# US 8,918,636 B2 · Systems and methods for protecting alternative streams in adaptive bitrate streaming systems

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,918,636 B2
- Document ID: US8918636B2
- Status: Granted
- Kind: B2
- Application number: 13/341,265
- Filed: 2011-12-30
- Published: 2013-03-07
- Granted: 2014-12-23
- Earliest claimed: 2011-09-01
- Assignees: Sonic IP, Inc.
- Applicants: Michael George Kiefer; Eric William Grab; Jason Braness
- Inventors: Michael George Kiefer; Eric William Grab; Jason Braness
- Web page: https://patentgrep.com/patent/US8918636B2

## CPC

- H04N 21/2347: involving video stream encryption
- H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)}
- H04L 9/0822: {using key encryption key}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 9/32: including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04N 21/2541: {Rights Management (protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08)}
- H04N 21/4408: involving video stream encryption, e.g. re-encrypting a decrypted video stream for redistribution in a home network
- H04N 21/4627: Rights management {associated to the content (security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08)}
- H04N 21/6334: for authorisation, e.g. by transmitting a key {(wireless communications network key management H04W12/04; wireless communications network access security H04W12/08)}
- H04N 21/64715: {Protecting content from unauthorized alteration within the network (verifying the information received for network security in communication control or processing H04L63/12; integrity in wireless network security H04W12/10)}
- H04L 2209/603: Digital right managament [DRM]
- H04N: PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Systems and methods for performing adaptive bitrate streaming using alternative streams of protected content in accordance with embodiments of the invention are described. One embodiment includes a processor, and non-volatile storage containing an encoding application. In addition, the encoding application configures the processor to: receive source content; obtain common cryptographic information; encode the source content as a plurality of streams including a plurality of alternative streams of content; and protect the plurality of alternative streams of content using the common cryptographic information.

## Claims

### Claim 1

A source encoder, comprising:
a processor;
non-volatile storage containing an encoding application for encoding and protecting frames of video to create a plurality of alternative streams of protected content;
wherein the encoding application configures the processor to:
receive a source content;
obtain a common set of frame keys comprising a plurality of frame keys;
encode the source content as a plurality of streams including a plurality of alternative streams of content, wherein each alternative stream of content comprises a plurality of encoded video frames;
encrypt portions of several encoded video frames from each alternative stream of content using keys from the same common set of frame keys;
after encrypting the portions of encoded video frames, write the encoded video frames of each alternative stream of protected content to a separate container file from a plurality of container files and, for each encoded video frame with an encrypted portion that is written to a given container file, write a DRM information to the given container file that identifies (i) an encrypted portion of the encoded video frame and (ii) a frame key from the common set of frame keys that can be utilized by a playback device to access the encrypted portion of the encoded video frame; and
store an encrypted copy of the common set of frame keys in each container file, wherein each encrypted copy of the common set of frame keys has been encrypted with at least one encryption key.

### Claim 2 (depends on 1)

The source encoder of claim 1, wherein the encoding application configures the processor to obtain common cryptographic information by configuring the processor to:
send a request to a DRM server for common set of frame keys; and
receive the common set of frame keys from the DRM server.

### Claim 3 (depends on 1)

The source encoder of claim 1, wherein a title ID is associated with the common set of frame keys and the plurality of alternative streams of protected content.

### Claim 4 (depends on 1)

The source encoder of claim 1, wherein the container files are Matroska container files.

### Claim 5 (depends on 4)

The source encoder of claim 4, wherein the encoding application configures the processor to write a DRMHeader element to a TracksData element in a Tracks element within each of the Matroska container files, where the DRMHeader element includes the encrypted copy of the common set of frame keys.

### Claim 6 (depends on 5)

The source encoder of claim 5, wherein:
the common set of frame keys is a part of a frame key table;
the encoding application configures the processor to:
encrypt the frame key table using the at least one encryption key; and
write the encrypted frame key table to the DRMHeader element of each of the Matroska container files.

### Claim 7 (depends on 6)

The source encoder of claim 6, wherein:
the source content includes a stream of video;
the encoding application configures the processor to:
write a BlockGroup element to a Matroska container file including the DRM information that identifies the encrypted portions of the encoded video frames and the frame keys used to access the encrypted portions of the encoded video frames.

### Claim 8 (depends on 4)

The source encoder of claim 4, wherein the encoding application further configures the processor to:
generate an index for each Matroska container file during the encoding of each of the alternative streams of protected content; and
write a Cues element containing the index to the indexed Matroska container file.

### Claim 9

A method of encoding and protecting source content as a plurality of alternative streams of protected content, comprising:
receiving a source content using a source encoder;
obtaining a common set of frame keys comprising a plurality of frame keys using the source encoder;
encoding the source content as a plurality of streams including a plurality of alternative streams of content using the source encoder, wherein each alternative stream of content comprises a plurality of encoded video frames;
encrypting portions of several encoded video frames from each alternative stream of content using keys from the same common set of frame keys and the source encoder;
after encrypting the portions of encoded video frames, writing the encoded video frames of each given alternative stream of protected content to a separate container file from a plurality of container files using the source encoder and, for each encoded video frame with an encrypted portion that is written to a given container file, writing a DRM information to the given container file that identifies (i) an encrypted portion of the encoded video frame and (ii) a frame key from the common set of frame keys that can be utilized by a playback device to access the encrypted portion of the encoded video frame; and
storing an encrypted copy of the common set of frame keys in each container file using the source encoder, wherein each encrypted copy of the common set of frame keys has been encrypted with at least one encryption key.

### Claim 10 (depends on 9)

The method of claim 9, wherein obtaining the common set of frame keys comprises:
sending a request to a DRM server for the common set of frame keys using the source encoder; and
receiving the common set of frame keys from the DRM server.

### Claim 11 (depends on 9)

The method of claim 9, further comprising associating a title ID with the common set of frame keys and the plurality of alternative streams of protected content.

### Claim 12 (depends on 9)

The method of claim 9, wherein the container files are Matroska container files.

### Claim 13 (depends on 12)

The method of claim 12, further comprising writing a DRMHeader element to a TracksData element in a Tracks element within each of the Matroska container files using the source encoder, where the DRMHeader element includes the encrypted copy of the common set of frame keys.

### Claim 14 (depends on 13)

The method of claim 13, wherein the common set of frame keys is a part of a frame key table and the method further comprises:
encrypting the frame key table using the at least one encryption key using the source encoder; and
writing the encrypted frame key table to the DRMHeader element of each of the Matroska container files using the source encoder.

### Claim 15 (depends on 14)

The method of claim 14, wherein the source content includes a stream of video and the method further comprises:
writing a BlockGroup element to a Matroska container file including the DRM information that identifies the encrypted portions of the encoded video frames and the frame keys used to access the encrypted portions of the encoded video frames using the source encoder.

### Claim 16 (depends on 12)

The method of claim 12, further comprising:
generating an index for each Matroska container file using the source encoder during the encoding of each of the alternative streams of protected content; and
writing a Cues element containing the index to the indexed Matroska container file using the source encoder.

### Claim 17

A non-transitory machine readable medium containing processor instructions, where execution of the instructions by a processor causes the processor to perform a process comprising:
receiving a source content;
obtaining a common set of frame keys comprising a plurality of frame keys;
encoding the source content as a plurality of streams including a plurality of alternative streams of content, wherein each alternative stream of content comprises a plurality of encoded video frames;
encrypting portions of several encoded video frames from each alternative stream of content using keys from the same common set of frame keys;
after encrypting the portions of encoded video frames, writing the encoded video frames of each given alternative stream of protected content to a separate container file and, for each encoded video frame with an encrypted portion that is written to a given container file, writing a DRM information to the given container file that identifies an encrypted portion of the encoded video frame and a frame key from the common set of frame keys that can be utilized by a playback device to access the encrypted portion of the encoded video frame; and
storing an encrypted copy of the common set of frame keys in each container file, wherein each encrypted copy of the common set of frame keys has been encrypted with at least one encryption key.

### Claim 18

A content distribution system, comprising:
a DRM server;
a content distribution server;
a source encoder configured to:
receive source content;
obtain a common set of frame keys comprising a plurality of frame keys from the DRM server;
encode the source content as a plurality of streams including a plurality of alternative streams of content associated with a title, wherein each alternative stream of content comprises a plurality of encoded video frames;
encrypt portions of several encoded video frames from each alternative stream of content using keys from the same common set of frame keys;
after encrypting the portions of encoded video frames, write the encoded video frames of each alternative stream of protected content to a separate container file from a plurality of container files and, for each encoded video frame with an encrypted portion that is written to a given container file, write a DRM information to the given container file that identifies (i) an encrypted portion of the encoded video frame and (ii) a frame key from the common set of frame keys that can be utilized by a playback device to access the encrypted portion of the encoded video frame;
store an encrypted copy of the common set of frame keys in each container file, wherein each encrypted copy of the common set of frame keys has been encrypted with at least one encryption key;
provide the plurality of container files containing the plurality of alternative streams of protected content associated with the title to the content distribution server;
wherein the DRM server is configured to:
receive a request for access to the alternative streams of protected content associated with the title from a playback device;
securely provide a copy of the at least one encryption key used to encrypt the common set of frame keys to the playback device; and
wherein the content distribution server is configured to grant the playback device access to the alternative streams of protected content associated with the title.

### Claim 19 (depends on 18)

The content distribution system of claim 18, wherein the DRM server is configured to associate a title ID with the title.

### Claim 20 (depends on 19)

The content distribution system of claim 19, wherein the DRM server is configured to associate the common set of frame keys with the title ID.

### Claim 21 (depends on 19)

The content distribution system of claim 19, wherein the request for access to the alternative streams of protected content associated with the title comprises a request identifying a title ID.

### Claim 22 (depends on 18)

The content distribution system of claim 18, wherein the content distribution server is further configured to:
receive requests for portions of at least one container file from the playback device; and
provide the requested portions of the at least one container file to the playback device.

### Claim 23 (depends on 18)

The content distribution system of claim 18, wherein the plurality of container files are Matroska container files.

### Claim 24 (depends on 23)

The content distribution system of claim 23, wherein the source encoder is configured to write a DRMHeader element to a TracksData element in a Tracks element within each of the Matroska container files, where the DRMHeader element includes the encrypted copy of the common set of frame keys.

### Claim 25 (depends on 24)

The source encoder of claim 24, wherein:
the common set of frame keys is a part of a frame key table;
the source encoder is configured to:
encrypt the frame key table using the at least one encryption key; and
write the encrypted frame key table to the DRMHeader element of each of the Matroska container files.

### Claim 26 (depends on 25)

The content distribution system of claim 25, wherein
the source content includes a stream of video; and
the source encoder is configured to:
write a BlockGroup element to a Matroska container file including the DRM information that identifies the encrypted portions of the encoded video frames used to access the encrypted portions of the encoded video frames.

### Claim 27 (depends on 23)

The content distribution system of claim 23, wherein the source encoder is configured to:
generate an index for each Matroska container file during the encoding of each of the alternative streams of protected content; and
write a Cues element containing the index to the indexed Matroska container file.

### Claim 28

A method of distributing content encoded as a plurality of alternative streams of protected content, the method comprising:
receiving a source content using a source encoder;
obtaining a common set of frame keys from a DRM server using the source encoder, wherein the common set of frame keys comprises a plurality of frame keys;
encoding the source content as a plurality of streams including a plurality of alternative streams of content using the source encoder, wherein each alternative stream of content comprises a plurality of encoded video frames;
encrypting portions of several encoded video frames from each alternative stream of content using keys from the same common set of frame keys and the source encoder;
after encrypting the portions of encoded video frames, writing the encoded video frames of each given alternative stream of protected content to a separate container file from a plurality of container files using the source encoder and, for each encoded video frame with an encrypted portion that is written to a given container file, writing a DRM information to the given container file that identifies (i) an encrypted portion of the encoded video frame and (ii) a frame key from the common set of frame keys that can be utilized by a playback device to access the encrypted portion of the encoded video frame;
storing an encrypted copy of the common set of frame keys in each container file using the source encoder, wherein each encrypted copy of the common set of frame keys has been encrypted with at least one encryption key;
providing the plurality of container files containing the plurality of alternative streams of protected content to a content distribution server;
receiving a request for access to the alternative streams of protected content from a playback device using the DRM server, wherein the plurality of alternative streams of protected content are associated with a title;
securely providing to the playback device at least one encryption key using the DRM server, where the at least one encryption keys is used to access the encrypted common cryptographic information; and
granting the playback device access to the alternative streams of protected content using the content distribution server.

### Claim 29 (depends on 28)

The method of claim 28, wherein the title is identified using a title ID.

### Claim 30 (depends on 29)

The method of claim 29, wherein the common set of frame keys is associated with the title ID.

### Claim 31 (depends on 29)

The method of claim 29, wherein the request for access to the alternative streams of protected content associated with the title comprises a request identifying a title ID.

### Claim 32 (depends on 28)

The method of claim 28, further comprising:
receiving requests for portions of at least one container file from the playback device using the content distribution server; and
providing the requested portions of the at least one container file to the playback device using the content distribution server.

### Claim 33 (depends on 28)

The method of claim 28, wherein the plurality of container files are Matroska container files.

### Claim 34 (depends on 28)

The method of claim 28, wherein the container files are Matroska container files.

### Claim 35 (depends on 34)

The method of claim 34, further comprising writing a DRMHeader element to a TracksData element in a Tracks element within each of the Matroska container files using the source encoder, where the DRMHeader element includes the encrypted copy of the common set of frame keys.

### Claim 36 (depends on 35)

The method of claim 35, wherein the common set of frame keys is a part of a frame key table, the method further comprising:
encrypting the frame key table using the at least one encryption key; and
writing the encrypted frame key table to the DRMHeader element of each of the Matroska container files using the source encoder.

### Claim 37 (depends on 36)

The method of claim 36, wherein the source content includes a stream of video, the method further comprising:
writing a BlockGroup element to a Matroska container file including the DRM information that identifies the encrypted portions of the encoded video frames and the frame keys used to access the encrypted portions of the encoded video frames using the source encoder.

### Claim 38 (depends on 34)

The method of claim 34, further comprising:
generating an index for each Matroska container file during the encoding of each of the alternative streams of protected content using the source encoder; and
writing a Cues element containing the index to the indexed Matroska container file using the source encoder.