# US 8,751,807 B2 · Method and system for secure over-the-top live video delivery > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,751,807 B2 - Document ID: US8751807B2 - Status: Granted - Kind: B2 - Application number: 13/530,997 - Filed: 2012-06-22 - Published: 2012-12-27 - Granted: 2014-06-10 - Earliest claimed: 2011-06-23 - Assignees: Azuki Systems, Inc. - Applicants: Kevin J Ma; Robert Hickey; Paul Tweedale - Inventors: Kevin J Ma; Robert Hickey; Paul Tweedale - Web page: https://patentgrep.com/patent/US8751807B2 ## CPC - H04N 21/2541: {Rights Management (protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08)} - G11B 27/10: Indexing; Addressing; Timing or synchronising; Measuring tape travel - H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/14: using a plurality of keys or algorithms - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04N 21/2347: involving video stream encryption - H04N 21/2387: Stream processing in response to a playback request from an end-user, e.g. for trick-play - H04N 21/2393: {involving handling client requests (scheduling or organising the servicing of application requests H04L67/60)} - H04N 21/42623: {involving specific decryption arrangements} - H04N 21/4627: Rights management {associated to the content (security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08)} - H04N 21/63345: {by transmitting keys (key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06)} - H04N 21/8456: {by decomposing the content in the time domain, e.g. in time segments} - H04L 2209/24: Key scheduling, i.e. generating round keys or sub-keys for block encryption - H04L 2209/60: Digital content management, e.g. content distribution - H04N: PICTORIAL COMMUNICATION, e.g. TELEVISION - G11B: INFORMATION STORAGE BASED ON RELATIVE MOVEMENT BETWEEN RECORD CARRIER AND TRANSDUCER (recording measured values in a way that does not require playback through a transducer G01D9/00; recording or playback apparatus using mechanically marked tape, e.g. punched paper tape, or using unit records, e.g. punched or magnetically marked cards G06K; transferring data from one type of record carrier to another G06K1/18; circuits for coupling output of reproducer to radio receiver H04B1/20; gramophone pick-ups or like acoustic electromechanical transducers or circuits therefor H04R) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method is provided for managing key rotation (use of series of keys) and secure key distribution in over-the-top content delivery. The method provided supports supplying a first content encryption key to a content packaging engine for encryption of a first portion of a video stream. Once the first content encryption key has expired, a second content encryption key is provided to the content packaging engine for encryption of a second portion of a video stream. The method further provides for notification of client devices of imminent key changes, as well as support for secure retrieval of new keys by client devices. A system is also specified for implementing a client and server infrastructure in accordance with the provisions of the method. ## Claims ### Claim 1 A method for managing secure distribution of content, comprising: generating a series of content encryption keys and providing them serially to a packaging server for encrypting a content item, each content encryption key provided upon expiration of a period of use of a serially preceding content encryption key, the packaging server generating packaged content for delivery to client devices via a content delivery network, the packaged content including or accompanied by key expiration information usable by the client devices to identify transitions between sections of the packaged content encrypted by different ones of the content encryption keys; and providing the content encryption keys to a license server for delivery to the client devices for use in decrypting the content item, the license server being operative to establish that a requesting client device is authorized to access the content item, the license server being further operative to securely deliver the content encryption keys to a requesting client device whose authorization to access the content item has been established. ### Claim 2 (depends on 1) The method of claim 1, wherein the content is audio/video content. ### Claim 3 (depends on 1) The method of claim 1, wherein the content is encrypted using an encryption algorithm selected from AES128, HC128, and RC4. ### Claim 4 (depends on 3) The method of claim 3, further comprising: resetting an initialization vector of the encryption algorithm when transitioning to use of each successive content encryption key. ### Claim 5 (depends on 1) The method of claim 1, wherein the content encryption keys are provided to the packaging server through a secure interface secured using Secure Sockets Layer or other security protocol. ### Claim 6 (depends on 1) The method of claim 1, wherein a next content encryption key is pushed to the packaging server when it is determined that a current content encryption key should be expired as a security precaution. ### Claim 7 (depends on 1) The method of claim 1, wherein providing the content encryption keys includes pushing a content encryption key and a suggested expiration time to the packaging server. ### Claim 8 (depends on 7) The method of claim 7, wherein the content encryption key and suggested expiration time are pushed only in response to a request for a new content encryption key from the packaging server. ### Claim 9 (depends on 8) The method of claim 8, wherein the packaging server requests a new key in anticipation of expiration of a current key. ### Claim 10 (depends on 7) The method of claim 7, further including receiving a notification from the packaging server of an exact expiration time at which a new content encryption key took effect. ### Claim 11 (depends on 10) The method of claim 10, wherein the new content encryption key is provided to the license server only upon receiving the notification from the packaging server. ### Claim 12 (depends on 1) The method of claim 1, wherein the client device is notified at session initiation of a target fixed period for content key expiration. ### Claim 13 (depends on 1) The method of claim 1, wherein the client device is notified in real time of content key expiration. ### Claim 14 (depends on 13) The method of claim 13, wherein the packaging server provides the key expiration information by inserting a key change notification into a content encryption metadata header as part of the unencrypted portion of the encrypted file, the content encryption metadata header. ### Claim 15 (depends on 13) The method of claim 13, wherein the packaging server provides the key expiration information by inserting a key change notification into a content manifest file accessible to the client devices, the content manifest file being selected from an m3u8 file, an IIS Smooth Streaming manifest file, a DASH MPD file and a proprietary manifest file. ### Claim 16 (depends on 13) The method of claim 13, wherein the packaging server provides the key expiration information by inserting a key change notification into the file name of the segment files being generated. ### Claim 17 (depends on 1) The method of claim 1, wherein the content encryption key is provided to the license server through a secure interface secured using Secure Sockets Layer or other security protocol. ### Claim 18 (depends on 1) The method of claim 1, wherein the series of content encryption keys are versioned using monotonically increasing integer values while maintaining a direct correlation between an encryption key version and a segment number or segment duration associated with segments of the packaged content. ### Claim 19 (depends on 18) The method of claim 18, wherein the license server is operative to allow client devices to request previously used content encryption keys and key expiration information. ### Claim 20 (depends on 1) The method of claim 1, wherein the license server distributes content encryption keys and content encryption key expiration information to client devices using a secure channel. ### Claim 21 (depends on 20) The method of claim 20, wherein the secure channel is secured using a selected one of Secure Sockets Layer and a token-based technique using a token encrypted with a symmetric key. ### Claim 22 (depends on 21) The method of claim 21, wherein the token-based technique employs white box encryption to encrypt the token. ### Claim 23 (depends on 1) The method of claim 1, wherein the license server sends content encryption keys and expiration information only in response to requests from the client devices. ### Claim 24 (depends on 1) The method of claim 1, wherein the license server is operative when establishing that a requesting client device is authorized to access the content item to verify client device identity and content access rights before returning content encryption key or expiration information. ### Claim 25 A computerized device operable as a workflow manager for managing secure distribution of content, comprising: memory operative to store computer program instructions; one or more processors; input/output interface circuitry; and interconnect circuitry coupling the memory, processors and input/output interface circuitry together, wherein the processors are operative to execute the computer program instructions from the memory to cause the computerized device to: generate a series of content encryption keys and providing them serially to a packaging server for encrypting a content item, each content encryption key provided upon expiration of a period of use of a serially preceding content encryption key, the packaging server generating packaged content for delivery to client devices via a content delivery network, the packaged content including or accompanied by key expiration information usable by the client devices to identify transitions between sections of the packaged content encrypted by different ones of the content encryption keys; and provide the content encryption keys to a license server for delivery to the client devices for use in decrypting the content item, the license server being operative to establish that a requesting client device is authorized to access the content item, the license server being further operative to securely deliver the content encryption keys to a requesting client device whose authorization to access the content item has been established. ### Claim 26 A method for packaging content for secure distribution, comprising: receiving a series of content encryption keys and using them to encrypt a content item, each content encryption key provided upon expiration of a period of use of a serially preceding content encryption key, the content encryption keys being provided separately to a license server for delivery to client devices for use in decrypting the content item, the license server being operative to establish that a requesting client device is authorized to access the content item, the license server being further operative to securely deliver the content encryption keys to a requesting client device whose authorization to access the content item has been established; and generating packaged content and providing it to a content delivery network for delivery to the client devices, the packaged content including the content item as encrypted and being accompanied by key expiration information usable by the client devices to identify transitions between sections of the packaged content encrypted by different ones of the content encryption keys. ### Claim 27 (depends on 26) The method of claim 26, wherein a next content encryption key is pushed to the packaging server when it is determined that a current content encryption key should be expired as a security precaution. ### Claim 28 (depends on 26) The method of claim 26, wherein providing the content encryption keys includes pushing a content encryption key and a suggested expiration time to the packaging server. ### Claim 29 (depends on 28) The method of claim 28, wherein the content encryption key and suggested expiration time are pushed only in response to a request for a new content encryption key from the packaging server. ### Claim 30 (depends on 29) The method of claim 29, wherein the packaging server requests a new key in anticipation of expiration of a current key. ### Claim 31 (depends on 28) The method of claim 28, wherein the content encryption keys are received from a workflow manager, and further including sending a notification to the workflow manager of an exact expiration time at which a new content encryption key took effect. ### Claim 32 (depends on 26) The method of claim 26, wherein the client device is notified in real time of content key expiration. ### Claim 33 (depends on 32) The method of claim 32, wherein the packaging server provides the key expiration information by inserting a key change notification into a content encryption metadata header as part of the unencrypted portion of the encrypted file, the content encryption metadata header. ### Claim 34 (depends on 32) The method of claim 32, wherein the packaging server provides the key expiration information by inserting a key change notification into a content manifest file accessible to the client devices, the content manifest file being selected from an m3u8 file, an IIS Smooth Streaming manifest file, a DASH MPD file and a proprietary manifest file. ### Claim 35 (depends on 26) The method of claim 26, wherein the series of content encryption keys are versioned using monotonically increasing integer values while maintaining a direct correlation between an encryption key version and a segment number or segment duration associated with segments of the packaged content. ### Claim 36 (depends on 26) The method of claim 26, wherein the license server is operative when establishing that a requesting client device is authorized to access the content item to verify client device identity and content access rights before returning content encryption key or expiration information. ### Claim 37 A computerized device operable as a packaging server for packaging content for secure distribution, comprising: memory operative to store computer program instructions; one or more processors; input/output interface circuitry; and interconnect circuitry coupling the memory, processors and input/output interface circuitry together, wherein the processors are operative to execute the computer program instructions from the memory to cause the computerized device to: receive a series of content encryption keys and using them to encrypt a content item, each content encryption key provided upon expiration of a period of use of a serially preceding content encryption key, the content encryption keys being provided separately to a license server for delivery to client devices for use in decrypting the content item, the license server being operative to establish that a requesting client device is authorized to access the content item, the license server being further operative to securely deliver the content encryption keys to a requesting client device whose authorization to access the content item has been established; and generate packaged content and providing it to a content delivery network for delivery to the client devices, the packaged content including the content item as encrypted and being accompanied by key expiration information usable by the client devices to identify transitions between sections of the packaged content encrypted by different ones of the content encryption keys. ### Claim 38 A system for ingestion of content and packaging and delivery of the content to client devices via a content delivery network, comprising: a set of one or more server computers collectively coupled to a source of the content and to the content delivery network and including a packaging server, a workflow manager and a license server; the packaging server being operative to (i) receive a series of content encryption keys from the workflow manager and use them to encrypt a content item, each content encryption key provided upon expiration of a period of use of a serially preceding content encryption key, and (ii) generate packaged content and providing it to the content delivery network for delivery to the client devices, the packaged content including the content item as encrypted and being accompanied by key expiration information usable by the client devices to identify transitions between sections of the packaged content encrypted by different ones of the content encryption keys; the workflow manager being operative to (i) generate the series of content encryption keys and provide them serially to the packaging server for encrypting the content item, each content encryption key provided upon expiration of a period of use of a serially preceding content encryption key, and (ii) provide the content encryption keys to the license server for delivery to the client devices for use in decrypting the content item; and the license server being operative to (i) establish that a requesting client device is authorized to access the content item, and (ii) securely deliver the content encryption keys to a requesting client device whose authorization to access the content item has been established by the license server, the content encryption keys being delivered for use by the requesting client device in decrypting the content item.