Fine grain rights management of streaming content

Abstract

The present invention provides methods, apparatuses, and systems for delivering protected streaming content to a receiving device. In an aspect of the present invention, a broadcaster provides streaming content. To ensure viewers are properly authorized, the streaming content is encrypted with a traffic key. The traffic key is provided to the users via a key stream message, which is encrypted with a service key. The user obtains at least one rights object from a rights issuers and the at least one rights object includes the service key so that the streaming content may be used. The at least one rights object also contains information regarding usage rights that may be configured by the rights issuer so that, depending on the user and/or the receiving device, different rights may be available. The key stream message may include a program category variable value that indicates the type of content and in conjunction with the rights object, determines what usage rights exist for the streaming content.

What is claimed: 
     
         1 . A method comprising:
 encrypting a stream of data corresponding to a broadcast service, the data having different portions encrypted, respectively, by one or more traffic keys;   transmitting the stream of encrypted data corresponding to the broadcast service; and   transmitting an encrypted key stream message, the encrypted key stream message including the one or more traffic keys, wherein the encrypted key stream message is separate from the stream of encrypted data.   
     
     
         2 . The method of  claim 1  further comprising:
 providing a first rights object, the first rights object including a service key, wherein the service key enables decryption of the encrypted key stream message. 
 
     
     
         3 . The method of  claim 1 , wherein the transmission of the stream of encrypted data further comprises:
 transmitting a first program category variable value.   
     
     
         4 . The method of  claim 3 , wherein the transmission of the stream of encrypted data further comprises:
 transmitting a second program category variable value, wherein the first program category variable value is associated with a first rights issuer and the second program category variable value is associated with a second rights issuer.   
     
     
         5 . The method of  claim 4 , wherein the first and second program category variable values are provided in a vector, the first and second program category variable values respectively comprising a first position and a second position in the vector. 
     
     
         6 . The method of  claim 5 , wherein the first and second program category variable values include a two bit value. 
     
     
         7 . The method of  claim 6 , further comprising:
 providing a second rights object, a third rights object and a fourth rights object, wherein the first, second, third and fourth rights objects form a set of rights objects.   
     
     
         8 . The method of  claim 7 , wherein at least one of the first and second program category variable values corresponds to one of the first, second, third and fourth rights objects. 
     
     
         9 . The method of  claim 2 , wherein the first rights object includes a plurality of usage rights associated with a plurality of program category variable values, whereby the transmitted first program value corresponds to one of the plurality of usage rights. 
     
     
         10 . The method of  claim 1 , further comprising:
 changing the one or more traffic keys; and   repeating the encryption of the stream of data with the changed one or more traffic keys, the transmission of the stream of encrypted data, and the transmission of the encrypted key stream message including the changed one or more traffic keys.   
     
     
         11 . An apparatus comprising:
 at least one processor; and   at least one non-transitory memory including computer program code,   wherein the at least one non-transitory memory and the computer program code are configured to, with the at least one processor, cause the apparatus to perform at least the following:   encrypt a stream of data corresponding to a broadcast service, the data having different portions encrypted, respectively, by one or more traffic keys;   transmit the stream of encrypted data corresponding to the broadcast service; and   transmit an encrypted key stream message, the encrypted key stream message including the one or more traffic keys, wherein the encrypted key stream message is separate from the stream of encrypted data.   
     
     
         12 . The apparatus of  11 , wherein the apparatus to further perform at least the following:
 provide a first rights object, the first rights object including a service key, wherein the service key enables decryption of the encrypted key stream message.   
     
     
         13 . The apparatus of  claim 11 , wherein the transmission of the stream of encrypted data further comprises:
 transmit a first program category variable value.   
     
     
         14 . The apparatus of  claim 13 , wherein the transmission of the stream of encrypted data further comprises:
 transmit a second program category variable value, wherein the first program category variable value is associated with a first rights issuer and the second program category variable value is associated with a second rights issuer.   
     
     
         15 . The apparatus of  claim 14 , wherein the first and second program category variable values are provided in a vector, the first and second program category variable values respectively comprising a first position and a second position in the vector. 
     
     
         16 . The apparatus of  claim 15 , wherein the first and second program category variable values include a two bit value. 
     
     
         17 . The apparatus of  claim 16 , wherein the apparatus to further perform at least the following:
 provide a second rights object, a third rights object and a fourth rights object, wherein the first, second, third and fourth rights objects form a set of rights objects.   
     
     
         18 . The apparatus of  claim 17 , wherein at least one of the first and second program category variable values corresponds to one of the first, second, third and fourth rights objects. 
     
     
         19 . The apparatus of  claim 12 , wherein the first rights object includes a plurality of usage rights associated with a plurality of program category variable values, whereby the transmitted first program value corresponds to one of the plurality of usage rights. 
     
     
         20 . The apparatus of  claim 11 , further comprising:
 change the one or more traffic keys; and   repeat the encryption of the stream of data with the changed one or more traffic keys, the transmission of the stream of encrypted data, and the transmission of the encrypted key stream message including the changed one or more traffic keys.