Method and system for secure over-the-top live video delivery

A computerized device operable as a workflow manager for managing secure distribution of content, comprising:

• memory operative to store computer program instructions;
• one or more processors;
• input/output interface circuitry;
• and
• interconnect circuitry coupling the memory, processors and input/output interface circuitry together,
• wherein the processors are operative to execute the computer program instructions from the memory to cause the computerized device to:
• generate a series of content encryption keys and providing them serially to a packaging server for encrypting a content item, each content encryption key provided upon expiration of a period of use of a serially preceding content encryption key, the packaging server generating packaged content for delivery to client devices via a content delivery network, the packaged content including or accompanied by key expiration information usable by the client devices to identify transitions between sections of the packaged content encrypted by different ones of the content encryption keys;
• and
• provide the content encryption keys to a license server for delivery to the client devices for use in decrypting the content item, the license server being operative to establish that a requesting client device is authorized to access the content item, the license server being further operative to securely deliver the content encryption keys to a requesting client device whose authorization to access the content item has been established.

A computerized device operable as a packaging server for packaging content for secure distribution, comprising:

• memory operative to store computer program instructions;
• one or more processors;
• input/output interface circuitry;
• and
• interconnect circuitry coupling the memory, processors and input/output interface circuitry together,
• wherein the processors are operative to execute the computer program instructions from the memory to cause the computerized device to:
• receive a series of content encryption keys and using them to encrypt a content item, each content encryption key provided upon expiration of a period of use of a serially preceding content encryption key, the content encryption keys being provided separately to a license server for delivery to client devices for use in decrypting the content item, the license server being operative to establish that a requesting client device is authorized to access the content item, the license server being further operative to securely deliver the content encryption keys to a requesting client device whose authorization to access the content item has been established;
• and
• generate packaged content and providing it to a content delivery network for delivery to the client devices, the packaged content including the content item as encrypted and being accompanied by key expiration information usable by the client devices to identify transitions between sections of the packaged content encrypted by different ones of the content encryption keys.

A system for ingestion of content and packaging and delivery of the content to client devices via a content delivery network, comprising:

• a set of one or more server computers collectively coupled to a source of the content and to the content delivery network and including a packaging server, a workflow manager and a license server;
• the packaging server being operative to (i) receive a series of content encryption keys from the workflow manager and use them to encrypt a content item, each content encryption key provided upon expiration of a period of use of a serially preceding content encryption key, and (ii) generate packaged content and providing it to the content delivery network for delivery to the client devices, the packaged content including the content item as encrypted and being accompanied by key expiration information usable by the client devices to identify transitions between sections of the packaged content encrypted by different ones of the content encryption keys;
• the workflow manager being operative to (i) generate the series of content encryption keys and provide them serially to the packaging server for encrypting the content item, each content encryption key provided upon expiration of a period of use of a serially preceding content encryption key, and (ii) provide the content encryption keys to the license server for delivery to the client devices for use in decrypting the content item;
• and
• the license server being operative to (i) establish that a requesting client device is authorized to access the content item, and (ii) securely deliver the content encryption keys to a requesting client device whose authorization to access the content item has been established by the license server, the content encryption keys being delivered for use by the requesting client device in decrypting the content item.