# US 2016/0366116 A1 · Drm protected video streaming on game console with secret-less application

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2016/0366116 A1
- Document ID: US20160366116A1
- Status: Published application
- Kind: A1
- Application number: 15/246,965
- Filed: 2016-08-25
- Published: 2016-12-15
- Earliest claimed: 2014-02-19
- Assignees: Adobe Systems Incorporated
- Applicants: Adobe Systems Incorporated
- Inventors: Viswanathan Swaminathan; Sheng Wei; Joseph Donovan Steele
- Web page: https://patentgrep.com/patent/US20160366116A1

## CPC

- H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)}
- G06F 21/10: Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]}
- G06F 21/33: using certificates
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)}
- H04L 63/0492: {by using a location-limited connection, e.g. near-field communication or limited proximity of entities}
- H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04L 63/0815: {providing single-sign-on or federations}
- H04L 65/65: Network streaming protocols, e.g. real-time transport protocol [RTP] or real-time control protocol [RTCP]
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Techniques are disclosed for secure playback of protected multimedia content on a game console using a secret-less application. An SSO model can be used for client authentication at a key server, which eliminates the need of storing or using any secret information in the client application. Further, an encrypted content key generated by a content packager using a public key can be deployed in the key URI of a playlist file, which is sent to the key server. The key server can be configured to decrypt the content key using a corresponding private key. Further, the content key and unencrypted samples are protected in the game console client application from debugging and replay attacks by using additional security checks at both the client and key server. By storing secret information remotely from the game console and using the SSO model, DRM policies can be enforced on an untrusted client application.

## Claims

### Claim 1

A computer-implemented method for secure playback of protected multimedia content using a secret-less application, the method comprising:
receiving an access control credential from a security token service via a communications network;
receiving, from a multimedia content server via the communications network, a playlist file having encoded therein a uniform resource identifier (URI) associated with a key server and a security token signed by the multimedia content server, the security token having encoded therein an encrypted content key associated with protected multimedia content;
sending the access control credential and the encrypted content key to the key server via the communications network using a secure communications protocol;
receiving a decrypted content key from the key server via the communications network using the secure communications protocol, the decrypted content key being configured for accessing the protected multimedia content; and
playing back the protected multimedia content using the decrypted content key.

### Claim 2 (depends on 1)

The method of claim 1, further comprising receiving the protected multimedia content from the multimedia content server via the communications network.

### Claim 3 (depends on 2)

The method of claim 2, wherein the protected multimedia content is encrypted, and wherein the method further comprises decrypting the protected multimedia content using the decrypted content key.

### Claim 4 (depends on 1)

The method of claim 1, wherein the URI is encoded in a format comprising “https://remote-keyserver/key?token=XboxSecurityToken”, where “remote-keyserver” represents a uniform resource locator (URL) of the key server, and “XboxSecurityToken” represents the security token.

### Claim 5 (depends on 1)

The method of claim 1, wherein the secure communications protocol includes Hypertext Transfer Protocol Secure (HTTPS).

### Claim 6 (depends on 1)

The method of claim 1, wherein the access control credential includes a single sign on token.

### Claim 7 (depends on 1)

The method of claim 1, wherein the playing is performed using a HTTP Live Streaming (HLS) player.

### Claim 8 (depends on 1)

The method of claim 1, further comprising:
determining, by the key server, that a client computing device is authenticated based on the access control credential;
in response to the determination, decrypting, by the key server, the encrypted content key using a private cryptographic key; and
sending, by the key server, the decrypted content key to the client computing device via the communications network using the secure communications protocol.

### Claim 9 (depends on 8)

The method of claim 8, wherein the access control credential includes a single sign on token, and wherein the determining is performed according to a single sign on authentication model.

### Claim 10 (depends on 1)

The method of claim 1, wherein the encrypted content key is encoded within a security token signed by a multimedia content server associated with the protected multimedia content.

### Claim 11 (depends on 1)

The method of claim 1, further comprising receiving, by the key server and from the client computing device via the communications network using the secure communications protocol, policy information associated with the protected multimedia content.

### Claim 12 (depends on 11)

The method of claim 11, further comprising obtaining, by the key server, output control information from the policy information.

### Claim 13 (depends on 11)

The method of claim 11, further comprising determining, by the key server, that the encrypted content key is valid based on expiry information encoded in the policy information.

### Claim 14 (depends on 11)

The method of claim 11, wherein the policy information is encoded with the security token.

### Claim 15

A computer-implemented method comprising:
generating a playlist file associated with protected multimedia content, the playlist file having encoded therein a uniform resource identifier (URI) associated with a key server and a signed security token having encoded therein an encrypted content key associated with the protected multimedia content;
encrypting the protected multimedia content using the content key; and
sending the playlist file and the protected multimedia content to a client computing system via a communication network using a secure communications protocol.

### Claim 16 (depends on 15)

The method of claim 15, further comprising encoding the URI in a format comprising “https://remote-keyserver/key?token=Xbox SecurityToken”, where “remote-keyserver” represents a uniform resource locator (URL) of the key server, and “XboxSecurityToken” represents the security token.

### Claim 17 (depends on 15)

The method of claim 15, further comprising encoding policy information associated with the protected multimedia content in the playlist file.

### Claim 18 (depends on 15)

The method of claim 15, wherein the secure communications protocol includes Hypertext Transfer Protocol Secure (HTTPS).

### Claim 19

A system for secure playback of protected multimedia content using a secret-less application, the system comprising:
a storage;
a client computing device comprising one or more computer processors operatively coupled to the storage; and
a key server comprising one or more computer processors operatively coupled to the storage;
wherein the one or more computer processors are configured to execute instructions stored in the storage that when executed cause the one or more computer processors to carry out a process comprising:
receiving, by the client computing device, an access control credential from a security token service via a communications network;
receiving, by the client computing device and from a multimedia content server via the communications network, a playlist file having encoded therein a uniform resource identifier (URI) associated with a key server and a security token signed by the multimedia content server, the security token having encoded therein an encrypted content key associated with protected multimedia content;
sending, by the client computing device, the access control credential and the encrypted content key to the key server via the communications network using a secure communications protocol;
determining, by the key server, that a client computing device is authenticated based on the access control credential;
in response to the determination, decrypting, by the key server, the encrypted content key using a private cryptographic key;
sending, by the key server, the decrypted content key to the client computing device via the communications network using the secure communications protocol, the decrypted content key being configured for accessing the protected multimedia content;
receiving, by the client computing device, the decrypted content key from the key server via the communications network using the secure communications protocol; and
playing back, by the client computing device, the protected multimedia content using the decrypted content key.

### Claim 20 (depends on 19)

The system of claim 19, wherein the system further comprises a content server comprising one or more computer processors operatively coupled to the storage; and wherein the process further comprises:
generating, by the content server, a playlist file associated with protected multimedia content, the playlist file having encoded therein a uniform resource identifier (URI) associated with a key server and a signed security token having encoded therein an encrypted content key associated with the protected multimedia content;
encrypting, by the content server, the protected multimedia content using the content key; and
sending, by the content server, the playlist file and the protected multimedia content to a client computing system via a communication network using a secure communications protocol.