Encryption management, content recording management, and playback management in a network environment
Management of key information as described herein enables a respective service provider to distribute encrypted content to subscribers, preventing improper use of the content without authorization. For example, the service provider can distribute encrypted content for recording by a subscriber at a remote location. At or around a time of recording the encrypted content, and on behalf of the user, the service provider initiates storage of the corresponding decryption information that is needed to decrypt the recorded encrypted content. In order to play back the recorded segments of the encrypted content, the subscriber communicates with a server resource to be authenticated. Subsequent to being authenticated, the server resource distributes a copy of decryption information needed to decrypt the previously recorded segments of encrypted content to the subscriber. Accordingly, the service provider retains control of playing back content via controlled distribution of the corresponding copy of decryption information.
1. A method comprising:
via computer processor hardware in a network including a client device and a server resource that serves data to the client device:
retrieving segments of encrypted content as specified by first content access information, the first content access information further specifying resources from which to retrieve original decryption keys to decrypt the segments of encrypted content;
storing the segments of encrypted content in a first repository associated with the client device for later retrieval;
retrieving the original decryption keys;
in a second repository accessible to the client device, storing copies of the original decryption keys for later retrieval, the second repository disparately located with respect to the first repository, the copies of the original decryption keys available to decrypt the encrypted segments of content stored in the first repository; and
deriving second content access information to specify locations of the copies of the original decryption keys in the second repository, the second content access information providing mapping between the stored segments of encrypted content in the first repository and corresponding copies of the original decryption keys in the second repository.
2. The method as in claim 1 , wherein the encrypted segments of content is content selected for recording by a user in a subscriber domain of a cable network environment in which the client device resides, the selected content scheduled for distribution in a particular timeslot.
3. The method as in claim 1 further comprising:
retrieving the first content access information in response to receiving selection of particular content for recording and subsequent playback at a later time; and
producing the second content access information in response to receiving a request to record the particular content.
4. The method as in claim 1 , wherein the segments of encrypted content includes a first segment of encrypted content and a second segment of encrypted content, a first decryption key assigned to the first segment of encrypted content, the first decryption key configured to decrypt the first segment of encrypted content, a second decryption key assigned to the second of segment of encrypted content, the second decryption key configured to decrypt the second segment of encrypted content.
5. The method as in claim 4 , wherein storing copies of the original decryption keys further comprises:
retrieving the first decryption key from storage;
storing a copy of the first decryption key at a first location in the second repository;
retrieving the second decryption key from storage; and
storing a copy of the second decryption key at a second location in the second repository.
6. The method as in claim 5 further comprises:
producing the second content access information to indicate a location of the first segment of encrypted content and the second segment of encrypted content stored in the first repository;
producing the second content access information to further indicate the first location from which a copy of the first decryption key is retrievable from the second repository, the second content access information mapping the first decryption key to the first segment of encrypted content; and
producing the second content access information to further indicate a second location from which a copy of the second decryption key is retrievable from the second repository, the second content access information mapping the second decryption key to the second segment of encrypted content.
7. The method as in claim 1 further comprising:
in response to receiving a command to play back the stored segments of encrypted content in the first repository:
utilizing the second content access information to identify an ordering of playing back renditions of the stored segments of encrypted content;
utilizing the second content access information to identify locations of the copies of original decryption keys corresponding to the stored segments of encrypted content; and
retrieving the copies of original decryption keys from the locations as specified by the second content access information.
8. The method as in claim 1 further comprising:
at the client device, as specified by the second content access information:
i) initiating retrieval of the stored segments of encrypted content from the first repository, the first repository located in a subscriber domain in which the client device resides;
ii) establishing a secured communication link to access the second repository; and
iii) initiating retrieval of the copies of original decryption keys from the second repository over the secured communication link.
9. The method as in claim 8 , wherein the client device requires authorization from a content distribution service provider providing access to the encrypted segments of content to access the copies of the original decryption keys from the second repository upon a subsequent request by the client device to playback a rendition of the encrypted segments of content stored in these first repository.
10. The method as in claim 1 , wherein the copies of the original decryption keys are available from the second repository after the original decryption keys become unavailable for retrieval by the client device.
11. The method as in claim 1 further comprising:
retrieving the original decryption keys and storing the copies of the original decryption keys in the second repository in anticipation of the client device requesting playback of the segments of encrypted content stored in the first repository.
12. The method as in claim 1 further comprising:
retrieving the original decryption keys and storing the copies of the original decryption keys in the second repository in response to detecting retrieval and storage of the segments of encrypted content to the first repository for later playback by the client device.
13. The method as in claim 1 , wherein the second repository is a remotely located resource accessible to the client device subsequent to authentication of the client device to access the copies of the original decryption keys stored in the second repository through the server resource, the server resource operable to serve the copies of the original decryption keys to the client device.
14. The method as in claim 1 , wherein retrieving segments of encrypted content includes retrieving the segments of encrypted content from a first location in which the segments of encrypted content are stored, the first repository disparately located with respect to the first location from which the segments of encrypted content are retrieved; and
wherein retrieving the original decryption keys includes retrieving the original decryption keys from a second location in which the original decryption keys are stored, the second repository disparately located with respect to the second location from which the original decryption keys are retrieved.
15. The method as in claim 14 , wherein the copies of the original decryption keys are available from the second repository after the original decryption keys become unavailable for retrieval by the client device.
16. The method as in claim 1 , wherein the copies of the original decryption keys includes a copy of a first decryption key and a copy of a second decryption key, the copy of the first decryption key assigned to decrypt a first encrypted segment of content stored in the first repository, a copy of the second decryption key assigned to decrypt a second encrypted segment of content stored in the first repository.
17. The method as in claim 1 further comprising:
storing the segments of encrypted content in the first repository and storing copies of the original decryption keys for later retrieval in response to receiving input from a subscriber having access to the segments of encrypted content as specified by first content access information.
18. A method comprising:
via computer processor hardware in a playback device:
receiving a request to playback segments of encrypted content stored in a first repository, the stored segments of encrypted content previously retrieved using first content access information indicating: i) first locations from which to retrieve the segments of encrypted content and ii) corresponding original decryption keys to decrypt the segments of encrypted content;
in response to receiving the request from the subscriber, retrieving second content access information; and
utilizing the second content access information to identify second locations from which to retrieve the stored segments of encrypted content in the first repository and copies of the corresponding original decryption keys from a second repository, the second repository disparately located with respect to the first repository, the second content access information providing mapping between the stored segments of encrypted content in the first repository and copies of the corresponding original decryption keys in the second repository.
19. The method as in claim 18 further comprising:
prior to receiving the request to playback stored segments of encrypted content, receiving input from the subscriber requesting to record the content, the segments of encrypted content previously retrieved by the playback device on behalf of the subscriber using the first content access information, the first content access information used to identify the first locations in order to store the copies of the corresponding original decryption keys to the second locations.
20. The method as in claim 19 further comprising:
applying retrieved copies of the corresponding original decryption keys to the retrieved stored segments of encrypted content to play back the content on the playback device.
21. The method as in claim 18 , wherein the copies of the corresponding original decryption keys are stored at a remote location with respect to the playback device, the method further comprising:
communicating credentials to an authentication server resource operated by a content distribution service provider making the segments of encrypted content available to the subscriber; and
subsequent to authentication of the subscriber by the authentication server resource, receiving the copies of the original decryption keys associated with the stored segments of encrypted content previously retrieved on behalf of the subscriber.
22. The method as in claim 21 , wherein the received copies of the original decryption keys are encrypted, the method further comprising:
receiving decryption information from a server resource over a network connection; and
applying the decryption information to the received copies of the original decryption keys.
23. A computer system comprising:
a first repository;
computer processor hardware operable to:
retrieve segments of encrypted content as specified by first content access information, the first content access information further specifying resources from which to retrieve original decryption keys to decrypt the segments of encrypted content;
store the segments of encrypted content in the first repository associated with a client device for later retrieval; and
in a second repository accessible to the client device, store copies of the original decryption keys for later retrieval to decrypt the encrypted segments of content, the second repository disparately located with respect to the first repository; and
derive second content access information to specify locations of the copies of the original decryption keys in the second repository, the second content access information providing mapping between the stored segments of encrypted content in the first repository and corresponding copies of the original decryption keys in the second repository.
24. The computer system as in claim 23 , wherein the segments of encrypted content includes a first grouping of multiple segments of encrypted content and a second grouping of multiple segments of encrypted content, a first decryption key assigned to the first grouping of segments of encrypted content, the first decryption key configured to decrypt the first grouping of segments of encrypted content, a second decryption key assigned to the second grouping of segments of encrypted content, the second decryption key configured to decrypt the second grouping of segments of encrypted content.
25. The computer system as in claim 24 , wherein the computer processor hardware is further operable to:
retrieve a copy of the first decryption key;
store a copy of the first decryption key at a first location in the second repository;
retrieve a copy of the second decryption key; and
store a copy of the second decryption key at a second location in the second repository.
26. The computer system as in claim 24 , wherein the computer processor hardware is further operable to:
produce the second content access information to indicate locations of the first grouping of segments of encrypted content and the second grouping of segments of encrypted content stored in the first repository;
produce the second content access information to indicate the first location from which a copy of the first decryption key is retrievable from the second repository, the second content access information mapping the first grouping of multiple segments of encrypted content to the copy of the first decryption key; and
produce the second content access information to indicate a second location from which a copy of the second decryption key is retrievable from the second repository, the second content access information mapping the second grouping of multiple segments of encrypted content to the copy of the second decryption key.
27. The computer system as in claim 23 , wherein the computer processor hardware is further operable to:
in response to receiving a command to play back the stored segments of encrypted content in the first repository:
utilize the second content access information to identify an ordering of playing back renditions of the stored segments of encrypted content;
utilize the second content access information to identify locations of the copies of original decryption keys corresponding to the stored segments of encrypted content; and
retrieve the copies of original decryption keys from the locations as specified by the second content access information.
28. The computer system as in claim 23 , wherein the computer processor hardware is further operable to:
at the client device, as specified by the second content access information:
i) initiate retrieval of the stored segments of encrypted content from the first repository, the first repository located in a subscriber domain in which the client device resides;
ii) establish a secured communication link to access the second repository; and
iii) initiate retrieval of the copies of original decryption keys over the secured communication link from the second repository;
wherein the client device requires authorization from a content distribution service provider providing access to the encrypted segments of content to access the copies of the original decryption keys from the second repository upon a subsequent request by the client device to playback a rendition of the encrypted segments of content stored in the first repository.
29. Computer-readable storage hardware having instructions stored thereon, the instructions, when carried out by computer processor hardware, cause the computer processor hardware to:
retrieve segments of encrypted content as specified by first content access information, the first content access information further specifying resources from which to retrieve original decryption keys to decrypt the segments of encrypted content;
store the segments of encrypted content in a first repository associated with the client device for later retrieval;
in a second repository accessible to the client device, store retrieved copies of the original decryption keys to decrypt the encrypted segments of content for later retrieval, the second repository disparately located with respect to the first repository; and
derive second content access information to specify locations of the copies of the original decryption keys in the second repository, the second content access information providing mapping between the stored segments of encrypted content in the first repository and corresponding copies of the original decryption keys in the second repository.