Method and system for secure over-the-top live video delivery
A method is provided for managing key rotation (use of series of keys) and secure key distribution in over-the-top content delivery. The method provided supports supplying a first content encryption key to a content packaging engine for encryption of a first portion of a video stream. Once the first content encryption key has expired, a second content encryption key is provided to the content packaging engine for encryption of a second portion of a video stream. The method further provides for notification of client devices of imminent key changes, as well as support for secure retrieval of new keys by client devices. A system is also specified for implementing a client and server infrastructure in accordance with the provisions of the method.
1. A method for managing secure distribution of audio or video content, comprising:
generating a series of content encryption keys for encrypting a single audio or video content item, each content encryption key associated with a different portion of the single audio or video content item wherein client devices requesting the single audio or video content item is further provided with key expiration information usable by the client devices to identify transitions between portions of the single audio or video content item that use different ones of the content encryption keys; and
providing the content encryption keys to a license server for delivery to the client devices for use in decrypting the content item, the license server being operative to establish that a requesting client device is authorized to access the content item, the license server being further operative to securely deliver the content encryption keys to a requesting client device whose authorization to access the content item has been established.
2. The method of claim 1 , wherein the client device is notified at session initiation of a target fixed period for content key expiration.
3. The method of claim 1 , wherein the client device is notified in real time of content key expiration.
4. The method of claim 3 , wherein the key expiration information is provided to the client device by inserting a key change notification into a content encryption metadata header as part of the unencrypted portion of the encrypted file, the content encryption metadata header.
5. The method of claim 3 , wherein the key expiration information is provided to the client device by inserting a key change notification into a content manifest file accessible to the client devices, the content manifest file being selected from an m3u8 file, an IIS Smooth Streaming manifest file, a DASH MPD file and a proprietary manifest file.
6. The method of claim 3 , wherein the key expiration information is provided to the client device by inserting a key change notification into the file name of the segment files being generated.
7. The method of claim 1 , wherein the license server distributes content encryption keys and content encryption key expiration information to client devices using a secure channel.
8. The method of claim 7 , wherein the secure channel is secured using a selected one of Secure Sockets Layer and a token-based technique using a token encrypted with a symmetric key.
9. The method of claim 1 , wherein the license server sends content encryption keys and expiration information only in response to requests from the client devices.
10. The method of claim 1 , wherein the license server is operative when establishing that a requesting client device is authorized to access the content item to verify client device identity and content access rights before returning content encryption key or expiration information.
11. A computerized device operable as a workflow manager for managing secure distribution of audio or video content, comprising:
memory operative to store computer program instructions;
one or more processors;
input/output interface circuitry; and
interconnect circuitry coupling the memory, processors and input/output interface circuitry together,
wherein the processors are operative to execute the computer program instructions from the memory to cause the computerized device to:
generate a series of content encryption keys for encrypting a single audio or video content item, each content encryption key associated with a different portion of the single audio or video content item wherein client devices requesting the single audio or video content item is further provided with key expiration information usable by the client devices to identify transitions between portions of the single audio or video content item that use different ones of the content encryption keys; and
provide the content encryption keys to a license server for delivery to the client devices for use in decrypting the content item, the license server being operative to establish that a requesting client device is authorized to access the content item, the license server being further operative to securely deliver the content encryption keys to a requesting client device whose authorization to access the content item has been established.
12. The computerized device of claim 11 , wherein the client device is notified at session initiation of a target fixed period for content key expiration.
13. The computerized device of claim 11 , wherein the client device is notified in real time of content key expiration.
14. The computerized device of claim 11 , wherein the key expiration information is provided to the client device by inserting a key change notification into a content encryption metadata header as part of the unencrypted portion of the encrypted file, the content encryption metadata header.
15. The computerized device of claim 11 , wherein the key expiration information is provided to the client device by inserting a key change notification into a content manifest file accessible to the client devices, the content manifest file being selected from an m3u8 file, an IIS Smooth Streaming manifest file, a DASH MPD file and a proprietary manifest file.
16. The computerized device of claim 15 , wherein the key expiration information is provided to the client device by inserting a key change notification into the file name of the segment files being generated.
17. The computerized device of claim 11 , wherein the license server distributes content encryption keys and content encryption key expiration information to client devices using a secure channel.
18. The computerized device of claim 17 , wherein the secure channel is secured using a selected one of Secure Sockets Layer and a token-based technique using a token encrypted with a symmetric key.
19. The computerized device of claim 11 , wherein the license server sends content encryption keys and expiration information only in response to requests from the client devices.
20. The computerized device of claim 11 , wherein the license server is operative when establishing that a requesting client device is authorized to access the content item to verify client device identity and content access rights before returning content encryption key or expiration information.