Authenticated Encryption Support in ISO/IEC 23009-4

A computer program product comprising computer executable instructions stored as tangible non-transitory matter on a non-transitory medium that when executed by a processor cause the processor to:

• receive an unencrypted segment;
• select an encryption key, an initialization vector, and an additional authentication data (AAD), wherein the AAD is derived by calculation at the processor;
• encrypt the segment, wherein the segment is encrypted using an Advanced Encryption Standard (AES) cipher in Galois/Counter Mode (GCM) mode with an initialization vector with a length given by an @authTagLength attribute of a SegmentEncryption element and an authentication tag with a length given by an @authTagLength attribute of the SegmentEncryption element;
• append the authentication tag to the encrypted segment;
• configure the encrypted segment with the appended authentication tag for transfer in a Dynamic Adaptive Streaming over Hypertext Transfer Protocol (HTTP) (DASH) media;
• assign a segment number to the encrypted segment;
• store the encrypted segment with the appended authentication tag;
• update a Media Presentation Description (MPD) associated with the encrypted segment with the appended authentication tag, wherein the MPD comprises an @aadBase attribute with an AAD base value, wherein the AAD value is the sum of the segment number and the @aadBase attribute value;
• and
• transmit the encrypted segment with the appended authentication tag to a destination.

A method of supporting authenticated encryption at a client node in a network, the method comprising:

• receiving a Dynamic Adaptive Streaming over Hypertext Transfer Protocol (HTTP) (DASH) media comprising an encrypted data segment, wherein the media comprises a @SegmentEncryption@ivEncryptionFlag attribute, a SegmentEncryption@ivLength attribute, a segment number, and information sufficient to permit the client node to:
• query a server for a decryption key;
• obtain a decryption key from the server;
• derive an initialization vector and an additional authentication data (AAD);
• authenticate an origin of the encrypted data segment;
• and
• decrypt the encrypted data segment,
• wherein the initialization vector is the segment number when the SegmentEncryption@ivEncryptionFlag value is ‘false’ and the media comprises a CryptoPeriod element,
• wherein the initialization vector is a sum of the segment number and an @ivBase attribute when the SegmentEncryption@ivEncryptionFlag value is ‘false’ and the media comprises a CryptoTimeline element,
• wherein the initialization vector is an Electronic Codebook (ECB)-encrypted value of a transmitted initialization vector when the SegmentEncryption@ivEncryptionFlag value is ‘true’ and the media does not comprise a CryptoTimeline element or a CryptoPeriod element,
• wherein the initialization vector is an ECB-encrypted value of the segment number when the SegmentEncryption@ivEncryptionFlag value is ‘true’ and the media comprises a CryptoPeriod element,
• wherein the initialization vector is an ECB-encrypted value of the sum of the segment number and the @ivBase when the SegmentEncryption@ivEncryptionFlag value is ‘true’ and the media comprises a CryptoTimeline element, and
• wherein the initialization vector is a first SegmentEncryption@ivLength most significant bit from ECB output when the SegmentEncryption@ivEncryptionFlag value is ‘true’ and the SegmentEncryption@ivLength is smaller than an output block size of the ECB output.