Comcast Cable Communications, LLC

Kyong Park

James W Fahrny

Nikola Kolev

Jason S Burgess

John D Robinson

Michael Chen

Garey Hassler

Greg Rutz

Bradley Hess

James Fahrny

Systems and methods for managing group encryption are described. In certain methods, a content asset may be encrypted with an asset key. An account key may be determined. Using the account key, an encrypted content asset package may be generated. The asset key may make up at least a portion of the encrypted content asset package. The encrypted content asset package is decryptable with the account key. The encrypted content asset package and an identifier associated with the account key may be transmitted, for example to a playback device.

Content recording and group encryption

Methods, systems, computer-readable media, and apparatuses for providing policy-based copyright enforcement of media content items streamed to client devices are described. Various aspects discussed herein relate to managing content access rights in an adaptive bitrate environment (e.g., where an asset may be encoded and delivered at multiple different bitrates). The system discussed herein permits differentiated access to the same video, or portions of the same video, where any DRM-type client may read a manifest file including content verification data, which may be video authentication information that is specific to the video. Additional aspects discussed herein provide DRM metadata specific to each frame of a multi-bitrate video to enable the client device to verify the multi-bitrate video on a frame-by-frame basis.

Adaptive rights management system

Systems, apparatuses, and methods are described for converting digital rights management (DRM) data in a specific protocol to standardized DRM data. The standardized DRM data may be used to secure content delivered to user devices through a content delivery network. If a user device decides to record a content item, a request for authenticating entitlement to the content item may be sent to a network device and the network device may reply with an authentication receipt if appropriate. If the user device later decides to access the content item, the user device may send the authentication receipt back to the network server so that the network server may reply with a decryption key for decrypting the content item.

Digital rights management data conversion in a content delivery network

Methods and apparatus for real-time security monitoring on a computing device are presented. A system may define privileges to access hardware interfaces for each process of a plurality of processes executing on a computing device. The privileges may be defined in a privileged operating system level that controls root access to an operating system. In response to a determination that a process is attempting to access a hardware interface, the system may determine whether the process is privileged to access the hardware interface by checking the privileges. In response to determining that the process is not privileged to access the hardware interface, the intrusion detection agent may terminate the process.

Security monitoring at operating system kernel level

Systems and methods are described that relate to authentication and/or binding of multiple devices with varying security profiles. In one aspect, a first device with a higher security profile may vouch for the authenticity of a second device with a lower security profile when the second device requests access for content from a content provider. The vouching process may be implemented by allowing the first device to overlay its digital signature on a registration request that has been signed and transmitted by the second device. The second device with the lower security profile may access content from the content provider or source for a predetermined time period, even when the second device does not access content through the first device.

Authentication and binding of multiple devices

Authorization and delivery of content may employ uniform resource signing packages. A uniform resource signing package may comprise access parameters for a content item, user, and/or device, and may be sent to the client as a uniform resource query parameter. The client may include the uniform resource signing package in future requests associated with the content item.

Content authorization and delivery

Groups of devices may be prevented from accessing content by encrypting the content. A plurality of secrets associated with a decryption key may be generated using a secret sharing algorithm. The plurality of secrets may be sent to one or more groups of devices to derive the decryption key. A non-restricted subset of the groups of devices may receive one or more secrets. Devices within the non-restricted subset of the groups may be able to use one or more secrets to determine the decryption key for the content. Groups that do not receive one or more secrets may be unable to determine the decryption key for the content.

Scalable content restriction

Disclosed are systems and methods for a digital rights management (DRM) interface. A DRM request can be received via a scheme-agnostic application program interface (API). A scheme-specific request based on the DRM request can be transmitted via a scheme-specific API. A response to the scheme-specific request can be received via the scheme-specific API. A response to the DRM request can be transmitted via the scheme-agnostic API.

Digital rights management interface

Methods and systems related to authoring and acquiring digital rights management (DRM) licenses are disclosed. For example, a computing device may generate or author a digital rights management license for a content asset that includes one or more usage restriction rules. A usage restriction may limit the maximum display resolution for a content asset. Another device may then receive the license and process the one or more usage restrictions prior to presentation of the content asset to a user.

Video resolution enforcement and optimization in an adaptive bitrate environment

A streamlined workflow for digital rights management (DRM) licensing for content such as media assets is achieved via an authentication server establishing an authenticated session that is referenced by other processes, whereby a content grant may include a key to desired encrypted content with a portion of the content or content meta-data. The authentication server verifies the user's identity and provides a session grant including a session security mechanism, such as a token, session key, or negotiated secret. The session grant may be used to obtain a content authorization from a content router. The content authorization includes an address at which the content may be found and may be decorated with security mechanisms. The session grant and/or content authorization may include an entitlement record reflecting the user's entitlements to access content. The session grant and/or content authorization may be used to obtain a content grant from a content server.

Streamlined digital rights management

Systems and methods are for content security may comprise transmitting a request for authorization to access secured content. A content key for the secured content may be received and stored to a restricted region of a memory. A device security module may have access to the restricted region and may decrypt, based on satisfaction of a use condition and using the content key, the secured content. An encryption key associated with a secure media system authorized to access the secured content may be received. The device security module may encrypt, using the encryption key, the secured content and route the secured content to the secure media system.

Systems and methods for content security

Disclosed are systems and methods for encryption key management. Content items, or portions thereof, can be assigned to a plurality of partitions. Each of the plurality of partitions can correspond to a timeframe of encryption key rotation. Cache control can be applied to manifests and/or content based on the timeframe of encryption key rotation.

Growing community of inventors

Woodbine, MD, United States of America

Kyong Park