Source: https://patents.google.com/patent/CA2797306C/en
Timestamp: 2018-08-16 22:27:27
Document Index: 202551836

Matched Legal Cases: ['Application No. 10', 'art\n6', 'art 210', 'art 220', 'art 230', 'art 240', 'art 250', 'art 260', 'art 270', 'art 280', 'art 240', 'art 220', 'art 220', 'art 240', 'art 270', 'art 270', 'art 240', 'art 230', 'art 230', 'art 250', 'art 240', 'art 260', 'art 260', 'art 260', 'art 230', 'art 310', 'art 310', 'art 320', 'art 320', 'art 330', 'art 330', 'art 310', 'art 320', 'art 340', 'art 350', 'art 360', 'art 310', 'art 330', 'art 360', 'art 360', 'art 320', 'art 340', 'art 340', 'art 340', 'art 340', 'art 330', 'art 340', 'art 340', 'art 360', 'art 340', 'art 320', 'art 340', 'art 360', 'art 340', 'art 360', 'art 360', 'art 360', 'art 360', 'art 320', 'art 360']

CA2797306C - Security processing system and method for http live streaming - Google Patents
CA2797306C
CA2797306C CA 2797306 CA2797306A CA2797306C CA 2797306 C CA2797306 C CA 2797306C CA 2797306 CA2797306 CA 2797306 CA 2797306 A CA2797306 A CA 2797306A CA 2797306 C CA2797306 C CA 2797306C
CA 2797306
CA2797306A1 (en )
Disclosed are a security processing system and method for HLS transmissions.
An aspect of the invention provides a content key conversion device connected over a network to a content proxy device configured to provide encryption key information to a content operating device for a content received from a content provider device of an external network. The content key conversion device includes: a reception part that receives a double encryption key of a content from the content proxy device;
an interface part that receives key decryption information corresponding to the double encryption key from an encryption key provider device of an external network;
a decryption part that decrypts the double encryption key of the content using the key decryption information and thereby converts the double encryption key to an encryption key; and a transmission part that transmits the encryption key converted by the decryption part to the content proxy device.
SECURITY PROCESSING SYSTEM AND METHOD
FOR HTTP LIVE STREAMING
This application claims the benefit of Korean Patent Application No. 10-2011-0127363, filed with the Korean Intellectual Property Office on November 30, 2011, the disclosure of which is incorporated herein by reference in its entirety.
1. Technical Field The present invention relates to a security processing system, more particularly to a security processing system and method for HLS transmissions.
2. Description of the Related Art Streaming refers to transmitting contents such as video or audio contents from a server to a client over a network such as the Internet. The term "streaming"
was derived based on the observation that the transmitted data flows like a stream. The server separates a video content into packets that can be sent over a network, and the client assembles the packets and restores the original form before replay the video content. Here, the replaying of the content and the receiving of the packets occur concurrently, and the series of associated packets are referred to as a "stream".
Streaming, which involves replaying a content while the client is downloading it, is distinguished from a simple file transfer, which involves first receiving the entire video content and replaying the video afterwards. The client replays the content while receiving packets from the server, and then deletes the replayed data. A few examples of protocols for streaming files include the H'TTP (Hypertext Transfer Protocol), FTP (File Transfer Protocol), RTP (Real-time Transport Protocol), RTSP (Real Time Streaming Protocol), HLS (H'TTP Live Streaming), etc. Here, HTTP and FTP are essentially file transfer protocols, while RTP and RTSP are protocols for real-time file streaming.
3 It has been pointed out, however, that there is a problem in content security, because when a content supported by 1-ILS is encrypted, the key information used in the content encryption is transmitted to a terminal together with the content information, and the key information can be easily extracted for decrypting the encrypted content. To complement this problem, it has been proposed to use HTTPS when transmitting the key information, but while HTTPS allows user authentication, it does not allow content authentication. As it is impossible to authenticate contents even when providing security by way of HTTPS, there is a need for content-based security, such as for controlling viewing authorization per content.
An aspect of the invention provides a content key conversion device connected over a local network to a content proxy device configured to provide encryption key information to a content operating device for a content received from a content provider
4 device of an external network. The content key conversion device includes: a reception part configured to receive a double encryption key of a content from the content proxy device; an interface part configured to receive key decryption information corresponding to the double encryption key from an encryption key provider device of an external network; a decryption part configured to decrypt the double encryption key of the content using the key decryption information and thereby convert the double encryption key to an encryption key; and a transmission part configured to transmit the encryption key converted by the decryption part to the content proxy device.
5 The metadata of the key-encryption key can be recorded in the form of an annotation recognizable by the content key conversion device and the encryption key provider device.
Another aspect of the invention provides a content proxy device located in a local network. The content proxy device includes: a terminal connector part configured to connect with a content operating device over a local network and to receive a content request signal from the content operating device; a communication part configured to connect with a content provider device of an external network and receive a double encryption key of an encrypted content from the content provider device based on the content request signal received from the content operating device; a storage part configured to store the double encryption key received from the content provider device; a device connector part configured to transmit the double encryption key of the encrypted content to a content conversion device of the local network and to receive an encryption key, which may be obtained by decrypting the double encryption key of the encrypted content, from the content key conversion device; and a transmission part
6 configured to transmit the encryption key converted by the content key conversion device to the content operating device.
7 The content proxy device can further include an address conversion part configured to convert the address information of the encryption key to local address information, upon receiving the encryption key from the content key conversion device;
and an index file generator part configured to generate a third index file including the address information of the encrypted content and the local address information, where the terminal connector part can transmit the third index file to the content operating device.
Yet another aspect of the invention provides an HLS-based content provider device connected with a content proxy device over an external network. The content provider device includes: a first index file generator part configured to generate a first index file, which may include the address information of an encrypted content encrypted using an encryption key and the address information of the encryption key for decoding the encrypted content; a second index file generator part configured to generate a second index file, which may include the address information of the encrypted content, the address information of a double encryption key obtained by double-encrypting the encryption key using a key-encryption key, and the metadata of the key-encryption key; and a transmission part configured to receive a content provision request from the content proxy device over an external network and transmit a
8 second index file corresponding to a content requested by a user, where the content proxy device is configured to transmit at least one of a double encryption key obtained by using the double encryption key address and the key-encryption key metadata for decrypting the double encryption key included in the second index file to a content key conversion device connected over a local network, and is configured to receive from the content key conversion device an encryption key, which may be obtained by decrypting the double encryption key of the encrypted content.
9 BRIEF DESCRIPTION OF THE DRAWINGS
FIG 2 is a block diagram illustrating the content proxy device of an HLS-based security processing system according to an embodiment of the invention.
FIG 4 and FIG. 5 are flow diagrams illustrating an HLS-based security processing method according to an embodiment of the invention.
The principles of the HLS-based security processing system and method according to certain aspects of the invention will be described below in more detail with reference to the accompanying drawings, using specific embodiments as examples.
However, the drawings and detailed descriptions illustrate just one possible embodiment from among numerous embodiments to effectively describe the features of the invention.
As such, the invention should not be understood as being limited to the drawings and descriptions that follow.
In the description of the invention set forth below, certain specific explanations of well-known functions or elements will be omitted if they are deemed to unnecessarily
10 obscure the essence of the invention. The terminology used in the following include terms which were defined in consideration of the functions associated with the invention and which may change according to the intentions of the user or operator or according to custom, etc. The definitions of the terms should therefore be determined based on the overall concept of the invention.
11 FIG. 1 is a diagram schematically illustrating an HLS-based security processing system according to an embodiment of the invention.
Referring to FIG 1, the HLS-based security processing system may have a content operating device 150, a content proxy device 200, and a content key conversion device 300 connected over a local network 130. The HLS-based security processing system may connect with a content provider device 110 and an encryption key provider device 120 formed in an external network 100.
The content provider device 110 may store and manage contents for providing VOD and real time broadcasts requested by the content operating device 150.
More specifically, in order to provide security for the contents, the content provider device 110 may encrypt a content based on an encryption key provided by the encryption key provider device 120 and thus convert it into an encrypted content. Here, the encrypted content can be a DRM (Digital Rights Management) content. The content provider device 110 may store the converted encrypted content. Here, the content provider device 110 can store the encrypted content by dividing it into data blocks of a particular size.
The content provider device 110 may be located in an external network 100 and may connect with the content operating device 150 located in a local network to receive requests for contents from the content operating device 150. The content provider device 110 may transmit the requested content to the content operating device 150.
12 In order to transmit the encryption key to the content proxy device 200, the content provider device 110 may again encrypt the encryption key and thus generate a double encryption key. The content provider device 110 may transmit the double encryption key to the content proxy device 200.
The content provider device 110 according to an embodiment of the invention may again encrypt the encryption key to generate a double encryption key, where a key-
13 encryption key can be used to convert the encryption key into the double encryption key.
Here, an index file can be defined as a playlist in that it includes information by which the content operating device 150 may replay contents. Although the description here uses an example in which just one content provider device 110 is present, the invention is not thus limited, and a multiple number of content provider devices 110 can
14 be included, depending on the type of content or the content-providing company, etc., with the content proxy device 200 connecting to and receiving a content from a corresponding content provider device 110 according to the content requested by the user.
The content key conversion device 300 may cooperate with the encryption key
15 provider device 120 to decrypt the double encryption key into the encryption key.
The content key conversion device 300 may use the key decryption information to convert the double encryption key into the encryption key and may
16 transmit the converted encryption key to the content proxy device 200.
The content operating device 150 may parse the third index file to receive the encrypted content from the content provider device 110 and may receive the encryption key from the content proxy device 200 to replay the content. In this way, the content
17 operating device 150 may receive a request for a content from a user and may display the requested content. Here, the content can be any one of various types of multimedia including broadcast programs such as movies, dramas, news, music videos, and commercials, still images such as photographs, music files, etc. In a specific example, the content operating device 150 may display a user interface (UI) screen that includes a multiple number of contents which the user may choose from. For example, the content operating device 150 can display a user interface screen including the highlight scenes, titles, authors, etc., of the contents. When a user selects one of the contents shown on the user interface screen, the content operating device 150 may transfer the content request information for the selected content to the content proxy device 200.
The content request information can be IP information or URL information of the content provider device 110 that provides the content selected by the user. The content request information can further include content identification information for identifying the content requested by the user.
As described above, the content operating device 150 may receive an encryption key from the content proxy device 200. The content operating device
18 may use the encryption key to decrypt the encrypted content received from the content provider device 110 and convert it into the content. The content operating device 150 may display the converted content. Here, the content operating device 150 can display the content by way of a multimedia player. Here, the multimedia player may be a module capable of operating and displaying the content.
The content proxy device 200 may store the received double encryption key.
The content proxy device 200 may transmit the double encryption key to the content key conversion device 300 to receive the encryption key, obtained by decrypting the double encryption key. The content proxy device 200 may transmit the encryption key to the content operating device 150. The content proxy device 200 will be described below in more detail with reference to FIG. 2.
19 The content key conversion device 300 may manage the key decryption information for decrypting the double encryption key. In other words, the content key conversion device 300 may receive the key decryption information for the content from the encryption key provider device 120 of the external network 100 and store the key decryption information. The content key conversion device 300 may receive the double encryption key of the content from the content proxy device 200. Also, the content key conversion device 300 may decrypt the double encryption key using the key decryption information to convert the double encryption key into the encryption key. The content key conversion device 300 may transmit the encryption key to the content proxy device 200. The content key conversion device 300 will be described below in more detail with reference to FIG. 3.
Referring to FIG. 2, the content proxy device 200 may include a terminal
20 connector part 210, a communication part 220, an address conversion part 230, a first control part 240, a device connector part 250, a transmission part 260, a first storage part 270, and an index file generator part 280.
21 The double encryption key can also be received from the encryption key provider device 120.
For example, the first control part 240 can control the communication part 220 to connect with the content provider device 110 based on the content request information. When the double encryption key is received by way of the communication part 220, the first control part 240 can control the first storage part 270 to store the received double encryption key in the first storage part 270. The first control part 240 can control the address conversion part 230 to convert the address of the encryption key
22 at the address conversion part 230. When the encryption key is received by way of the device connector part 250, the first control part 240 can control the transmission part 260 to transmit the received encryption key to the content operating device 150.
The transmission part 260 may transmit data to the content operating device 150. In other words, the transmission part 260 can transmit to the content operating device 150 a third index file, including the local address information for the encryption key converted at the address conversion part 230 and the encrypted content address information. Here, the content operating device 150 can connect to the content proxy
23 device 200 based on the local address information to request an encryption key for decrypting the encrypted content.
The interface part 310 may connect with the encryption key provider device
24 120 located in an external network 100 to receive data from the encryption key provider device 120. That is, the interface part 310 may request the encryption key provider device 120 for key decryption information needed for decrypting the double encryption key.
The reception part 320 may connect with the content proxy device 200 to receive data from the content proxy device 200. In other words, the reception part 320 may receive the double encryption key of the encrypted content from the content proxy device 200 in order to request a decryption of the double encryption key.
Here, the double encryption key can include a double encryption key for one or multiple data blocks of a particular size into which the encrypted content may be divided.
The second control part 330 may control the overall operation of the content key conversion device 300. That is, the second control part 330 may serve to control the components of the content key conversion device 300 such as the interface part 310, reception part 320, decryption part 340, transmission part 350, and second storage part 360.
25 For example, when the key decryption information is received by way of the interface part 310, the second control part 330 can control the second storage part 360 to store the key decryption information in the second storage part 360 in a matching relationship with the content identification information. When the double encryption key is received by way of the reception part 320, the second control part can control the decryption part 340 such that the double encryption key is provided to the decryption part 340 and the double encryption key is decrypted at the decryption part 340. When the double encryption key is decrypted into the encryption key at the decryption part 340, the second control part 330 can provide the control for transmitting the encryption key to the content proxy device 200.
The decryption part 340 may decrypt the double encryption key into the encryption key. In other words, the decryption part 340 may search the content identification information, received together with the double encryption key, in the second storage part 360, extract the same content identification information, and then extract the key decryption information matching the content identification information.
The decryption part 340 may decrypt the double encryption key received from the content proxy device 200 based on the extracted key decryption information and convert it into the encryption key. A reason for converting a double encryption key into an encryption key in this manner is to convert the double encryption key into the encryption key, which is the information necessary for decrypting the encrypted content.
26 In cases where only content identification information is received from the content proxy device 200 via the reception part 320, the decryption part 340 may extract the key decryption information and double encryption key matching the content identification information in the second storage part 360. The decryption part 340 may decrypt the extracted double encryption key based on the key decryption information and convert it into the encryption key.
The second storage part 360 may store various programs for controlling the overall operation of the content key conversion device 300 as well as various data generated by or obtained for executing the programs. For example, the second storage part 360 can store the key decryption information of the encrypted content received from the encryption key provider device 120 and the double encryption key. The second storage part 360 can also store the key decryption information in a matching relationship with the content identification information. The second storage part 360 can store the double encryption key received by way of the reception part 320. The second
27 storage part 360 can store the encryption key obtained by the decryption part decrypting the double encryption key.
Referring to FIGs. 4 and 5, when a user requests a content, the content
28 operating device 150 may generate content request information regarding the content requested by the user (step 400).
The content proxy device 200 may parse the second index file received from
29 the content provider device 110 and may store the double encryption key obtained using the double encryption key address information (412). Here, the content proxy device 200 can store a double encryption key for each data block of a particular size to which the encrypted content may be divided.
Referring to FIG 5, the content proxy device 200 may convert the address information of the encryption key received from the content key conversion device 300 to generate a third index file (500).
As described above, the content proxy device 200 may convert the encryption key address information of the second index file into its local address information, and
30 may generate a third index file that includes the local address information converted as above and the encrypted content's address information.
31 While the spirit of the invention has been described in detail with reference to particular embodiments, a person skilled in the art would understand that numerous variations and modifications can be conceived without departing from the spirit and scope of the invention defined by the claims appended below.
a reception part configured to receive a double encryption key of an encrypted content and metadata of a key-encryption key used to convert an encryption key into the double encryption key from a content proxy device, the encrypted content being provided by a content provider device of an external network;
an interface part configured to receive the key-encryption key by using address information included in the metadata of the key-encryption key from an encryption key provider device of the external network;
a decryption part configured to decrypt the double encryption key of the content by using the key-encryption key and thereby convert the double encryption key to the encryption key; and a transmission part configured to transmit the encryption key converted by the decryption part to the content proxy device, wherein the content key conversion device is connected over a local network to the content proxy device, and the content proxy device is connected over the local network to a content operating device on which the encrypted content is consumed by a user, and transmits the encryption key to the content operating device.
generate a first index file, the first index file including address information of the encrypted content and address information of the encryption key for decrypting the encrypted content, generate a second index file based on the first index file, the second index file including at least one of address information of the encrypted content, address information of a double encryption key obtained by double-encrypting the encryption key using a key-encryption key, and metadata of the key-encryption key, and upon receiving a request to replay a content from a user, transmit the second index file of the requested content to the content proxy device.
5. A content proxy device located in a local network, the content proxy device comprising:
a terminal connector part configured to connect with a content operating device over the local network and to receive a content request signal from the content operating device;
a communication part configured to connect with a content provider device of an external network and receive a double encryption key of an encrypted content and metadata of a key-encryption key used to convert an encryption key into the double encryption key from the content provider device based on the content request signal received from the content operating device;
a storage part configured to store the double encryption key and the metadata received from the content provider device;
a device connector part configured to transmit the double encryption key of the encrypted content to a content key conversion device of the local network and to receive the encryption key from the content key conversion device, the encryption key obtained by decrypting the double encryption key of the encrypted content; and a transmission part configured to transmit the encryption key converted by the content key conversion device to the content operating device on which the encrypted content is consumed by a user, wherein the content key conversion device receives the key-encryption key by using address information included in the metadata of the key-encryption key from an encryption key provider device of the external network.
6. The content proxy device of claim 5, wherein the encrypted content is divided into data blocks of a particular size, and the storage part stores double encryption key information for each of the data blocks having a particular size.
7. The content proxy device of claim 5, wherein the content provider device is configured to:
generate a first index file, the first index file including address information of the encrypted content and address information of the encryption key for decrypting the encrypted content, and generate a second index file based on the first index file, the second index file including at least one of address information of the encrypted content, address information of a double encryption key obtained by double-encrypting the encryption key using a key-encryption key, and metadata of the key-encryption key.
8. The content proxy device of claim 7, wherein the communication part receives the second index file of a content requested by the user, and the device connector part transmits to the content key conversion device the double encryption key obtained using the double encryption key address and the key-encryption key metadata for decrypting the double encryption key included in the second index file.
9. The content proxy device of claim 7, wherein the metadata of the key-encryption key is recorded in a form of an annotation recognizable by the content key conversion device and the encryption key provider device.
10. The content proxy device of claim 7, further comprising:
an address conversion part configured to convert address information of the encryption key to local address information, upon receiving the encryption key from the content key conversion device; and an index file generator part configured to generate a third index file including address information of the encrypted content and the local address information, wherein the terminal connector part transmits the third index file to the content operating device.
11. The content proxy device of claim 10, wherein the terminal connector part transmits an encryption key requested by the content operating device through the local address information.
1 2. An HLS-based content provider device connected with a content proxy device over an external network, the content provider device comprising:
a second index file generator part configured to generate a second index file, the second index file including the address information of the encrypted content, address information of a double encryption key obtained by double-encrypting the encryption key using a key-encryption key, and metadata of the key-encryption key; and a transmission part configured to receive a content provision request from the content proxy device over an external network and transmit a second index file corresponding to a content requested by a user, wherein the content proxy device is configured to transmit at least one of a double encryption key obtained by using the double encryption key address and the metadata of the key-encryption key for decrypting the double encryption key included in the second index file to a content key conversion device connected over a local network, and receive the encryption key from the content key conversion device, the encryption key obtained by decrypting the double encryption key of the encrypted content, and transmit the encryption key to a content operating device on which the encrypted content is consumed by the user, the content proxy device being connected over the local network to the content operating device, and the content key conversion device receives the key-encryption key using address information included in the metadata of the key encryption key from the encryption key provider device of the external network.
13. A content key conversion device comprising:
a reception part that receives a double encryption key of an encrypted content from a content proxy device, the encrypted content being provided by a content provider device of an external network;
an interface part that receives a key-encryption key corresponding to the double encryption key from an encryption key provider device of the external network;
and a transmission part that transmits an encryption key, converted by decrypting the double encryption key of the encrypted content using the key-encryption key, to the content proxy device, wherein the content key conversion device is connected over a local network to the content proxy device, the content proxy device is connected over the local network to a content operating device on which the encrypted content is consumed by a user and transmits the encryption key to the content operating device, the reception part receives metadata of the key-encryption key from the content proxy device, the interface part receives the key-encryption key from the encryption key provider device using address information included in the metadata of the key-encryption key, and the content provider device is configured to:
generate a first index file, the first index file including address information of the encrypted content and address information of the encryption key for decrypting the encrypted content, generate a second index file based on the first index file. the second index file including address information of the encrypted content, address information of a double encryption key obtained by double-encrypting the encryption key using a key-encryption key, and metadata of the key-encryption key, and upon receiving a request to replay a content from the user, transmit the second index file of the requested content to the content proxy device.
The content key conversion device of claim 13, wherein the content provided by the content provider device is provided as data blocks of a particular size, and the key decryption information is provided for each data block or for each group of data blocks.
15. The content key conversion device of claim 14, wherein the metadata of the key-encryption key is recorded in a form of an annotation recognizable by the content key conversion device and the encryption key provider device.
16. A content proxy device located in a local network, the content proxy device comprising:
a device connector part that transmits the double encryption key of the encrypted content and the metadata of the key-encryption key to a content key conversion device of the local network and receives an encryption key from the content key conversion device, the encryption key obtained by decrypting the double encryption key of the encrypted content; and a transmission part that transmits the encryption key converted by the content key conversion device to the content operating device on which the encrypted content is consumed by a user, wherein the content key conversion device receives the key-encryption key from the encryption key provider device using address information included in the metadata of the key-encryption key, and the content provider device is configured to:
generate a first index file, the first index file including address information of the encrypted content and address information of the encryption key for decrypting the encrypted content, generate a second index file based on the first index file, the second index file including address information of the encrypted content, address information of a double encryption key obtained by double-encrypting the encryption key using a key-encryption key, and metadata of the key-encryption key, and upon receiving a request to replay a. content from the user, transmit the second index file of the requested content to the content proxy device.
17. The content proxy device of claim 16, wherein the encrypted content is divided into data blocks of a particular size, and the storage part stores double encryption key information for each of the data blocks having a particular size.
18. The content proxy device of claim 16, wherein the communication part receives the second index file from the content provider device, and the device connector part transmits to the content key conversion device the double encryption key obtained using the double encryption key address and the key-encryption key metadata for decrypting the double encryption key included in the second index file.
19. The content proxy device of claim 16, wherein the metadata of the key-encryption key is recorded in a form of an annotation recognizable by the content key conversion device and the encryption key provider device.
20. The content proxy device of claim 16, further comprising:
21 . The content proxy device of claim 20, wherein the terminal connector part transmits an encryption key requested by the content operating device through the local address information.
An HLS-based content provider device connected with a content proxy device over an external network, the content provider device comprising:
a second index file generator part that generates a second index file, the second index file including the address information of the encrypted content, address information of a double encryption key obtained by double-encrypting the encryption key using a key-encryption key, and metadata of the key-encryption key; and a transmission part that receives a content provision request from the content proxy device over the external network and transmits the second index file corresponding to a content requested by a user, wherein the content proxy device is configured to transmit at least one of the double encryption key and the metadata of the key-encryption key for decrypting the double encryption key included in the second index file to a content key conversion device connected over a local network, receive the encryption key from the content key conversion device, the encryption key obtained by decrypting the double encryption key of the encrypted content, and transmit the encryption key to a content operating device on which the encrypted content is consumed by the user, the content proxy device being connected over the local network to the content operating device, and the content key conversion device receives the key-encryption key from the encryption key provider device using address information included in the metadata of the key-encryption key.
CA 2797306 2011-11-30 2012-11-29 Security processing system and method for http live streaming Active CA2797306C (en)
CA2797306A1 true CA2797306A1 (en) 2013-05-30
CA2797306C true CA2797306C (en) 2017-11-14
CA 2797306 Active CA2797306C (en) 2011-11-30 2012-11-29 Security processing system and method for http live streaming