Extending data confidentiality into a player application
In a content protection scheme, and in response to a request for a content segment received by a server, the server generates and associates with the segment a message that confers entitlement to a session-specific key from which one or more decryption keys may be derived. The decryption keys are useful to decrypt the segment at runtime as it is about to be rendered by a player. Before delivery, the server encrypts the segment to generate an encrypted fragment, and it then serves the encrypted fragment (and the message) in response to the request. At the client, information in the message is used to obtain the session-specific key. Using that key, the decryption keys are derived, and those keys are then used to decrypt the received encrypted fragment. The decryption occurs at runtime. The approach protects content while in transit to and at rest in the client browser environment.
1. An apparatus associated with an edge network, comprising:
a processor;
computer memory holding computer program instructions executed by the processor to perform content protection, the computer program instructions comprising:
program code operative in response to a request for a segment of content to generate and associate with the segment a message that includes a first public portion and a second private portion, the first public portion holding a token-protected URL that confers entitlement by a client player to a session-specific key, the second private portion holding a cryptographic parameter encrypted with the session-specific key;
program code operative to encrypt the segment of content to create an encrypted fragment;
program code operative to serve the encrypted fragment and the message in response to the request;
program code operative to receive a request for the session-specific key, the request for the session-specific key having been issued by the client player following parsing by the client player of the message for the segment;
program code operative to generate the session-specific key; and
program code operative to return the session-specific key to the client player to enable the client player to derive one or more decryption keys as the segment is being rendered by the client player.
2. The apparatus as described in claim 1 wherein the message is associated with the segment of content by one of: placement within a media container, placement within a customer header preceding a first byte of encrypted fragment, and by placement in a distinct transport stream.
3. The apparatus as described in claim 1 wherein the session-specific key is an ephemeral key.
4. The apparatus as described in claim 1 wherein the encrypted fragment and the message are served to the client player over an SSL connection.
5. The apparatus as described in claim 1 wherein the segment of content represents a time slice of contiguous video and audio data of a configurable length at a discrete bitrate.
6. An apparatus associated with a client machine, comprising:
a processor;
player code;
computer memory holding computer program instructions executed by the processor as a security module that executes in association with the player code, the computer program instructions comprising:
program code operative to generate a request for a segment of content;
program code operative to receive from a server an encrypted fragment, the encrypted fragment having a message associated therewith, the message conferring entitlement to a session-specific key, wherein the message includes a first public portion, and a second private portion, the first public portion holding a URL to the session-specific key, and the second private portion holding a cryptographic parameter encrypted by the session-specific key;
program code operative to use information in the message to issue to the server a request to obtain the session-specific key;
program code operative to receive from the server the session-specific key, the session-specific key having been generated at a server in response to receipt at the server of the request to obtain the session-specific key;
program code operative to derive, from the session-specific key, one or more decryption keys; and
program code operative to decrypt, using the one or more decryption keys, the received encrypted fragment, the decryption occurring as the segment is rendered by the player code.
7. The apparatus as described in claim 6 wherein the encrypted fragment and the message are received by the client player over an SSL connection.
8. The apparatus as described in claim 6 wherein the segment of content represents a time slice of contiguous video and audio data of a configurable length at a discrete bitrate.
9. The apparatus as described in claim 6 wherein the session-specific key is an ephemeral key.