Method and apparatus for avoiding license storming during an unplanned regional blackout

A computer implemented method and apparatus for avoiding license storming during an unplanned regional blackout. The method comprises generating a leaf license for each geographic region of a plurality of geographic regions in a broadcast area, wherein each leaf license includes a first content encryption key for decrypting media content associated with the leaf license, and where each leaf license is bound to a root license for each geographic region in the plurality of geographic regions; and generating, in response to a blackout event, a new leaf license for each geographic region of the plurality of geographic regions that are located outside of a blackout area, wherein each new leaf license includes a second content encryption key different from the first content encryption key for decrypting protected media content, and wherein each new leaf license remains bound to the root license for each geographic region in the plurality of geographic regions.

BACKGROUND

1. Field of the Invention

Embodiments of the present invention generally relate to digital rights management and, more particularly, to a method and apparatus for avoiding license storming during an unplanned regional blackout.

2. Description of the Related Art

Broadcasters often deliver media on networks using Hyper Text Transfer Protocol (HTTP) streaming solutions such as HTTP Dynamic Streaming (HDS), HTTP live streaming (HLS) and Dynamic Adaptive streaming for HTTP (MPEG-DASH) to take advantage of HTTP Content Delivery Network (CDN) capabilities, efficient seeking and efficient bit rate shifting so as to enable a rich user experience. To protect their media streams from unauthorized access, broadcasters use various available digital rights management (DRM) solutions, such as ADOBE® Access that require an encryption key to decrypt protected content. The encryption key is provided to users who meet certain criteria so as to enable decryption of each segment of the protected content being streamed.

One aspect of DRM solutions includes provisions for changing the encryption key in order to enforce a regional blackout. A regional blackout occurs when a part of a live media stream is to be prevented, that is, barred from broadcast in one or more geographic regions, for example, for regulatory or governmental reasons. When such a blackout occurs without preparation, that is, it is unplanned, the encryption key is abruptly changed. In response, every media player that is currently rendering the protected content must then request the new key from a license server. Only requests from media players that are not in blackout regions are provided with the new encryption key so as to enforce the regional blackout. However, this technique is undesirable since it places a heavy request load on the license server for new encryption keys, such heavy request load being known as license storming.

Therefore, there is a need for a method and apparatus for avoiding license storming during an unplanned regional blackout.

SUMMARY

A method for avoiding license storming during an unplanned regional blackout is described. The method generates a leaf license for each geographic region of a plurality of geographic regions in a broadcast area. Each leaf license includes a first content encryption key (CEK) for decrypting media content associated with the leaf license, and is bound to a root license for each geographic region in the plurality of geographic regions. Binding of the leaf license to the root license means that the root license includes a root key that is used to encrypt the CEK. Thus, the root key is used to decrypt the CEK, which in turn decrypts the protected media content. In response to a blackout event, wherein one or more geographic regions of the plurality of geographic regions is located in a blackout area and is to be prevented from viewing the protected media content, new leaf licenses are generated for each geographic region outside of the blackout area. Each new leaf license includes a second content encryption key that is different from the first content encryption key for decrypting protected media content. Since the new leaf license is also bound to the root license, and the root license is not changed, the new leaf license is able to be decrypted by the existing root license, thereby avoid license storming.

In another embodiment, an apparatus for avoiding license storming during an unplanned regional blackout is described. The apparatus includes a license generator for generating a leaf license for each geographic region of a plurality of geographic regions in a broadcast area, where each leaf license includes a first content encryption key (CEK) for decrypting media content before a blackout event. In addition, each leaf license is bound to a root license for each geographic region in the plurality of geographic regions. The root license includes a root key that is used to decrypt the CEK, which in turn decrypts the protected media content. In response to a blackout event, the license generator generates a new leaf license for each geographic region of the plurality of geographic regions that are located outside of the blackout area, wherein each new leaf license includes a second content encryption key that is different from the first content encryption key for decrypting protected media content. Since the new leaf license is also bound to the root license, and the root license is not changed, the new leaf license is able to be decrypted by the existing root license, thereby avoid license storming.

In yet another embodiment, a computer readable medium for avoiding license storming during an unplanned regional blackout is described. The computer readable medium comprises a processor for performing instruction of a method. The method generates a leaf license for each geographic region of a plurality of geographic regions in a broadcast area. Each leaf license includes a first content encryption key (CEK) for decrypting media content associated with the leaf license, and is bound to a root license for each geographic region in the plurality of geographic regions. The root license includes a root key that is used to decrypt the CEK, which in turn decrypts the protected media content. In response to a blackout event, wherein one or more geographic regions of the plurality of geographic regions is located in a blackout area and is to be barred from viewing the protected media content, new leaf licenses are generated for each geographic region outside of the blackout area. Each new leaf license includes a second content encryption key that is different from the first content encryption key for decrypting protected media content. Since the new leaf license is also bound to the root license, and the root license is not changed, the new leaf license is able to be decrypted by the existing root license, thereby avoid license storming.

DETAILED DESCRIPTION OF EMBODIMENTS

Embodiments of the present invention include a method and apparatus for avoiding license storming during a regional blackout. The embodiments secure a content encryption key (CEK) in a leaf license that is bound to a root license. The leaf license is provided to a media player in a manifest file, while the root license is fetched by a media player from a license server. On the media player, the root license includes a root key that is used to decrypt the CEK, which in turn decrypts the protected content.

A different leaf license and root key is created for each geographic region in a broadcast area. In addition, a different manifest file is created for each geographic region and includes region specific digital rights management (DRM) metadata. When a blackout event occurs, the CEK is rotated and the leaf license is regenerated for each region outside of the blackout region(s) so decryption of media content can continue in each region outside of the blackout region(s). The blackout regions are provided a manifest file that includes alternate content that may be viewed during a blackout period.

In non-black out regions, because the leaf license is still bound to the root license, the root license can still decrypt the leaf license, such that the protected content may be played without additional requests to a license server. In some embodiments, when a user is mobile and plays protected content in a non-blackout region, but subsequently moves to a blackout region, the protected content is blocked.

Advantageously, digital rights management technology, such as ADOBE Access can protect content during unplanned regional blackouts while avoiding license storming. Because licenses are segregated by region, the present invention provides a manifest for alternate content to a blackout region. Also, it is virtually impossible for a malicious media player in a blackout region to access the protected content because the media player is not provided a leaf license that includes the new CEK. Although the present invention avoids license storming in the event of an unplanned blackout, the method described herein may also be used during planned blackouts.

As used herein, a geographic region is a region of a broadcast area, such as a region typically defined by time boundaries, such as time zones, although or other boundaries, such as governmental jurisdictions, are also contemplated. A blackout is an event that occurs when media content is broadcast in one or more geographic regions of a broadcast area, but is to be prevented from being broadcast in one or more other regions of a broadcast area. For example, election results may be broadcast in a given region where polling is closed, but government regulation requires that such election results broadcast be prevented in regions where polling is not closed, thereby avoiding undue influence at the polls by such broadcast.

A blackout region is a region of the broadcast area where broadcast of content is to be prevented.

A content encryption key (CEK) is an encryption key used to encrypt and decrypt media content. The CEK may be a symmetric key, for example, AES-128 encryption using a 128-bit key. A leaf license is a license that contains the CEK that is encrypted using a root key. The root key may be a symmetric key. Each leaf license and root key are unique to a given geographic region in a broadcast area. In order to view encrypted media content, the root key must be used to decrypt the CEK, which in turn, decrypts the media content.

Alternate content is any content other than the media content that is to be prevented from being broadcast to a given blackout region. A blackout period is a period of time for which the blackout occurs. For example, in the case of election results, the blackout period for a given period begins when polling closes in another region and ends when polling closes in the present region.

FIG. 1is a block diagram of a system100for avoiding license storming during an unplanned regional blackout, according to one or more embodiments. The system100includes a content packaging server102, a content distributing server104, a license server106, and a client device108, communicatively coupled to one another via a network110.

The content packaging server102is a computing device, such as a desktop computer, laptop, tablet computer, and the like, such as ADOBE Media Server or ADOBE Primetime packager. The content packaging server102includes a Central Processing Unit (CPU)112, support circuits114, and a memory116. The CPU112may include one or more commercially available microprocessors or microcontrollers that facilitate data processing and storage. The various support circuits114facilitate the operation of the CPU112and include one or more clock circuits, power supplies, cache, input/output circuits, and the like. The memory116includes at least one of Read Only Memory (ROM), Random Access Memory (RAM), disk drive storage, optical storage, removable storage and/or the like.

The memory116includes an operating system118, a license generator120, a content packager122, an encryption module124, DRM metadata126, manifest files128, file of geographic regions130, media content132, a plurality of leaf licenses134, and in the event of a blackout event, a plurality of new leaf licenses136, and a plurality of root keys138. Each leaf license134includes a content encryption key (CEK)135. Each new leaf license136includes a new CEK137. The operating system118may include various commercially known operating systems. The DRM metadata126includes a leaf license and a universal resource locator (URL) for the license server106. The file of geographic regions130includes key value pairs that include region identifiers and an associated root license for the region.

Before the media content132is sent to a client device108, a content encryption key (CEK)135is used to encrypt the media content132. The CEK135is encrypted inside of the leaf license134using the root key138. As such, the root key138is needed to later decrypt the CEK135that decrypts the encrypted media content132. The leaf license134and root key138are unique to a specific geographic region, such that when a blackout event occurs in one or more geographic regions, new leaf licenses136may be generated and sent to the non-blackout regions, leaving the blackout regions without the new leaf license136needed to decrypt the media content132. The encrypted leaf license134is included in the DRM metadata126. The manifest file128includes a universal resource locator (URL) that identifies the location of where to retrieve media content132. There is a unique DRM metadata126and manifest file128for each geographic region.

The content distributing server104is a computing device, such as a desktop computer, laptop, tablet computer, and the like, owned by a multichannel video programming distributor site, such as COMCAST, NETFLIX, and the like. The content distributing server104is a repository for packaged content180received from the content packaging server102. The packaged content180includes protected content182, DRM metadata184, and a manifest file186. As described previously, there is different DRM metadata184and manifest file186for each geographic region.

The license server106is a computing device, such as a desktop computer, laptop, tablet computer, and the like, such as ADOBE® Access License Server. The license server106includes a Central Processing Unit (CPU)160, support circuits162, and a memory164. The CPU160may include one or more commercially available microprocessors or microcontrollers that facilitate data processing and storage. The various support circuits162facilitate the operation of the CPU160and include one or more clock circuits, power supplies, cache, input/output circuits, and the like. The memory164includes at least one of Read Only Memory (ROM), Random Access Memory (RAM), disk drive storage, optical storage, removable storage and/or the like. The memory164includes an operating system166, root license generator168, a verification module170, a client database172, and root licenses174, one root license for each geographic region of a broadcast area. The operating system166may include various commercially known operating systems.

The client device108is any computing device capable of receiving and playing streaming media content, such as a media player, a browser, and the like. The client device108includes a Central Processing Unit (CPU)140, support circuits142, and a memory144. The CPU140may include one or more commercially available microprocessors or microcontrollers that facilitate data processing and storage. The various support circuits142facilitate the operation of the CPU140and include one or more clock circuits, power supplies, cache, input/output circuits, and the like. The memory144includes at least one of Read Only Memory (ROM), Random Access Memory (RAM), disk drive storage, optical storage, removable storage and/or the like.

The memory144includes an operating system146and a media player148. The operating system146may include various commercially known operating systems. The media player148includes a DRM manager150, a media renderer152, a root license154, and a cached manifest URL156. The root license154includes a root key (not shown) that is used to decrypt the CEK in the leaf license. The CEK is used to decrypt the protected content182received from the content distributing server104.

The network110includes a communication system that connects computers (or devices) by wire, cable, fiber optic and/or wireless link facilitated by various types of well-known network elements, such as hubs, switches, routers, and the like. The network110may be a part of the Intranet using various communications infrastructure, such as Ethernet, Wi-Fi, a personal area network (PAN), a wireless PAN, Bluetooth, Near field communication, and the like.

A broadcast area is divided into pre-defined geographic regions. The root license generator168on the license server106generates a root license for each geographic region of a broadcast area. For example, the broadcast area may be divided into ten regions. In such case, the root license generator168generates ten root licenses174. The generated root licenses174include root keys that are accessed by the content packaging server102for use in encrypting the CEK135within the leaf licenses134. The root licenses174are also later requested by the DRM manager150on the client device108for use in decrypting the CEK135.

The encryption module124encrypts the media content132using a content encryption key (CEK)135. The license generator120generates a leaf license134for each geographic region in the broadcast area. The CEK135is encrypted inside the leaf license134using the root key138for the geographic region that is associated with the leaf/root license pair for that region. The manifest file128includes a universal resource locator (URL) that identifies the location of the protected media content182on the content distributing server104. When a user of the client device108logs into a multichannel video programming distributor website to request content, the region identifier of the media player148is returned along with a general manifest file that identifies a main URL for the content. The main URL is the same for all regions. The media player148sends a request to the content distributing server104at the main URL and provides the region identifier with a request. The content distributing server104returns the manifest file186specific to the geographic region identified by the region identifier provided by the media player148.

The media player148then fetches the protected content182and DRM metadata184using the actual manifest for its region. If this is the first time that the media player148is playing the protected content182, the media player148extracts the location of the license server106from the DRM metadata184and requests from the license server106a root license174that is associated with the geographic region of the media player148.

In response to the request, the verification module170on the license server106accesses the client database172to ensure that the media player148is entitled to the root license174. The root license generator168provides a root license174that is individualized for the media player148. A root license174includes a root key (not shown) that exists for each geographic region in a broadcast area, but the root license generator168individualizes the root license174for the media player148by uniquely encrypting the root license174for a given media player148.

The media player148caches the root license154received from the license server106and uses that root license154as required for decrypting segments of streamed protected content182. The root license154contains the same root key that was used to encrypt CEK135, where the encrypted CEK is contained in the leaf license134generated by the license generator120on the content packaging server102. Binding of the leaf license134to the root license154means that the root license154is used to encrypt the CEK135within the leaf license134. Thus, when a blackout event occurs, although a new leaf license136that includes a new CEK137is generated for DRM of the blackout event, the new leaf license136is still bound to the root license154and thus able to be decrypted thereby. As such, a subsequent request by media player148to the license server106for a new root license is not needed.

The DRM manager150uses the root key from the root license154to decrypt the CEK135from the leaf license134, decrypts the protected content182and passes it to the media renderer152for rendering.

When a blackout event occurs, the license generator120rotates the CEK for the geographic regions that are outside of the blackout region. For example, if there are ten (10) geographic regions, and two of the regions are blackout regions, the license generator120creates a new CEK137. The encryption module124encrypts the media content132using the new CEK137. The content packager122generates new DRM metadata126and manifest files128for each geographic region. The geographic regions that are outside of the blackout area receive the DRM metadata126with the new leaf license136and a manifest file128that includes a URL for accessing the protected content182. The geographic regions that are inside of the blackout area (i.e., blackout regions) are provided DRM metadata126that does not include the new leaf license136, and a manifest file128that includes a URL for accessing alternate content that may be viewed during a blackout period. The content packager122packages the encrypted media content132, DRM metadata126, and manifest files128. The content packager122then publishes the packaged content180at the content distributing server104.

When a media player148is not located in a blackout region, the media player148continues to receive the protected content158. The DRM manager150uses the root license154to decrypt the new leaf license136received in the DRM metadata159that is received from the content distributing server104. Because the new leaf license136is still bound to the root license154, meaning the root license154was used to encrypt the new leaf license136, no new root license is required to decrypt the new leaf license136, access the new CEK137, and decrypt the protected content158. The media renderer152therefore seamlessly continues to render the media content being streamed.

When a media player148is located within a blackout region, the media player148accesses the manifest URL156, which includes a URL of alternate content for which a license is not required. The media renderer152renders the alternate content for the duration of the blackout period.

In the case where the media player148is a malicious player that accesses the protected content182from the content distributing server104, the malicious player is unable to decrypt the protected content182because their DRM metadata159does not contain the new leaf license136. As such the media player148is unable to gain access to the new CEK137and cannot decrypt the protected content182.

FIG. 2depicts a flow diagram of a method200for avoiding license storming during an unplanned regional blackout as performed by the license generator120, encryption module124and content packager122ofFIG. 1, according to one or more embodiments. The method200packages a different set of protected content with DRM metadata and a manifest file for each geographic region in a broadcast area. When a blackout event occurs, the method200generates new DRM metadata and manifest files for each geographic region such that the protected content cannot be viewed in the blackout regions. The method200starts at step202and proceeds to step204.

At step204, the method200packages and publishes protected content as described in further detail with respect toFIG. 3below. The method200proceeds to step206where the method200receives a signal that a blackout event has occurred. The blackout event may be signaled in-stream via a message from a media encoder to the content packager. The blackout event may be received out-of-band, for example, via java-JMX API or through HTTP REST interface, and the like.

The method200proceeds to step208, where the method200, in response to the blackout event, rotates content encryption key (CEK) and encrypts the content with the newly generated CEK. The content is encrypted with a CEK. The method200then uses the new CEK to encrypt the content for the geographic regions outside of the blackout area. The method200encrypts the new CEK differently for each geographic region. The method200encrypts the new CEK using a region-specific root key.

The method200proceeds to step210, where the method200generates new leaf licenses, digital rights management (DRM) metadata and manifest files for each geographic region in the broadcast area. Each leaf license includes the new CEK. The method200encrypts the new CEK using the root key for the associated geographic region. The method200then updates the DRM metadata files for regions outside of the blackout area with the new leaf licenses. The method200updates the DRM metadata files for regions inside of blackout areas without a leaf license. The method200also updates the manifest files with the URL for the location of the content. For geographic regions outside of the blackout area, the URL provides the location of the encrypted content. For geographic regions within the blackout area, the URL provides a location of alternate content that may be viewed by the media player within the blackout area for the duration of the blackout period.

The method200proceeds to step212, where the method200publishes the encrypted content, DRM metadata, and manifest files on a content distributing server. When a media player requests content, the request includes the media player's region identifier. The media player receives the content appropriate for the geographic region where the media player is located, whether the region is in a blackout area or not. When a blackout event occurs and the CEK is changed, a media player need not request a new license because the new leaf license that includes the CEK is still bound to the root license that is cached on the media player, thereby avoiding license storming. The method200proceeds to step214and ends.

FIG. 3depicts a flow diagram of a method300for packaging and publishing content, as performed by the license generator120, content packager122, and encryption module124ofFIG. 1, according to one or more embodiments. The method300encrypts media content, prepares DRM metadata and manifest files for each geographic region in a broadcast area, and packages and publishes the encrypted content, DRM metadata and manifest files for all of the geographic regions in the broadcast area. The method300is performed initially when a broadcast begins, before a blackout event occurs. The method300starts at step302and proceeds to step304.

At step304, the method300encrypts media content. The method300encrypts the media content with a content encryption key (CEK). The CEK is used to encrypt the media content and upon receipt at a media player, the media content must be decrypted using the same CEK. The method300using license chaining to secure the CEK as described in further detail below.

The method300proceeds to step306, where the method300generates leaf licenses, one for each geographic region in the broadcast area. The method300encrypts the CEK inside of the leaf license using the root key for the geographic region. The method300proceeds to step308, where the method300generates DRM metadata and a manifest file for each geographic region in the broadcast area. The DRM metadata includes the leaf license and a URL of a license server from where a media player can request a root license. The manifest file includes a URL for where to access the encrypted content for the region where the media player resides.

The method300proceeds to step310, where the method300packages and publishes the encrypted content, DRM metadata and manifest files for all of the geographic regions of the broadcast area. The method300packages the encrypted content, DRM metadata and manifest file for each region and publishes it to a content distributing server where it may be requested by a media player. The method300proceeds to step312and ends.

In an alternate embodiment, a media player can determine when it is mobile and has moved into a blackout region. The media player is able to periodically obtain its current physical geographical location from a network service provider or device-platform Application Programming Interfaces (APIs). The physical geographical location may be based on any measurement units, for example, longitude and latitude, network cell id, IP address and the like. The license server exposes a service API that is used to determine the current region ID and its boundaries based on the current physical geographical location. When a media player is mobile, for example, when a viewer of the content is on a train or bus and travels into a different geographic region, the media player recognizes when it moves into a different region.

When mobile, media playback is initiated as describe above (i.e., a media player uses a main manifest URL and region ID to generate a region specific manifest URL and fetches the manifest file. The media player extracts the DRM metadata from the manifest file and provides the metadata along with the region ID to the DRM Platform to acquire the root license.)

The DRM platform reconfirms the region ID by providing the license server with the current location and receiving the region ID, along with associated physical geographical boundary, in response. The DRM platform matches the region ID provided by the media player with the region ID provided by the license server. If the region IDs match, the DRM platform sends a request to the license server to acquire a root license. The licenser server validates the mapping of the region ID and a root license ID (present in the leaf license of the DRM metadata). If the region ID and root license ID match, the license server responds with a valid root license. The DRM platform uses the root license to derive the CEK from the leaf license to enable playback of the media content.

The DRM platform monitors the region boundary such that it can determine if crossing a region boundary results in entry to a blackout region. In some embodiments, the DRM platform continuously polls its current location through the API exposed by the device platform or network service provide and determines if it is contained within the current region boundary received from the license server. In some embodiments, the DRM platform registers itself to a call back service (by providing the current region boundary) of the device platform. The DRM platform receives notification when the device crosses a region boundary.

When a region boundary is crossed, the DRM platform provides the current location to the license server and receives its new region ID in response. The DRM platform sends notification to the media player that the client device has moved to a new region. The DRM platform may send a notification that the current license will expire within a pre-determined grace period, for example 1 or 2 minutes.

The media player, within the grace period, fetches the manifest file associated with the new region ID and extracts the DRM metadata from the manifest file. The media player provides the DRM metadata to the DRM platform along with the region ID, at which time the DRM platform reconfirms (if it is not already cached for the current physical region boundary) the region ID with the license server as described above.

Again, the DRM platform matches the region ID provided by the player with the one received from the license server. If there is a match, playback of the media content continues. However, if after expiry of the grace period, a valid root license is not received (i.e., the media player has moved into a blackout region), playback of the media content stops. As such, even though a user may initially be located in a non-blackout region, if the user moves to a blackout region, the protected content is blocked.

The embodiments of the present invention may be embodied as methods, apparatus, electronic devices, and/or computer program products. Accordingly, the embodiments of the present invention may be embodied in hardware and/or in software (including firmware, resident software, micro-code, etc.), which may be generally referred to herein as a “circuit” or “module”. Furthermore, the present invention may take the form of a computer program product on a computer-usable or computer-readable storage medium having computer-usable or computer-readable program code embodied in the medium for use by or in connection with an instruction execution system. In the context of this document, a computer-usable or computer-readable medium may be any medium that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. These computer program instructions may also be stored in a computer-usable or computer-readable memory that may direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer usable or computer-readable memory produce an article of manufacture including instructions that implement the function specified in the flowchart and/or block diagram block or blocks.

The computer-usable or computer-readable medium may be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, device, or propagation medium. More specific examples (a non-exhaustive list) of the computer-readable medium include the following: hard disks, optical storage devices, a transmission media such as those supporting the Internet or an intranet, magnetic storage devices, an electrical connection having one or more wires, a portable computer diskette, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, and a compact disc read-only memory (CD-ROM).

Computer program code for carrying out operations of the present invention may be written in an object oriented programming language, such as Java®, Smalltalk or C++, and the like. However, the computer program code for carrying out operations of the present invention may also be written in conventional procedural programming languages, such as the “C” programming language and/or any other lower level assembler languages. It will be further appreciated that the functionality of any or all of the program modules may also be implemented using discrete hardware components, one or more Application Specific Integrated Circuits (ASICs), or programmed Digital Signal Processors or microcontrollers.