Encryption management, content recording management, and playback management in a network environment
Management of key information as described herein enables a respective service provider to distribute encrypted content to subscribers, preventing improper use of the content without authorization. For example, the service provider can distribute encrypted content for recording by a subscriber at a remote location. At or around a time of recording the encrypted content, and on behalf of the user, the service provider initiates storage of the corresponding decryption information that is needed to decrypt the recorded encrypted content. In order to play back the recorded segments of the encrypted content, the subscriber communicates with a server resource to be authenticated. Subsequent to being authenticated, the server resource distributes a copy of decryption information needed to decrypt the previously recorded segments of encrypted content to the subscriber. Accordingly, the service provider retains control of playing back content via controlled distribution of the corresponding copy of decryption information.
1. A method comprising:
receiving first content access information including first network addresses and second network addresses, the first network addresses specifying locations of segments of encrypted content associated with a request, the second network addresses specifying locations of copies of original decryption keys to decrypt the segments of encrypted content;
utilizing the first network addresses in the first content access information to communicate over a network and retrieve the segments of encrypted content associated with the request;
utilizing the second network addresses in the first content access information to communicate over the network and retrieve the copies of original decryption keys;
storing the segments of encrypted content and the copies of original decryption keys for later retrieval; and
producing second content access information to provide a mapping between the stored segments of encrypted content and the stored copies of original decryption keys;
the method further comprising:
retrieving a first encrypted decryption key from the stored copies of the original decryption keys as specified by the second content access information; and
decrypting the first encrypted decryption key to produce a first decryption key.
2. The method as in claim 1 further comprising:
distributing the second content access information to a subscriber.
3. The method as in claim 1 , wherein the request specifies particular content to record on behalf of a subscriber, the method further comprising:
retrieving the first content access information in response to receiving selection of the particular content for recording; and
producing the second content access information to facilitate subsequent playback of the particular content by the subscriber.
4. The method as in claim 1 , wherein the segments of encrypted content are available to the subscriber from a service provider; and
wherein the service provider requires authorization of the subscriber prior to providing corresponding access to the copies of original decryption keys.
5. The method as in claim 1 ,
wherein the copies of original decryption keys are stored in a second repository accessible to a communication device through gateway hardware.
6. The method as in claim 1 , wherein retrieval of the stored copies of the original decryption keys from the second repository through gateway hardware requires authorization of the communication device.
7. The method as in claim 1 , wherein the second network addresses of the second content access information indicate: i) third locations from which the stored segments of encrypted content are retrievable, and ii) fourth locations from which the stored copies of original decryption keys are retrievable.
8. The method as in claim 7 , wherein the request is a request to record the segments of encrypted content for later retrieval; and
wherein retrieval of the stored copies of the original decryption keys from the fourth locations requires authentication by a server resource.
9. The method as in claim 8 , wherein the stored copies of the original decryption keys are encrypted.
10. The method as in claim 9 further comprising:
communicating the second content access information to a communication device that uses a decryption key from an authentication resource to decrypt the copies of the original decryption keys, the communication device further operable to use the decrypted copies of the decryption keys to decrypt the segments of encrypted content retrieved from the third locations.
11. The method as in claim 7 , wherein the fourth locations specify a repository that is disparately located with respect to a repository specified by the second locations.
12. The method as in claim 1 , wherein the encrypted segments of content include a first encrypted segment of content and a second encrypted segment of content;
wherein the copies of the original decryption keys include a copy of a first original decryption key and a copy of a second original decryption key, the method further comprising:
producing the second content access information to indicate that: i) the copy of the first original decryption key decrypts the first encrypted segment of content, and ii) the copy of the second original decryption key decrypts the second encrypted segment of content in the first repository.
13. The method as in claim 1 , wherein the segments of encrypted content represent video segments initially retrievable by a communication device in a subscriber domain via use of the first content access information; and
wherein the second content access information provides the communication device in the subscriber domain access to the segments of encrypted content after the video segments are no longer available via use of the first content access information.
14. The method as in claim 1 further comprising:
obtaining a decryption key from a server resource; and
wherein decrypting the first encrypted decryption key includes:
applying the obtained decryption key to the first encrypted decryption key to produce the first decryption key.
15. The method as in claim 1 , wherein the second content access information indicates a mapping between the first encrypted decryption key and a first segment of encrypted content in the stored segments of encrypted content.
16. The method as in claim 15 further comprising:
retrieving the first segment of encrypted content as specified by the second content access information from the stored segments of encrypted content; and
applying the first decryption key to the first segment of encrypted content to decrypt the first segment of encrypted content into a first segment of decrypted content.
17. The method as in claim 16 further comprising:
playing back the first segment of decrypted content on a display screen.
18. A system comprising:
computer processor hardware operable to:
receive first content access information including first network addresses and second network addresses, the first network addresses specifying locations of segments of encrypted content associated with a request for recording of content, the second network addresses specifying locations of copies of original decryption keys to decrypt the segments of encrypted content;
utilize the first network addresses and the second network addresses in the first content access information to retrieve the segments of encrypted content associated with the request and the copies of original decryption keys;
store the segments of encrypted content for later retrieval;
store the copies of original decryption keys for later retrieval; and
produce second content access information to provide a mapping between the stored segments of encrypted content and the stored copies of original decryption keys to decrypt the stored segments of encrypted content;
retrieve a first encrypted decryption key from the stored copies of original decryption keys as specified by the second content access information; and
decrypt the first encrypted decryption key to produce a first decryption key.
19. The system as in claim 18 , wherein the computer processor hardware is further operable to utilize the first content access information to retrieve the copies of original decryption keys.
20. The system as in claim 19 , wherein the first content access information provides a mapping between the retrieved segments of encrypted content and the copies of original decryption keys.
21. The system as in claim 18 , wherein the computer processor hardware is further operable to distribute the second content access information to a subscriber to retrieve the copies of original decryption keys.
22. The system as in claim 18 , wherein the request specifies particular content to record on behalf of a subscriber; and
wherein the computer processor hardware is further operable to:
retrieve the first content access information in response to receiving selection of the particular content for recording; and produce the second content access information to facilitate subsequent playback of the particular content by the subscriber.
23. The system as in claim 18 , wherein the segments of encrypted content are available to a subscriber from a service provider; and
wherein the service provider requires authorization of the subscriber prior to the service provider providing access to the copies of the original decryption keys.
24. The system as in claim 18 , wherein a subscriber i) retrieves the segments of encrypted content through gateway hardware operated by a service provider to which the subscriber subscribes and ii) stores the retrieved segments of encrypted content in a first repository for later retrieval; and
wherein a server resource operated by the service provider stores the copies of original decryption keys in a second repository, the second repository accessible to the subscriber through the gateway hardware.
25. The system as in claim 24 , wherein the service provider requires authorization of the subscriber prior to distribution of the stored copies of original decryption keys from the second repository through the gateway hardware to the subscriber.
26. The system as in claim 18 , wherein the computer processor hardware is further operative to: obtain a decryption key from a server resource; and apply the obtained decryption key to the first encrypted decryption key to produce the first decryption key.
27. The system as in claim 18 , wherein the second content access information indicates a mapping between the first encrypted decryption key and a first segment of encrypted content in the stored segments of encrypted content.
28. The system as in claim 27 , wherein the computer processor hardware is further operative to:
retrieve the first segment of encrypted content as specified by the second content access information from the stored segments of encrypted content; and
apply the first decryption key to the first segment of encrypted content to decrypt the first segment of encrypted content into a first segment of decrypted content.
29. The system as in claim 28 , wherein the computer processor hardware is further operative to:
play back the first segment of decrypted content on a display screen.