Secure Bridging of Third-Party Digital Rights Management to Local Security

Abstract

Encrypted content from a content provider is received at a headend of a video programming distributor. The content provider is distinct from the video programming distributor. The content is decrypted and modified by blending a user-interface overlay with the content in a virtual set-top application associated with a set-top of a customer of the video programming distributor. The modified content is provided over a secure data link to a conditional-access encoder at the headend. The conditional-access encoder encrypts the processed content, which is then transmitted to a client device.

What is claimed is: 
     
         1 . A method, comprising:
 at a headend of a video programming distributor hosting a plurality of virtual set-top applications, each virtual set-top application corresponding to a client device:
 at a first virtual set-top application of the plurality of virtual set-top applications, the first virtual set-top application corresponding to a first client device:
 receiving encrypted content from a content provider, wherein the content provider is distinct from the video programming distributor; 
 decrypting the encrypted content in accordance with a first Digital Rights Management (DRM) protocol used by the content provider; 
 modifying the decrypted content, including blending a user-interface overlay, provided by a playback application executing at the headend of the video programming distributor, with the decrypted content to generate a new data stream; and 
 
 at a video programming distributor network:
 determining a second DRM protocol compatible with the first client device; 
 encrypting, via a conditional-access encoder, the new data stream using the second DRM protocol compatible with the first client device; and 
 transmitting, to the first client device, the data as encrypted by the conditional-access encoder. 
 
   
     
     
         2 . The method of  claim 1 , further comprising:
 at the first virtual set-top application, after modifying the decrypted content to generate the new data stream:
 encrypting the new data stream corresponding to the modified decrypted content from the content provider; 
 transmitting the encrypted new data stream over a secure data link from the first virtual set-top application to the video programming distributor network; and 
   at the video programming distributor network:
 decrypting the encrypted new data stream to generate decrypted data; 
 sending the decrypted data to the conditional-access encoder, wherein encrypting the new data stream comprises encrypting the decrypted data. 
   
     
     
         3 . The method of  claim 2 , wherein the encrypted new data stream is transmitted via a local network. 
     
     
         4 . The method of  claim 2 , wherein the encrypted new data stream is transmitted via a wired Ethernet link. 
     
     
         5 . The method of  claim 2 , wherein the secure data link comprises a bridged private network. 
     
     
         6 . The method of  claim 1 , wherein the playback application comprises an HTML5 application. 
     
     
         7 . The method of  claim 1 , wherein receiving the encrypted content, decrypting the encrypted content, and modifying the decrypted content are performed in a secure application server at a central location. 
     
     
         8 . The method of  claim 7 , wherein decrypting the encrypted content is performed using a key from a secure keybox in the secure application server. 
     
     
         9 . The method of  claim 1 , wherein receiving the encrypted content from the content provider comprises receiving the encrypted content from a content-distribution network associated with the content provider. 
     
     
         10 . The method of  claim 9 , wherein the encrypted content is received from the content-distribution network via the Internet. 
     
     
         11 . The method of  claim 1 , wherein the encrypted content comprises encrypted video. 
     
     
         12 . The method of  claim 11 , wherein the method further comprises processing the decrypted content to scale the video to fit a window of a screen. 
     
     
         13 . The method of  claim 1 , wherein the video programming distributor is a cable-TV company or a satellite-TV company. 
     
     
         14 . The method of  claim 1 , wherein the headend of the video programming distributor distributes the data as encrypted by the conditional-access encoder via the Internet. 
     
     
         15 . The method of  claim 1 , wherein the encrypted content comprises encrypted audio. 
     
     
         16 . The method of  claim 1 , wherein the encrypted content comprises an encrypted image. 
     
     
         17 . The method of  claim 1 , wherein the virtual set-top application is executed by a secure application server. 
     
     
         18 . The method of  claim 1 , further comprising:
 at a second virtual set-top application corresponding to a second client device:
 receiving second encrypted content from the content provider; 
 decrypting the second encrypted content in accordance with the first Digital Rights Management (DRM) protocol used by the content provider; 
 determining that the second client device supports user-interface overlay rendering; 
 upon determining that the second client device does support user-interface overlay rendering: 
 re-encrypting the second decrypted content from the content provider; 
 transmitting the re-encrypted second content over a secure data link from the second virtual set-top application to the video programming distributor network; 
   at the video programming distributor network:
 decrypting the re-encrypted second content to generate decrypted second data; 
 determining a third DRM protocol compatible with the second client device; 
 encrypting, via the conditional-access encoder, the decrypted second data using the third DRM protocol compatible with the second client device; and 
 transmitting, to the second client device (i) the second data as encrypted by the conditional-access encoder, and (ii) at least one user-interface overlay that has not been encrypted using the third DRM protocol. 
   
     
     
         19 . An electronic system, comprising:
 a secure application server of a video programming distributor hosting a plurality of virtual set-top applications, each virtual set-top application corresponding to a client device, comprising one or more processors and memory storing one or more programs configured to be executed by the one or more processors, the one or more programs including instructions for:
 at a first virtual set-top application of the plurality of virtual set-top applications, the first virtual set-top application corresponding to a first client device:
 receiving encrypted content from a content provider, wherein the content provider is distinct from the video programming distributor; 
 decrypting the encrypted content in accordance with a first Digital Rights Management (DRM) protocol used by the content provider; 
 modifying the decrypted content, including blending a user-interface overlay, provided by a playback application executing at the headend of the video programming distributor, with the decrypted content to generate a new data stream; and 
 
 at a video programming distributor network:
 determining a second DRM protocol compatible with the first client device; 
 encrypting, via a conditional-access encoder, the new data stream using the second DRM protocol compatible with the first client device; and 
 transmitting, to the first client device, the data as encrypted by the conditional-access encoder. 
 
   
     
     
         20 . A non-transitory computer-readable storage medium storing one or more programs for execution by one or more processors at a headend of a video programming distributor hosting a plurality of virtual set-top applications, each virtual set-top application corresponding to a client device, the one or more programs including instructions for:
 at a first virtual set-top application of the plurality of virtual set-top applications, the first virtual set-top application corresponding to a first client device:
 receiving encrypted content from a content provider, wherein the content provider is distinct from the video programming distributor; 
 decrypting the encrypted content in accordance with a first Digital Rights Management (DRM) protocol used by the content provider; 
 modifying the decrypted content, including blending a user-interface overlay, provided by a playback application executing at the headend of the video programming distributor, with the decrypted content to generate a new data stream; and 
   at a video programming distributor network:
 determining a second DRM protocol compatible with the first client device; 
 encrypting, via a conditional-access encoder, the new data stream using the second DRM protocol compatible with the first client device; and 
 transmitting, to the first client device, the data as encrypted by the conditional-access encoder.