performing session key agreement with the receive end;
perform authorization control on the receive end; and
send an encrypted audio/video stream to the receive end after the completing the authorization control on the receive end, wherein the system is further caused to:
send a first message to the receive end, wherein the first message is used to request authentication;
receive a second message from the receive end, wherein the second message comprises a signature and a hash-based message authentication code (hmac) for authentication calculated by the receive end, and the signature indicates identity of the receive end;
calculate the authentication key;
calculate an hmac for authentication based on the calculated authentication key;
verify the signature in association with determining that the hmac for authentication is the same as the hmac for authentication calculated by the receive end;
in association with successfully verifying the signature, calculate an authentication key authentication code based on the calculated authentication key; and
send a third message to the receive end, wherein the third message includes the calculated authentication key authentication code.

### Claim 15 (depends on 14)

The system according to claim 14, wherein the first message comprises a version number list, the second message further comprises a version number of the receive end and an update time of a revocation list of the receive end, the version number of the receive end is included in the version number list, and the system is further caused to:
calculate the hmac for authentication based on: the version number of the receive end, the update time of the revocation list of the receive end, and the calculated authentication key; and
calculate the authentication key authentication code based on the version number of the receive end and the calculated authentication key.

### Claim 16 (depends on 15)

The system according to claim 15, wherein after a successful authentication key exchange, the system is further caused to:
send a revocation list update message to the receive end in association with determining that an update time of a revocation list of the system is different from the update time of the revocation list of the receive end, wherein the revocation list update message includes the revocation list of the system.

### Claim 17 (depends on 14)

The system according to claim 14, wherein
the first message further includes a current session identifier, a transmit end identifier, a public key list, and a fast authentication identifier,
the fast authentication identifier indicates the receive end to enter a fast authentication process or a common authentication process, and
the second message further includes the current session identifier, a public key of the receive end, a device certificate authority (CA) certificate of the receive end, and a device certificate of the receive end.

### Claim 18 (depends on 14)

The system according to claim 14, wherein the session key includes an odd key for content encryption and an even key for content encryption, wherein the odd key for content encryption or the even key for content encryption is used to encrypt the audio/video stream.

### Claim 19 (depends on 14)

The system according to claim 14, wherein the system is further caused to:
obtain authorization control information corresponding to the audio/video stream; and
perform, based on the authorization control information corresponding to the audio/video stream, authorization control on the receive end in a unit of the audio/video stream, wherein the authorization control information comprises a security level, a copy limit, a retention time, a maximum cascading depth, and a maximum number of connected devices supported by a device of each level.

### Claim 20 (depends on 19)

The system according to claim 19, wherein after performing the authorization control of the audio/video stream on the receive end, the system is further caused to:
send a fourth message to the receive end, wherein
the fourth message includes an identifier of an audio/video stream transmission channel corresponding to the audio/video stream and the authorization control information corresponding to the audio/video stream,
the identifier of the audio/video stream transmission channel indicates the audio/video stream transmission channel corresponding to the audio/video stream, and
the fourth message indicates the receive end to perform, based on the audio/video stream transmission channel corresponding to the audio/video stream and the authorization control information corresponding to the audio/video stream, authorization control on a lower-level device of the receive end in the unit of the audio/video stream.