Real-time delivery of license for previously stored encrypted content

Content is stored as ClearText by a content provider within a trusted area. Specific content is requested by an end user, preferably via a service provider, and the requested content is encrypted and then delivered over a secure communications channel to a home server system. While the encrypted content is stored on the home server system, the associated encryption keys are stored as a license with the content provider. When a playback device on the home server system is instructed to play back the encrypted content, the encrypted content is streamed from local storage within the home server system while the associated encrypted keys are simultaneously streamed from the content provider to the playback device.

FIELD OF THE INVENTION

The present invention relates to the field of content delivery. More particularly, the present invention relates to the field of real-time delivery of a license for previously stored encrypted content.

BACKGROUND OF THE INVENTION

High quality digital video entertainment will not be Internet delivered without effective content protection. Content providers view content protection as an absolute must have before compelling content is released for network connected devices. Moreover, it seems unreasonable to assume that in the future consumers will accept inferior quality content, or an inferior experience based upon the limitations of the Internet. The technology exists for content providers to provide high quality content over the Internet. However, digital content by its very nature is easy to duplicate either with or without the copyright holders permission. Broadband Internet allows the delivery of the content from the legal copyright holder, but that same technology also allows for the wide spread distribution of improperly duplicated content.

There are two predominate and rather distinct digital content protection models: Conditional Access (CA), and Digital Rights Management (DRM). The CA technology is based on encryption of live content that is broadcasted to consumers and the presence of a set-top box that has the ability to selectively decrypt the content. The digital content is encrypted during transmission at the uplink site and distributed over an broadcast network. Providing the keys to decrypt the content only to authorized subscribers restricts the content access. The keys are typically protected using smart card technology.

The DRM technology addresses the need for protecting file distribution. DRM has emerged as a complex set of technologies and business models to protect digital media copyrights and to provide revenue to content owners.

Most DRM systems use the same overall systems design as illustrated inFIG. 1. A ClearText Repository10includes a collection of content provided by content owners. The ClearText Repository10resides within a trusted area behind at least one firewall15. Within the trusted area, content residing on the ClearText Repository10can be encrypted. An Encrypted Content Server20receives encrypted content from the ClearText Repository10and packages the encrypted content for distribution. A License Server30holds description of rights and usage rules associated with the encrypted content, as well as associated encryption keys. A playback device40receives encrypted content from the Encrypted Content Server20for display and communicates with the License Server30to verify access rights.

The DRM process consists of requesting a unit of content, encrypting the unit of content with a session key, storing the session key in a content license, distributing the encrypted content to a playback device, delivering a license file that includes the encrypted session key to the playback device, and decrypting the content file and playing it under the usage rules specified in the license. A significant security issue exists in this process in that a content provider loses a degree of control over the content's security and distribution once the encrypted content and associated license file are transmitted to and stored on the playback device. Although the playback device may include a trusted area where the encrypted content is decrypted and decoded, the trusted area on a playback device is less secure than a trusted area maintained directly by the content provider.

A better set of protection mechanisms than CA and DRM is necessary to accomplish delivery of any media to any device on the Internet.

SUMMARY OF THE INVENTION

Content is preferably stored as ClearText by a content provider within a trusted area. Specific content is requested by an end user, preferably via a service provider, and the requested content is encrypted and then delivered over a secure communications channel to a home server system. While the encrypted content is stored on the home server system, the associated encryption keys are stored as a license with the content provider. When a playback device on the home server system is instructed to play back the encrypted content, the encrypted content is streamed from local storage within the home server system while the associated encrypted keys are simultaneously streamed from the content provider to the playback device.

In one aspect of the present invention, a method securely provides content from a content source to a local device. The method comprises downloading and storing encrypted content from the content source to a local storage, storing one or more encryption keys corresponding to the encrypted content at the content source, and utilizing the encrypted content by streaming the encrypted content from the local storage to a processing circuit within the local device while the one or more encryption keys are simultaneously streamed from the content source to the processing circuit. The one or more encryption keys can be streamed from the content source to the processing circuit over a secure connection. Utilizing the encrypted content can include playing the content on an audio or display device. The processing circuit decrypts the encrypted content using the one or more encryption keys. The encrypted content need not be downloaded from the content source to the local storage in real-time. The content comprises audio, video, or image data. The one or more encryption keys can be stored at the content source as encrypted encryption keys. The method can also include utilizing a secure clock to synchronize streaming of the encrypted content and the one or more encryption keys. The secure clock can ensure the enforcement of time-based rules associated with the one or more encryption keys. The secure clock can be located at the content source.

In another aspect of the present invention, a network of devices securely processes content. The network of devices comprises a remote content source, a local storage coupled to the remote content source to store encrypted content received from the remote content source, and a local device coupled to the local storage to receive the encrypted content streamed from the local storage while one or more encryption keys are simultaneous streamed from the content source to the local device, wherein the local device decrypts the encrypted content according to the one or more encryption keys. The local storage can reside within a home server. The local device can comprise the home server. The local device can comprise a set-top box coupled to the home server. The local device can comprise a television coupled to the home server. The network of devices can also include an audio or display device coupled to the local device, wherein the local device sends the decrypted content to the audio or display device for playback. The content source can include a secure clock and the local device can utilize the secure clock to synchronize the decryption of the encrypted content according to the one or more encryption keys. The local device and the local storage can be coupled via a home network. The home network and the content server can be coupled to the internet. The home network can be coupled to the internet via a broadband connection. The home network can comprise an ethernet network. The home network can comprise a wireless network. The one or more encryption keys can be stored at the content source as encrypted encryption keys. The content comprises audio, video, or image data.

In yet another aspect of the present invention, a device securely process content. The device comprises an input/output interface to receive a stream of encrypted content from a local storage and to receive a stream of one or more encryption keys from a content source, and a processing circuit coupled to the input/output interface to receive the stream of encrypted content and the stream of one or more encryption keys, and to decrypt the encrypted content according to the one or more encryption keys. The device can comprise a home server. The device can comprise a set-top box. The device can comprise a television. The local storage can reside within the device. The device can be coupled to an audio or display device, and the processing circuit sends the decrypted content to the audio or display device via the interface for playback. A secure clock can be utilized to synchronize the decryption of the encrypted content according to the one or more encryption keys. The secure clock can be located on the content source. The device can reside within a home network. The device can be coupled to the content source via the internet. The content comprises audio, video, or image data.

DETAILED DESCRIPTION OF THE EMBODIMENTS

Embodiments of the present invention provide for a system architecture that allows for seamless integration of content protection into an existing content delivery and playback system. The content protection system is designed to provide an end-to-end security solution for digital content preferably delivered over the Internet to a home server system and played back on a Client Network Module (CNM) device. The systems architecture is preferably independent of specific implementation technologies.

Content is preferably stored as ClearText by a content provider within a trusted area. Specific content is requested by an end user, preferably via a service provider, and the requested content is encrypted and then delivered over a secure communications channel to the home server system. While the encrypted content is stored on the home server system, the associated encryption keys are stored as a license with the content provider. When the CNM device on the home network system is instructed to play back the encrypted content, the encrypted content is streamed from local storage within the home server system while the associated encrypted keys are simultaneously streamed from the content provider to the CNM device. The main advantage of this type of content distribution system is that there is very limited real time demands placed on the Internet. Moreover, it is possible to deliver high bandwidth content over relatively lower bandwidth lines. In conventional streaming content delivery, the client and server must maintain a continuous high bandwidth link for the duration of the content. In embodiments of the present invention, no such requirements are placed on the system. Content provided by the content provider is preferably high bandwidth video entertainment such as movies.

Additional advantages of the content distribution system of the present invention include increased security and protection of content for copyright holders. Copyright holders are less likely to release content without sufficient technical protection. In summary, their requirements are: content must only be available for playback on licensed devices, content must only be available for the purchased license period, content must be protected so that it is unlikely to be inappropriately copied, and in the event that content is inappropriately copied, it must be traceable to the original transaction.

FIG. 2illustrates a content protection system according to the preferred embodiment of the present invention. The content protection system50includes a service provider100, a content provider200and a customer premises300. A function of the service provider100is to interact with the consumer and form a request that is sent to the content provider200for fulfillment. A customer is an end user associated with the customer premises300. The service provider100also accepts notifications from the content provider200that the consumer's request has been completed and bills the consumer. The service provider100, the content provider200and the customer premises300are each coupled to the Internet60.

The service provider100includes an e-commerce web site120and a billing server110. The web site120is a standard web site that validates the consumer, accepts the order, and sends the order to the content provider200for fulfillment. Functionality of the web site120preferably includes validating the consumer, formatting and signing the request of the consumer, validating the content provider200, and sending the request to the content provider200.

The billing server110performs billing of the customer as the final part of the fulfillment process. Since the service provider100does the billing, it is responsible for the relationship with the consumer. Billing should not occur until the content provider200informs the service provider100that the consumer has successfully obtained the content and license. Functionality of the billing server110preferably includes validating the content provider200and applying business rules included in the license to the satisfied request.

The content provider200is responsible for fulfilling the requests of the service provider100using the supplied credentials of the consumer. The content provider200includes a repository220, an encryption server230, a content server240, a license server250, and an associated database260. The repository220stores unencrypted content as ClearText.

The encryption server230is responsible for taking the request created by the service provider100and creating an experience out of it. Functionality of the encryption server230includes validating the service provider100, validating the request, validating the consumers' credentials, forming an association between the consumer and a playback device associated with the customer premises300, encrypting the requested content, using the playback device's public key to encrypt the license envelope, validating the content server240, validating the license server250, delivering the encrypted content to the content server240, and delivering the encrypted license to the license server250. The repository220and the encryption server230are secured within a trusted area210. The trusted area210is considered trusted as the repository220and the encryption server230preferably reside behind one or more separate firewall systems, and the encryption server230preferably requires double authentication connections from the service provider100. The service provider100is allowed to place requests for content with a playback device certificate that the content provider200can independently verify. It should be clear to those skilled in the art that other methods of providing a trusted area can be used.

The content protection system50is dependent on an association between the consumer, the playback device, and a home server within the consumer premises300. The home server includes a storage medium onto which the requested encrypted content is downloaded and stored. The association between the consumer, the playback device and the home server is preferably formed before the system allows the download and display of content. The consumer, the playback device and the home server are each given a unique certificate so the activity and authentications in the content protection system can be properly tracked. The playback device when manufactured is preferably provided with a signed digital certificate. Using this certificate, it is possible for the playback device to certify the consumer and the home server. The association database260includes the association, or linkage, between the consumer, playback device and home server. The association database260is responsible for creating this linkage as well as validating incoming requests (from the service provider100and content provider200), and providing the consumer, home server and playback device public credentials to valid requesters.

The content server240is a standard service that allows the home server to connect and download encrypted content that has been specified for it. Functionality of the content server240includes validating contentions from the home server, allowing the home server to download the encrypted content that has been made available to it, and sending notification to the billing server110that the encrypted content has been delivered to the consumer.

The license server250is a service that allows the playback device to connect and retrieve licenses. Functionality of the license server250includes validating connections from the playback device, delivering license to the playback device, and sending notification to the billing server110that the license has been delivered to the consumer.

The customer premises300is preferably the customer's home and includes a home network coupled to the Internet50via a broadband connection. The customer premises300includes a broadband router (BBR)310, the playback device330coupled to the BBR310, an analog playback device340coupled to the playback device330, and the home server320coupled to the BBR310. The BBR310is preferably coupled to the Internet50via broadband, such as a DSL or cable modem. Preferably, the BBR310operates in a default configuration that only allows communications to take place in one direction. The communication must be initiated from within the customer premises300. In general, this renders the BBR310as a secure “one-way” door into a network. The home server320is preferably a personal computer (PC) including a storage medium for storing encrypted content received from the content provider200. Alternatively, the home server320can be a dedicated device used for storage of the encrypted content. Alternatively, the home server320and/or the playback device330are coupled directly to the Internet50.

The playback device330is preferably a CNM based set-top box and the analog playback device340is a television. Alternatively, the playback device330is included within the analog playback device340such as an enhanced television or any other suitable analog playback device. Functionality of the playback device330includes validating the license server250, validating the home server320, decrypting the license envelope, decrypting the encrypted content, and decoding the content.

A block diagram of the internal components of an exemplary home server is illustrated inFIG. 3. As discussed above, the home server320is preferably a personal computer. The personal computer320includes a central processor unit (CPU)420, a main memory430, a video memory422, a mass storage device432and an Ethernet interface circuit428, all coupled together by a conventional bidirectional system bus434. The interface circuit428includes the physical interface circuit442for sending and receiving communications on the Ethernet in-home network. In the preferred embodiment of the present invention, the interface circuit428is implemented on an Ethernet interface card within the personal computer320. However, it should be apparent to those skilled in the art that the interface circuit428can be implemented within the personal computer320in any other appropriate manner, including building the interface circuit onto the motherboard itself. The mass storage device432stores the encrypted content received from the content server240(FIG. 2) and may include both fixed and removable media using any one or more of magnetic, optical or magneto-optical storage technology or any other available mass storage technology. The system bus434contains an address bus for addressing any portion of the memory422and430. The system bus434also includes a data bus for transferring data between and among the CPU420, the main memory430, the video memory422, the mass storage device432and the interface circuit428.

The personal computer320is also coupled to a number of peripheral input and output devices including the keyboard438, the mouse440and the associated display436. The keyboard438is coupled to the CPU420for allowing a user to input data and control commands into the personal computer320. A conventional mouse440is coupled to the keyboard438for manipulating graphic images on the display436as a cursor control device.

A port of the video memory422is coupled to a video multiplex and shifter circuit424, which in turn is coupled to a video amplifier426. The video amplifier426drives the display436. The video multiplex and shifter circuitry424and the video amplifier426convert pixel data stored in the video memory422to raster signals suitable for use by the display436.

FIG. 4illustrates an exemplary playback device according to the present invention. The playback device330is preferably a set-top box that includes the CNM module, where the set-top box is coupled to a television for display. Alternatively, the playback device330is combined with the analog playback device340such that the CNM module resides within a display device such as a television. The set-top box preferably controls the transmission of content from a local storage device such as personal computer (PC) to a television. The playback device330includes an input/output (I/O) interface510, a buffer520, a system memory530, a decoder540, and a central processing unit (CPU)550all coupled via a bi-directional bus560. The I/O interface510preferably couples the playback device330to the BBR310to receive encrypted content stored in the home server330and to receive associated encryption keys from the license server250(FIG. 2), and to the analog playback device340(FIG. 2) or other display device to display the content received from the home server320. It should be clear to those skilled in the art that the playback device330can be coupled to a device different than a PC for receiving encrypted content.

The system memory530stores the operating software used to enable operation of the playback device330. Any conventional type of memory can be used. The buffer520receives and buffers sequential portions of the streaming encrypted content from the home server320while simultaneously receiving and buffering the associated encryption key needed to decrypt the portion of the encrypted content. The portion of the encrypted content and the associated encryption key are sent to the decoder540. The decoder540decrypts and decodes the content according to access authorization associated with the encryption key. Preferably, multiple encryption keys are used to encrypt/decrypt the content such that each encryption key encrypts/decrypts a portion of the content. The encryption keys are streamed from the license server250to the playback device330as they are needed, not all at once. Preferably, the encryption keys are not stored in system memory530of the playback device330, only temporarily buffered in the buffer520. In this manner, security of the encryption keys is improved. Alternatively, a single encryption key is used to encrypt/decrypt the entire content.

The playback device330connects to the home server320to access the encrypted content and to the license server250to obtain access to the rights for the playback. The playback device330preferably only initiates connections and does not accept connections initiated from other devices. The encrypted content is decrypted by the playback device330in secure hardware and preferably outputs the content as analog, macrovision-protected video.

Functionality of the playback device330includes browsing capability, video playback, audio playback, and network configuration. The playback device330includes protocol stacks to allow for network connectivity with many different networking environments.

FIG. 5illustrates an operational diagram of the content protection system50illustrated inFIG. 2. There are several classes of connection in the content protection system50. The performance and characteristics of each of the connections depends upon the specific technology applied in each instance. The types of connections described below are the preferred connection types. It is understood by those skilled in the art that other types of communication connections can be used by the content protection system of the present invention.

The home server320is preferably coupled to the content server240over the broadband Internet connection. Preferably, this is a DSL or cable modem type connection with a minimum bandwidth of about 384 Kbits/sec.

The playback device330is preferably coupled to the home server330using the in-home network which may be wired or wireless. Preferably, the in-home network is Ethernet10base-T. The consumer accesses content that is stored on the home server320via the playback device330.

The playback device330is preferably coupled to the license server250over the broadband Internet connection. As the encrypted content is accessed on the home server320, the playback device330contacts the license server250to obtain the playback license and associated encryption keys for the encrypted content. The license server250preferably streams the license to the playback device330, as it is needed. Alternatively, the license may be downloaded and used once on the playback device330. The playback device330also from time to time connects to the license server250to obtain the current time in a secure fashion.

The web site120is preferably coupled to the encryption server230over a private network. After the consumer confirms their content request, the electronic commerce web site120contacts the encryption server230with the details of the request including the content id, requested license conditions, and consumer identification information. Preferably, the private network is contained within a business that is not accessible from the outside.

The web site120is preferably coupled to the association database260over a virtual private network (VPN). Identification credentials presented by the consumers are verified by the association database260. Preferably, the VPN is an encrypted network connection between two points on the Internet that allows the transmission of private data over a public medium.

The billing server110is preferably coupled to the association database260over the VPN. The playback device identification and the content identification data are presented to the billing server110. The billing server110asks the association database260for the billing information for the consumer associated with this playback device.

The encryption server230is preferably coupled to the content server240, to the license server250, and to the association database260over a private network. The encryption server230presents the consumers credentials and expects to receive the public keys for the playback device330and the home server320. After the content is watermarked and encrypted by the encryption server230, the encrypted content is delivered to the content server240. In a similar manner to the encrypted content, the encrypted license is delivered to the license server250.

The license server250is preferably coupled to the billing server110over the VPN. As the license is verified and downloaded to the playback device330, the billing cycle is started by the billing server110. The license server250provides the billing server110the identification of the playback device330and the identification of the content.

Encryption of the content is preferably done using the advanced encryption standard (AES). Each encryption key is associated with a portion of the content, where the size of each portion randomly varies. The resulting encryption key sequence is then encrypted with the public key of the playback device330.

As discussed above, the encryption server230encrypts and watermarks the content. Watermarking is a content protection mechanism used for a variety of purposes with digital content. The basic use of the watermarking is to discover pirated copies and claim copyright infringement. Watermarking is a process by which an electronic signature is added to content, making that content traceable back to the point where the watermark was added. Information related to the content ownership is embedded permanently and invisibly into the content. Watermarking is a separate field from encryption. However, it is desirable to combine the two by first watermarking the content and then encrypting it.

Preferably, a watermark is applied to the content before it is encrypted for a specific playback device so that in the event that a resulting clear text content is discovered “in the wild” it may be traced back to a particular transaction. Such functionality requires that each content delivery be uniquely watermarked and uniquely encrypted. Alternatively, only selected deliveries of content are watermarked, or watermarking is not performed at all within the content protection system of the present invention.

Licenses streamed to the playback device330preferably include a validity period. Once the validity period expires, the license is no longer valid. In general, clocks on systems are not trustworthy. To ensure that the playback device330accurately measures the validity period, the content protection system includes a design provision for a secure clock. Preferably, the playback device330is provided access to a secure clock residing on the license server250to obtain accurate time measurements. Alternatively, a secure distributed clock algorithm is used. Secure distributed clock algorithms ensure that the notion of time on the playback device is secure, and monotonically increasing, and on a regular basis are updated for accuracy.

In operation, a consumer makes a request for content to a service provider. The customer is preferably connected to the service provider over the Internet. In the request, the customer specifies content to be delivered and a playback device to which the content is to be delivered. The playback device preferably resides within a home network which includes a home server. The home server is preferably a personal computer. The service provider passes the request to a content provider where authentication and validation of the request are performed. Once the request is approved, the requested content is encrypted and stored on a content server, and a license including associated encryption keys are stored on a license server. Preferably, both the content server and the license server are operated by the content provider. Over the course of some time period, the encrypted content is transmitted to and stored on the home server to be used at a later date. The license remains at the license server. When the playback device initiates playback of the content, the encrypted content is streamed from the home server to the playback device, while the license and associated encryption keys are simultaneously streamed from the license server to the playback device. The playback device sequentially decrypts and decodes the streaming encrypted content using the encryption keys streamed from the license server. The playback device sends the content to an analog playback device. Security is enhanced since the encryption keys are not stored on the customer premises, the encryption keys are minimally out of the control of the content provider.

Although the content protection system of the present invention is described as a consumer initiating a content request from the customer premises, the consumer can also initiate a content request from a location other than the customer premises. In this case, the customer initiates a content request to a content provider, preferably via a service provider, from a location different than the customer premises and specifies the location of the customer premises to which the requested content is to be delivered.