IP Library › Granted Patent US 12,463,948
Granted Patent B2
US 12,463,948 · App. 18/088,295 · Granted Nov 4, 2025

Distributed data content protection

Inventors: Ville Ollikainen (Vihti, FI); Markku Kylanpaa (Helsinki, FI); Anni Karinsalo (Oulu, FI); Pekka Koskela (Oulu, FI)
Assignee: Adeia Guides Inc.
H04L63/0435H04L67/1097
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12,463,948
App. No.
18/088,295
Granted
Nov 4, 2025
Kind
B2
Abstract

Systems and methods are described for encrypting and decrypting data in a distributed storage environment. Such systems and methods for encryption may divide a data payload into slices, the slices including a first slice and a subsequent slice, employ a content encryption key and an initialization vector, encrypt the first slice using the content encryption key and the initialization vector, generate a subsequent initialization vector for the subsequent slice based upon the initialization vector and the unencrypted content of the first slice, and encrypt the subsequent slice using the subsequent initialization vector and the content encryption key. The systems and methods may then generate a list of the encrypted slices into which the data payload has been generated, and publish to a secure storage location, the slice list, the content encryption key and the initialization vector for the first slice in the slice list, with the slices outputted to the distributed storage environment. Systems and methods for decryption may receive, from a secure storage location, a slice list, a content encryption key, and an initialization vector, determine the encrypted slices to be received from the distributed storage environment. The systems and methods may receive, from the distributed storage environment, at least encrypted first slice and the encrypted subsequent slice, and decrypt the first slice using the content encryption key and the initialization vector, to generate a decrypted first slice, and generate a subsequent initialization vector for the subsequent slice based upon the initialization vector and the decrypted first slice, decrypt the subsequent slice using the subsequent initialization vector and the content encryption key, and combine the first slice and the subsequent slice into a data payload.

Claims (115)

1 . A method for encrypting data in a distributed storage environment, the method comprising:

dividing a media item into segments, the segments including a first segment and a subsequent segment;

encoding the at least first and subsequent segments as at least a first representation and a second representation, wherein the first representation and the second representation are encoded at different bitrates;

generating a content encryption key, a raw initialization value, and a first continuity reference;

generating from the first continuity reference and the raw initialization value, a first master initialization vector for the first segment and a first segment continuity reference;

generating a first representation-specific initialization vector for the first representation of the first segment, and a second representation-specific initialization vector for the second representation of the first segment, each based upon the first master initialization vector;

encrypting the first representation of the first segment with the first representation-specific initialization vector and the content encryption key, and the second representation of the first segment with the second representation-specific initialization vector and the content encryption key, to generate an encrypted first segment;

generating from the first segment continuity reference a second master initialization vector for the subsequent segment and a subsequent segment continuity reference;

generating a third representation-specific initialization vector for the first representation of the subsequent segment and a fourth representation-specific initialization vector for the second representation of the subsequent segment, each based upon the second master initialization vector;

encrypting at least the first representation of the subsequent segment with the third representation-specific initialization vector and the content encryption key, and the second representation of the subsequent segment with the fourth representation-specific initialization vector and the content encryption key, to generate an encrypted subsequent segment;

generating a segment reference list of the encrypted segments into which the media item has been divided and information about the representations into which each segment has been encoded;

publishing, to a secure storage location, the segment reference list, the content encryption key, the raw initialization value, and the continuity reference; and

outputting, to the distributed storage environment at least the encrypted first segment and the encrypted subsequent segment.

2 . The method of claim 1 , further including the steps of:

generating a zeroth representation for the subsequent segment, wherein the zeroth representation does not include a portion of the media item; and

generating, a zeroth representation-specific continuity reference for the subsequent segment.

3 . The method of claim 1 , wherein a zeroth representation-specific initialization vector is used as the first segment continuity reference.

4 . The method of claim 1 , wherein the step of dividing the media item further includes the step of dividing the media item into a further subsequent segment, and wherein the method further includes the steps of:

encoding the further subsequent segments as at least the first representation and the second representation, wherein the first representation and the second representation are encoded at different bitrates;

generating from the subsequent segment continuity reference a third master initialization vector for the further subsequent segment and a further subsequent segment continuity reference;

generating a fifth representation-specific initialization vector for the first representation of the first segment and a sixth representation-specific initialization vector for the second representation of the first segment, each based upon the third master initialization vector;

encrypting at least the first representation of the further subsequent segment with the fifth representation-specific initialization vector and the content encryption key, and the second representation of the further subsequent segment with the sixth representation-specific initialization vector and the content encryption key, to generate an encrypted further subsequent segment.

5 . The method of claim 1 , wherein the method further includes:

generating a replacement raw initialization vector to replace the raw initialization vector;

selecting a segment to be re-encrypted;

generating, from the relevant continuity reference and the replacement raw initialization value, a replacement master initialization vector for the selected segment and a selected segment continuity reference;

generating a replacement representation-specific initialization vector for the first representation of the selected segment and a replacement second representation-specific initialization vector for the second representation of the selected segment, each based upon the replacement master initialization vector;

encrypting at least the first representation of the selected segment with the replacement representation-specific first initialization vector and the content encryption key, and the second representation of the first segment with the replacement representation-specific second initialization vector and the content encryption key, to generate a replacement encrypted segment;

generating a renewed segment reference list of the encrypted segments into which the media item has been divided and information about the representations into which each segment has been encoded and which includes the replacement encrypted selected segment;

publishing, to the secure storage location, the renewed segment list and the replacement raw initialization vector; and

outputting, to the distributed storage environment, the replacement encrypted selected segment.

6 . A method of decrypting data in a distributed storage environment, the method including the steps of:

receiving, from a secure storage location, a segment reference list, a content encryption key, a continuity reference, and a raw initialization value;

determining, from the segment reference list, the encrypted segments to be received from the distributed storage environment, wherein the encrypted segments to be received include at least an encrypted first segment and an encrypted subsequent segment, and the encrypted first segment and encrypted second segment each include at least a first and second representation;

determining the representation for each segment which is to be retrieved;

generating, using control circuitry, from the continuity reference, a first master initialization vector for the first segment and a first segment continuity reference;

generating a first representation-specific initialization vector for the required representation of the first segment from the first master initialization vector;

receiving, from the distributed storage environment, the required representation for at least the first segment;

decrypting the received representation of the first segment with the first representation-specific initialization vector and the content encryption key to generate a decrypted first segment;

generating, for display, the decrypted first segment;

generating from the first segment continuity reference, a second master initialization vector for the subsequent segment and a subsequent segment continuity reference;

generating a second representation-specific initialization vector for the required representation of the second segment from the second master initialization vector;

receiving, from the distributed storage environment, the required representation for at least the second segment;

decrypting the received representation of the second segment with the second representation-specific initialization vector and the content encryption key to generate a decrypted subsequent segment; and

generating, for display, the decrypted second segment.

7 . The method of claim 6 , wherein the steps of:

generating, from the continuity reference, the first master initialization vector for the first segment and the first segment continuity reference;

generating the first representation-specific initialization vector for the required representation of the first segment from the first master initialization vector;

decrypting the received representation of the first segment with the first representation-specific initialization vector and the content encryption key to generate the decrypted first segment;

generating from the first segment continuity reference, the second master initialization vector for the subsequent segment and the subsequent segment continuity reference;

generating the second representation-specific initialization vector for the required representation of the second segment from the second master initialization vector; and

decrypting the received representation of the second segment with the second representation-specific initialization vector and the content encryption key to generate a decrypted subsequent segment,

are carried out in a trusted execution environment.

8 . The method of claim 6 , wherein the method further includes:

receiving, from the secure storage location, a renewed segment list and a replacement raw initialization vector to replace the raw initialization vector;

determining from the renewed segment list, the replacement encrypted segment to be received from the distributed storage environment;

receiving, from the distributed storage environment, the replacement encrypted segment.

9 . The method of claim 6 , further comprising a slice reference list that includes one alternative representation for each of the segments.

10 . The method of claim 9 , wherein the slice reference list further includes all possible initialization values for each representation of each segment.

11 . A system for encrypting data in a distributed storage environment, the system including control circuitry configured to:

divide a media item into segments, the segments including a first segment and a subsequent segment;

encode the at least first and subsequent segments as at least a first representation and a second representation, wherein the first representation and the second representation are encoded at different bitrates;

generate a content encryption key, a raw initialization value, and a first continuity reference;

generate from the first continuity reference and the raw initialization value, a first master initialization vector for the first segment and a first segment continuity reference;

generate a first representation-specific initialization vector for the first representation of the first segment, and a second representation-specific initialization vector for the second representation of the first segment, each based upon the first master initialization vector;

encrypt the first representation of the first segment with the first representation-specific initialization vector and the content encryption key, and the second representation of the first segment with the second representation-specific initialization vector and the content encryption key, to generate an encrypted first segment;

generate from the first segment continuity reference a second master initialization vector for the subsequent segment and a subsequent segment continuity reference;

generate a third representation-specific initialization vector for the first representation of the subsequent segment and a fourth representation-specific initialization vector for the second representation of the subsequent segment, each based upon the second master initialization vector;

encrypt at least the first representation of the subsequent segment with the third representation-specific initialization vector and the content encryption key, and the second representation of the subsequent segment with the fourth representation-specific initialization vector and the content encryption key, to generate an encrypted subsequent segment;

generate a segment reference list of the encrypted segments into which the media item has been divided and information about the representations into which each segment has been encoded;

publish, to a secure storage location, the segment reference list, the content encryption key, the raw initialization value, and the continuity reference; and

output, to the distributed storage environment at least the encrypted first segment and the encrypted subsequent segment.

12 . The system of claim 11 , wherein the control circuitry is further configured to generate a zeroth representation for the subsequent segment, wherein the zeroth representation does not include a portion of the media item, and generate a zeroth representation-specific continuity reference for the subsequent segment.

13 . The system of claim 11 , wherein a zeroth representation-specific initialization vector is used as the first segment continuity reference.

14 . The system of claim 11 , wherein the control circuitry is configured to divide the media item by dividing the media item into a further subsequent segment, and wherein the control circuitry is further configured to:

encode the further subsequent segments as at least the first representation and the second representation, wherein the first representation and the second representation are encoded at different bitrates;

generate from the subsequent segment continuity reference a third master initialization vector for the further subsequent segment and a further subsequent segment continuity reference;

generate a fifth representation-specific initialization vector for the first representation of the first segment and a sixth representation-specific initialization vector for the second representation of the first segment, each based upon the third master initialization vector;

encrypt at least the first representation of the further subsequent segment with the fifth representation-specific initialization vector and the content encryption key, and the second representation of the further subsequent segment with the sixth representation-specific initialization vector and the content encryption key, to generate an encrypted further subsequent segment.

15 . The system of claim 11 , wherein the control circuitry is further configured to:

generate a replacement raw initialization vector to replace the raw initialization vector;

select a segment to be re-encrypted;

generate, from the relevant continuity reference and the replacement raw initialization value, a replacement master initialization vector for the selected segment and a selected segment continuity reference;

generate a replacement representation-specific initialization vector for the first representation of the selected segment and a replacement second representation-specific initialization vector for the second representation of the selected segment, each based upon the replacement master initialization vector;

encrypt at least the first representation of the selected segment with the replacement representation-specific first initialization vector and the content encryption key, and the second representation of the first segment with the replacement representation-specific second initialization vector and the content encryption key, to generate a replacement encrypted segment;

generate a renewed segment reference list of the encrypted segments into which the media item has been divided and information about the representations into which each segment has been encoded and which includes the replacement encrypted selected segment;

publish, to the secure storage location, the renewed segment list and the replacement raw initialization vector; and

output, to the distributed storage environment, the replacement encrypted selected segment.

16 . A system for decrypting data in a distributed storage environment, the system including control circuitry configured to:

receive, from a secure storage location, a segment reference list, a content encryption key, a continuity reference, and a raw initialization value;

determine, from the segment reference list, the encrypted segments to be received from the distributed storage environment, wherein the encrypted segments to be received include at least an encrypted first segment and an encrypted subsequent segment, and the encrypted first segment and encrypted second segment each include at least a first and second representation;

determine the representation for each segment which is to be retrieved;

generate, using the control circuitry, from the continuity reference, a first master initialization vector for the first segment and a first segment continuity reference;

generate a first representation-specific initialization vector for the required representation of the first segment from the first master initialization vector;

receive, from the distributed storage environment, the required representation for at least the first segment;

decrypt the received representation of the first segment with the first representation-specific initialization vector and the content encryption key to generate a decrypted first segment;

generate, for display, the decrypted first segment;

generate from the first segment continuity reference, a second master initialization vector for the subsequent segment and a subsequent segment continuity reference;

generate a second representation-specific initialization vector for the required representation of the second segment from the second master initialization vector;

receive, from the distributed storage environment, the required representation for at least the second segment;

decrypt the received representation of the second segment with the second representation-specific initialization vector and the content encryption key to generate a decrypted subsequent segment; and

generate, for display, the decrypted second segment.

17 . The system of claim 16 , wherein the control circuitry is further configured to:

generate, from the continuity reference, the first master initialization vector for the first segment and the first segment continuity reference;

generate the first representation-specific initialization vector for the required representation of the first segment from the first master initialization vector;

decrypt the received representation of the first segment with the first representation-specific initialization vector and the content encryption key to generate the decrypted first segment;

generate from the first segment continuity reference, the second master initialization vector for the subsequent segment and the subsequent segment continuity reference;

generate the second representation-specific initialization vector for the required representation of the second segment from the second master initialization vector; and

decrypt the received representation of the second segment with the second representation-specific initialization vector and the content encryption key to generate a decrypted subsequent segment.

18 . The system of claim 16 , wherein the control circuitry is further configured to:

receive, from the secure storage location, a renewed segment list and a replacement raw initialization vector to replace the raw initialization vector;

determine from the renewed segment list, the replacement encrypted segment to be received from the distributed storage environment;

receive, from the distributed storage environment, the replacement encrypted segment.

19 . The system of claim 16 , further comprising a slice reference list that includes one alternative representation for each of the segments.

20 . The system of claim 19 , wherein the slice reference list further includes all possible initialization values for each representation of each segment.

Assignments (3)
CHANGE OF NAME Recorded Oct 4, 2024
From: ROVI GUIDES, INC.
To: ADEIA GUIDES INC.
Reel/Frame 069113/0420 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Dec 22, 2023
From: OLLIKAINEN, VILLE; KYLANPAA, MARKKU; KARINSALO, ANNI; KOSKELA, PEKKA
To: ROVI GUIDES, INC.
Reel/Frame 065944/0876 →
SECURITY INTEREST Recorded May 3, 2023
From: ADEIA GUIDES INC.; ADEIA IMAGING LLC; ADEIA MEDIA HOLDINGS LLC; ADEIA MEDIA SOLUTIONS INC.; ADEIA SEMICONDUCTOR ADVANCED TECHNOLOGIES INC.; ADEIA SEMICONDUCTOR BONDING TECHNOLOGIES INC.; ADEIA SEMICONDUCTOR INC.; ADEIA SEMICONDUCTOR SOLUTIONS LLC; ADEIA SEMICONDUCTOR TECHNOLOGIES LLC; ADEIA SOLUTIONS LLC
To: BANK OF AMERICA, N.A., AS COLLATERAL AGENT
Reel/Frame 063529/0272 →
Continuity (1)
Related Publication 20240214361A1 · Jun 27, 2024
References Cited (51)
US 7093295B1 · Saito · 2006 [cited by applicant]
US 11223479B1 · Firestone · 2022 [cited by examiner]
US 11620393B1 · Premaradj · 2023 [cited by applicant]
US 20040091114A1 · Carter · 2004 [cited by examiner]
US 20050021986A1 · Graunke et al. · 2005 [cited by applicant]
US 20080294913A1 · Nakagoe et al. · 2008 [cited by applicant]
US 20100150344A1 · Karroumi et al. · 2010 [cited by applicant]
US 20120087490A1 · Ollikainen et al. · 2012 [cited by applicant]
US 20170019253A1 · Baptist · 2017 [cited by examiner]
US 20170353516A1 · Gordon · 2017 [cited by examiner]
US 20180270045A1 · Almuhammadi et al. · 2018 [cited by applicant]
US 20190042359A1 · Durham · 2019 [cited by applicant]
US 20200241768A1 · Chen et al. · 2020 [cited by applicant]
US 20220164458A1 · Petri et al. · 2022 [cited by applicant]
US 20240214362A1 · Ollikainen et al. · 2024 [cited by applicant]
WO 03053059A1 · 2003 [cited by applicant]
WO 2008000894A1 · 2008 [cited by applicant]
WO 2009007508A1 · 2009 [cited by applicant]
U.S. Appl. No. 18/088,305, filed Dec. 23, 2022, Ville Ollikainen. [cited by applicant]
Alkwai et al., “Dynamic Quality Adaptive P2P Streaming System,” 2016 International Wireless Communications and Mobile Computing Conference (IWCMC), pp. 158-163 (2016) (Abstract Only). [cited by applicant]
Borse et. al., “A Novel Approach to Preserve DRM for Content Distribution over P2P Networks,” Applied Soft Computing and Communication Networks, Lecture Notes in Networks and Systems, vol. 187 (2021) (Abstract Only). [cited by applicant]
Bugtraq, Getting around non-executable stack (and fix), Buqtraq mailing list, Aug. 10, 1997, https://seclists.org/bugtraq/1997/Aug/63. [cited by applicant]
Chen et al., “An anonymous DRM scheme for sharing multimedia files in P2P networks,” Multimed Tools Appl 69, 1041-1065 (2014). [cited by applicant]
Conrado et al., “Privacy-Preserving Digital Rights Management.” Secure Data Management, Lecture Notes in Computer Science, vol. 3178 (2004) (Abstract Only). [cited by applicant]
DASH Industry Forum, DASH-IF Implementation Guidelines: Content Protection and Security, Commit Snapshot, Jul. 24, 2020, https://dashif-documents.azurewebsites.net/Guidelines-Security/master/Guidelines-Security.html. [cited by applicant]
DASH Industry Forum. 2018. DASH Reference Client 2.6.7. https://reference.dashif.org/dash.js/v2.6.7/samples/dash-if-reference-player/index.html. (2018). [cited by applicant]
Davidson et al. “Content sharing schemes in DRM systems with enhanced performance and privacy preservation,” J. Comput. Secur. 24:667-688 (2016) (Abstract Only). [cited by applicant]
Gazdar et al., Toward a Full Peer to Peer MPEG-DASH Compliant Streaming System. Multimedia Tools and Applications (2018) (Abstract Only). [cited by applicant]
Iwata et al., “A DRM system suitable for P2P content delivery and the study on its implementation,” 2:806-811 (2003). [cited by applicant]
Javaid et al., “Cache Memory: An Analysis on Replacement Algorithms and Optimization Techniques,” Mehran University Research Journal of Engineering and Technology, Mehran University of Engineering and Technology, 36(4):… [cited by applicant]
Joshi et al., “Towards practical privacy-preserving digital rights management for cloud computing,” 2013 IEEE 10th Consumer Communications and Networking Conference (CCNC), pp. 265-270 (2013) (Abstract Only). [cited by applicant]
Liben-Nowell et al., “Analysis of the evolution of peer-to-peer systems,” 21st Annual Aymposium on Principles of Distributed Computing, p. 233-242 (2002) (Abstract Only). [cited by applicant]
Microsoft, DASH Content Protection Using Microsoft Playready, Article Mar. 13, 2021, https://docs.microsoft.com/en-us/playready/specifications/mpeg-dash-playready. [cited by applicant]
Padmavathi et al., “A security framework for Content-Based Publish-Subscribe system,” Electronic Commerce Research and Applications, 5(1):78-90 (2006) (Abstract On;y). [cited by applicant]
Ponciano et al., “BitTorrent traffic from a caching perspective,” J Braz Comput Soc, 19:475-491 (2013). [cited by applicant]
Prasad et al., “Bandwidth estimation: metrics, measurement techniques, and tools,” in IEEE Network, vol. 17(6):27-35 (2003). [cited by applicant]
Ron Garrison, Structure of a MPEG-DASH MPD, Ott Verse Blog, Apr. 1, 2021, https://ottverse.com/structure-of-an-mpeg-dash-mpd/. [cited by applicant]
Sanjay, How to Play MPEG-DASH Encrypted Protected Content Using Encrypted Media Extensions (EME) in Browser, (2020), https://medium.com/swlh/how-to-play-mpeg-dash-encrypted-protected-content-using-encrypted-media-extens… [cited by applicant]
Seals, “Researchers Compromise Netflix Content in Widevine DRM Hack,” Accessed in May 2022 at https://threatpost.com/netflix-compromised-widevine-drm-hack/144220/. [cited by applicant]
Shukla et al., “Towards software defined low maintenance structured peer-to-peer overlays”, Peer-to-Peer Networking and Applications 14:1242-1260 (2021) (Abstract Only). [cited by applicant]
Sodagar, “The MPEG-DASH Standard for Multimedia Streaming Over the Internet,” IEEE Multimedia, 18(4):62-67, (2011) (Abstract Only). [cited by applicant]
Spiteri et al., “From Theoryto Practice: Improving Bitrate Adaptation in the Dash Reference Player,” In MMSYS'18: 9th ACM Multimedia Systems Conference, Jun. 12-15, 2018. ACM, 16 Pages. https://doi.org/10.1145/3204949.3… [cited by applicant]
Stolarz, “Peer-to-peer streaming media delivery,” Proceedings First International Conference on Peer-to-Peer Computing, pp. 48-52 (2001) (Abstract Only). [cited by applicant]
Topjohnwu, Magisk Manager, https://magiskmanager.com/. [cited by applicant]
W3C, Encrypted Media Extensions, W3C Recommendation Sep. 18, 2017, https://www.w3.org/TR/encrypted-media/. [cited by applicant]
Wikipedia, Block cipher mode of operation, Wikipedia article, https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation. [cited by applicant]
Wikipedia, Cache replacement policies, Wikipedia article, https://en.wikipedia.org/wiki/Cache_replacement_policies. [cited by applicant]
Zhang et al., “A Survey on Distributed Hash Table (DHT): Theory, Platforms, and Applications.” pp. 1-60 (2013), https://silo.tips/download/a-survey-on-distributed-hash-table-dht-theory-platforms-and-applications-hao-zha. [cited by applicant]
Deffs et al., “Introduction to Cryptography: Principles and Applications” Springer Berlin Heidelberg https://doi.org/10.1007/978-3-662-47974-2 (3rd Ed.) (2015). [cited by applicant]
Elbirt, “Symmetric-Key Cryptography: Block Ciphers” Understanding and Applying Cryptography and Data Security, United Kingdom: Auerbach Publishers, Incorporated (2009). [cited by applicant]
Vaudenay, “A Classical Introduction to Cryptography: Applications for Communications Security” 1st ed. New York, NY: Springer US (2006). [cited by applicant]
Cited By (1)
US 12,665,887