ES2360982A1 - Conditional access system contained in digital distribution systems of flash video based on cryptographic token. (Machine-translation by Google Translate, not legally binding) - Google Patents

Abstract

System of conditional access to contents in digital distribution systems of video flash based on cryptographic token. Flash technologies are a de facto standard for distributing video over heterogeneous networks. Conditional access systems can be used to control access to content. Currently, there is no standardized or widely accepted solution for this. In the commercial world, there are mainly oriented solutions for access to digital video broadcasting through decoding with set-top-boxes (stb). The method and system presented here use a similar system of access control, but using a "web browser" as a client. The user's credentials are stored in cryptographic hardware devices (token). Each user has its own token that contains its private key and the certificate with the public key, conveniently signed by the certifying authority (ca). This information is used to establish tls (transport layer security protocol) sessions. In this way, through tls sessions, access to each user can be allowed or denied depending on the content they want to access. (Machine-translation by Google Translate, not legally binding)

Description

Conditional access system to content in token-based digital flash video distribution systems cryptographic.

Technical sector

The present invention is focused on providing a conditional access system for payment-per-view management for Flash Video (FLV) based on the TLS (Transport Layer) protocol Security) Flash Video being a video distribution system Adobe Systems Incorporated owner. The video frames are transmitted using the proprietary RTMP protocol (Real Time Messaging Protocol). To access the video frames the client You must use a browser with Flash support. RTMP frames are send to the client encapsulated within the TLS protocol. This we allows to offer services of confidentiality, integrity, authenticity and does not repudiate the video sent at the same time as we can establish access control based on identity of the user. The use of cryptographic credentials Stored in cryptographic hardware (Token) allows the user can authenticate securely using TLS in front of the server web that in turn will also have a certificate and a password private

State of the art

In recent years there has been a spectacular hatching of different mechanisms for distribution Internet video If a few years ago there was a disparity of encoding and distribution formats competing to be the de facto standard on the Internet, the appearance of portals like YouTube or Google Video has completely revolutionized the stage standardizing it de facto. This proprietary scheme is in the actuality spreading through all those portals that want offer a similar service basically because of its simplicity for the end user and for its compatibility with all platforms.

Lately, interest in the development of video transmission systems over the Internet, such as can be seen in [Dapeng Wu Hou, Y.T. Wenwu Zhu Ya-Qin Zhang Peha. "Streaming video over the Internet: approaches and directions ". IEEE Transactions on Circuits and Systems for Video Technology, Mar 2001. Volume: 11, Issue: 3 On page (s): 282-300 ISSN: 1051-8215], [Xiao, Y. Du, X. Zhang, J. Hu, F. Guizani, S. "Internet Protocol Television (IPTV): The Killer Application for the Next-Generation Internet ", IEEE Communication Mag. Nov. 2007. Vol 45, pp. 126-134.] And [Eveline Veloso, Virgílio Almeida, Wagner Meira, Jr., Azer Bestavros, Shudong Jin, A hierarchical characterization of a live streaming media workload, IEEE / ACM Transactions on Networking (TON), v. 14 n.l, p. 133-146, February 2006.]. These systems are known commonly as IPTV.

There are previous IPTV patents based on set-top-boxes (STB). STBs are devices that connect to the distribution network and generate a signal compatible with the video input of the televisions. Examples are: [US 2006/0277316 A1. Yunchuan Wang, Wei Shu, Michael Her, "Internet protocol television"] and [US2008066131. CHANG HISAO M, ARELLANO JAVIER, "Authoring system for IPTV network"]. In the patent described herein the receiver or terminal system is a Personal computer (PC) with a browser and not an STB. The Navigator will be responsible for making the secure connection or tunnel not the STB as in [US 2007/0283385 A1. Chaoxin Charles Qiu, Diana Maria Cantu, "Methods and apparatus to provide media content created for a specific individual via IPTV "].

The most widespread rights management system Digital for multimedia content is the DRM (Digital Rigths Managment) It is based on an identity based license model to make sure that only the one who acquired those rights cannot Redistribute the content. In these cases the content incorporates a series of brands where the license is introduced. Patent Examples based on DRM systems are: [US 2006/0235800 A1. Jeff Furlong, Robert Laughlin Cookson, "Digital rights management for media streaming systems "] and [EP1903799. SUN CHAO," A METHOD FOR REALIZING PREVIEW OF IPTV PROGRAMS, AN ENCRYPTION APPARATUS, A RIGHT CENTER SYSTEM AND A USER TERMINAL "].

In this case the licenses are not managed but that the protection of the contents and the authentication of users are performed using the TLS protocol [T. Dieks, E. Rescola, RFC 4346: "The Transport Layer Security (TLS) Protocol Version 1.1 ", IETF, Networking group, Apr. 2006.]. Application examples of said protocol can be found in: TLS [Eun-Kyeong Kwon; Yong-Gu Cho; Ki-Joon Chae; "Integrated transport layer security: end-to-end security model between WTLS and TLS "Information Networking, 2001. Proceedings. 15th International Conference on 31 Jan. -2 Feb. 2001 Page (s): 65-71].

Explanation of the invention.

The connection is initiated by the browser when Try to access the multimedia content offered on a WEB server. The control of access to content is made from the cryptographic credentials (such as a digital certificate and the corresponding private key) presented by the user contained in Cryptographic Hardware (cryptographic token or device with Hardware cryptographic algorithms).

         \ newpage
      

The operation will be transparent to the user. You only have to worry about looking for the contents that you interest and connect your token to the PC.

The burden of management and control will fall on the servers, which as shown in figures 1 and 2, will consist mainly in:

?

Web Server: Search for content available.

?

Content servers: Multimedia data sources.

?

Coding Servers: encapsulate the content in frames.

?

Broadcast servers: establish an encrypted connection or tunnel through which transmits the information through a real time protocol (RTMP in the case of FLV).

         \ vskip1.000000 \ baselineskip
      

The servers can be understood as services software that could be hosted on a single physical server or distributed in several.

This system allows you to control access to content and therefore apply charging strategies per vision or flat access rates for defined periods of time (normally charged monthly or annually).

The broadcast server will be responsible for check if the certificates have been discharged or revoked to allow or not access to content.

Having cryptographic hardware allows that the user can access the contents in a secure way from any PC. The digital certificate is stored in said device. The data is transmitted encrypted by the connection of such so that a third party may not have access to them. The decryption system is in the token and so therefore, the private key does not leave it so it is not possible duplicate it

The system may allow:

?

Cancel reception when the token disconnect from the PC. To prevent multiple users Share a single token.

?

Retake the transmission in the point where it was interrupted if the user decides to connect the token and access the service from the same or another personal computer (service roaming).

         \ vskip1.000000 \ baselineskip
      

The industrial application model of this system is the same as in any conditional access system to multimedia content, very widespread today mainly thanks to Digital Television (both satellite, and terrestrial, like cable). In this case the receiver is not a television, if not a PC with a browser with Flash support and a token responsible for access control instead of a set-top-box

Registration and certificate revocation management to allow encrypted connections TLS must have an associated User payment management system. The token alone does not will allow the connection unless the information that the server will store associated with the identity of that user guaranteed by the digital certificate indicate that the owner of said certificate You have made the necessary payments to access the content.

Brief description of the drawings

Figure 1 shows a block diagram simplified with the proposed system architecture. The different parts that compose it are detailed below:

one.

Video sources

2.

Coding Server

3.

Broadcast servers

Four.

Transmission network.

5.

Web server.

6.

Terminal System or users.

         \ newpage
      

Figure 2 shows a block diagram generic client-server architecture Proposal for content access control. The different parts that compose it are detailed below:

one.

Servers for content coding multimedia.

2.

Video database.

3.

Server for encapsulating multimedia content and Server for establishing secure connections TLS

Four.

IP network distribution.

5.

PC-based Terminal System with browser with Flash support and crypto token with credentials digital

Claims (16)

1. A conditional content access system multimedia based on client-server architecture that you understand:

?

A personal computer (PC) as a customer

?

A Web service to offer contents.

?

Multimedia contents

?

A transmission network

?

A coding service or framework.

?

A broadcast service

?

A service to establish secure connections

?

A hardware system cryptographic.

           \ vskip1.000000 \ baselineskip
        

2. The system described in claim 1, where the services are on a single server. 3. The system described in claim 1, where the services are distributed in several servers 4. The system described in claim 1, where the content to which access is controlled is multimedia (audio, video and / or digital data) in Flash Video or FLV format. 5. The system described in claim 1, where the client PC has a Flash viewer or a browser with embedded Flash viewer. 6. The system described in claim 1, where the transmission network is an IP network. 7. The system described in claim 1, where the transmission network is a public access network. 8. The system described in claim 1, where the transmission network is a private access network. 9. The system described in claim 1, where the coding or network service is responsible for organize multimedia content in data frames following a preset format. 10. The system described in claim 1, where the coding or network service is responsible for organize multimedia content in data frames following a MPEG standard (Moving Pictures Experts Group). 11. The system described in claim 1, where the broadcast service uses the RTMP (Real Time) protocol Messaging Protocol). 12. The system described in claim 1, where the broadcast service uses the RTMPT (Real Time) protocol Messaging Protocol Tunneled). 13. The system described in claim 1, where the service to establish secure connections uses the TLS (Transport Layer Security) protocol. 14. The system described in claim 1, where a device is understood as cryptographic hardware electronic in charge of algorithm processing cryptographic 15. The system described in claim 1, where the cryptographic hardware is a token with credentials digital Understanding digital credentials a certificate digital issued by a Certificate Authority and its corresponding private key. 16. The system described in claim 1, which is used to manage a payment system for access to content.