Methods, devices, and systems for preventing rendering content from CDN to unauthorized users

1. A method comprising:

at a content delivery network (CDN) including one or more processors and a non-transitory memory:

receiving a request from a client device for a media content item, wherein the request indicates an identifier of a client;

provisioning an encrypted media content item corresponding to the media content item for the client, wherein at least a portion of the encrypted media content item is encrypted using at least one personalized key assigned to the client;

facilitating obtaining a manifest corresponding to the encrypted media content item, wherein the manifest specifies encryption metadata for retrieving the at least one personalized key by the client;

sending the encrypted media content item and the manifest to the client device; and

wherein a boundary of the portion of the encrypted media content item is aligned with a video sample unit boundary, a sub-segment boundary, or a segment boundary.

2. The method of claim 1 , wherein:

the portion of the encrypted media content item includes an instance of an encrypted segment encrypted with the at least one personalized key; and

provisioning the encrypted media content item corresponding to the media content item for the client includes:

deriving an instance identifier from the identifier of the client; and

selecting the instance of the encrypted segment from multiple instances of the encrypted segment based on the instance identifier, wherein each of the multiple instances is encrypted using a different personalized key.

3. The method of claim 2 , wherein the encrypted media content item includes encrypted segments protected with a content key corresponding to the media content item, and the method further includes:

receiving the encrypted segments and the multiple instances of the encrypted segment from a headend; and

storing the encrypted segments and the multiple instances of the encrypted segment.

4. The method of claim 3 , wherein:

the encrypted segments are generated by the headend during a global content encryption period using the content key;

the multiple instances of the encrypted segment are generated by the headend during a personalized content preparation period using multiple personalized keys; and

the encrypted segments are interleaved with the instance of the encrypted segment in the encrypted media content item.

5. The method of claim 1 , wherein:

the portion of the encrypted media content item corresponds to the encrypted media content item; and

provisioning the encrypted media content item corresponding to the media content item for the client includes:

receiving the media content item in an unencrypted format from a headend; and

obtaining the at least one personalized key corresponding to the identifier of the client and encrypting the media content item using the at least one personalized key to generate the encrypted media content item in response to receiving the request from the client.

6. The method of claim 1 , wherein:

the encrypted media content item includes the portion of the encrypted media content protected with the at least one personalized key and encrypted segments protected with a content key corresponding to the media content item; and

provisioning the encrypted media content item corresponding to the media content item for the client includes:

receiving the encrypted segments and an unencrypted portion of the media content item from a headend, wherein the encrypted segments and the unencrypted portion are interleaved; and

obtaining the at least one personalized key corresponding to the identifier of the client and encrypting the unencrypted portion using the at least one personalized key to generate the portion of the encrypted media content item in response to receiving the request from the client.

7. The method of claim 1 , wherein provisioning the encrypted media content item corresponding to the media content item for the client includes:

receiving encrypted segments protected with a content key corresponding to the media content item from a headend; and

modifying at least one of the encrypted segments or the encryption metadata associated with the content key in response to receiving the request from the client.

8. The method of claim 7 , wherein modifying at least one of the encrypted segments or the encryption metadata associated with the content key in response to receiving the request from the client includes:

obtaining the at least one personalized key corresponding to the identifier of the client; and

encrypting, using the at least one personalized key, at least one of the encrypted segments or the encryption metadata associated with the content key in response to receiving the request from the client.

9. The method of claim 7 , wherein sending the encrypted media content item and the manifest to the client device causes the client device to:

derive the encrypted segments and the encryption metadata, including decrypting the encrypted segments or the encryption metadata associated with the content key using the at least one personalized key.

10. The method of claim 1 , wherein facilitating obtaining the manifest corresponding to the encrypted media content item includes:

modifying the encryption metadata to specifying an identifier of the at least one personalized key upon obtaining the encrypted media content item.

11. A device comprising:

one or more processors;

a non-transitory memory; and

one or more programs stored in the non-transitory memory, which, when executed by the one or more processors, cause the device to:

receive a request from a client device for a media content item, wherein the request indicates an identifier of a client;

provision an encrypted media content item corresponding to the media content item for the client, wherein at least a portion of the encrypted media content item is encrypted using at least one personalized key assigned to the client;

facilitate obtaining a manifest corresponding to the encrypted media content item, wherein the manifest specifies encryption metadata for retrieving the at least one personalized key by the client;

send the encrypted media content item and the manifest to the client device; and

wherein a boundary of the portion of the encrypted media content item is aligned with a video sample unit boundary, a sub-segment boundary, or a segment boundary.

12. The device of claim 11 , wherein:

the portion of the encrypted media content item includes an instance of an encrypted segment encrypted with the at least one personalized key; and

provisioning the encrypted media content item corresponding to the media content item for the client includes:

deriving an instance identifier from the identifier of the client; and

selecting the instance of the encrypted segment from multiple instances of the encrypted segment based on the instance identifier, wherein each of the multiple instances is encrypted using a different personalized key.

13. The device of claim 12 , wherein the encrypted media content item includes encrypted segments protected with a content key corresponding to the media content item, and the one or more programs further cause the device to:

receive the encrypted segments and the multiple instances of the encrypted segment from a headend; and

store the encrypted segments and the multiple instances of the encrypted segment.

14. The device of claim 13 , wherein:

the encrypted segments are generated by the headend during a global content encryption period using the content key;

the multiple instances of the encrypted segment are generated by the headend during a personalized content preparation period using multiple personalized keys; and

the encrypted segments are interleaved with the instance of the encrypted segment in the encrypted media content item.

15. The device of claim 11 , wherein:

the portion of the encrypted media content item corresponds to the encrypted media content item; and

provisioning the encrypted media content item corresponding to the media content item for the client includes:

receiving the media content item in an unencrypted format from a headend; and

obtaining the at least one personalized key corresponding to the identifier of the client and encrypting the media content item using the at least one personalized key to generate the encrypted media content item in response to receiving the request from the client.

16. The device of claim 11 , wherein:

the encrypted media content item includes the portion of the encrypted media content protected with the at least one personalized key and encrypted segments protected with a content key corresponding to the media content item; and

provisioning the encrypted media content item corresponding to the media content item for the client includes:

receiving the encrypted segments and an unencrypted portion of the media content item from a headend, wherein the encrypted segments and the unencrypted portion are interleaved; and

obtaining the at least one personalized key corresponding to the identifier of the client and encrypting the unencrypted portion using the at least one personalized key to generate the portion of the encrypted media content item in response to receiving the request from the client.

17. The device of claim 11 , wherein provisioning the encrypted media content item corresponding to the media content item for the client includes:

receiving encrypted segments protected with a content key corresponding to the media content item from a headend; and

modifying at least one of the encrypted segments or the encryption metadata associated with the content key in response to receiving the request from the client.

18. The device of claim 17 , wherein modifying at least one of the encrypted segments or the encryption metadata associated with the content key in response to receiving the request from the client includes:

obtaining the at least one personalized key corresponding to the identifier of the client; and

encrypting, using the at least one personalized key, at least one of the encrypted segments or the encryption metadata associated with the content key in response to receiving the request from the client.

19. A non-transitory memory storing one or more programs, which, when executed by one or more processors of a device, cause the device to:

receive a request from a client device for a media content item, wherein the request indicates an identifier of a client;

provision an encrypted media content item corresponding to the media content item for the client, wherein at least a portion of the encrypted media content item is encrypted using at least one personalized key assigned to the client;

facilitate obtaining a manifest corresponding to the encrypted media content item, wherein the manifest specifies encryption metadata for retrieving the at least one personalized key by the client;

send the encrypted media content item and the manifest to the client device; and

wherein a boundary of the portion of the encrypted media content item is aligned with a video sample unit boundary, a sub-segment boundary, or a segment boundary.