System and method for protecting elementary bitstream incorporating independently encoded tile

Abstract

To provide a suitable system and method for protecting an elementary bitstream that incorporates an independently encoded tile.SOLUTION: There are provided a system and a method for partial frame encryption according to an embodiment of the present invention. In one embodiment, the method receives a video bitstream including a number of frames, each frame including a number of independently encoded compression units, and encrypts some of the number of compression units of the number of frames and generates an output bitstream that includes a number of independently encoded compression units, including some of encrypted compression units.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to the field of encryption and decryption of video information. More particularly, the present invention is directed to a method and system for generating a protected stream of compressed digital video using partial frame encryption. [Background technology]

[0002] Existing digital video compression techniques are complex processes that rely on a variety of techniques to convert (i.e., "encode") units of uncompressed video data into coded form. Such coding allows fewer bits to be used in representing the content of the original uncompressed video data. The resulting coded data can be transformed using an inverse process (i.e., "decoding") to produce digital video units of data that are either visually similar or identical to the original data. Modern techniques of digital video compression can achieve very high levels of compression.

[0003] The Motion Pictures Experts Group (MPEG) and the International Standards Organization (ISO) have produced various international standards that specify video compression and decompression algorithms for video encoding. These standards include MPEG-1, MPEG-2, MPEG-4, H.261, H.264, and the newer High Efficiency Video Coding (HEVC) standard, which has significantly improved compression efficiency over its predecessors. Specifically, HEVC can achieve twice the compression ratio at the same subjective quality compared to the previous H.264 standard. To achieve these compression optimizations, the HEVC standard has introduced several new tools designed specifically for parallel processing of video content on multi-core processor architectures. Specifically, many smartphone and tablet architectures currently available on the market utilize multi-core processors and are therefore capable of playing HEVC content using those multi-core architectures. Furthermore, with the increase in video traffic over networks, the HEVC standard provides certain tools that reduce some of the bandwidth requirements for distributing high-quality content.

[0004] Protecting the distribution of digital content from piracy and other types of illegal distribution is yet another concern for content providers. The term Digital Rights Management (DRM) is utilized to describe access control techniques used to control access to and / or copying of digital content. DRM systems typically involve the use of cryptographic information to control access to or protect portions of the content. Content protection is typically achieved using cryptographic information, such as (but not limited to) one or more encryption keys to encrypt the content.

[0005] Currently, there are various types of encryption schemes that can be used to protect data. In the digital world, encryption is often implemented by using a set of bits of some length known as a "key" to perform a predictable transformation on a unit of data. This results in another unit of data that cannot be "read" without knowledge of the key used to perform the transformation. The encryption process is easily reversible only to the extent that the encryption key or its counterpart (e.g., a "public" key) is available for use in converting or "decrypting" the encrypted data back to its original form. Video data is often encrypted using symmetric block ciphers, for example, according to the Data Encryption Standard (DES) or the Advanced Encryption Standard (AES). The specific techniques used to encrypt digital content may nevertheless consume additional processing resources that must be considered with respect to the encoding and distribution of content over a network. Summary of the Invention [Means for solving the problem]

[0006] According to an embodiment of the present invention, a system and method for partial frame encryption is disclosed. In one embodiment, the method receives a video bitstream including several frames, each frame including several independently encoded compression units within the frame, encrypts a portion of each of several compression units within the several frames, and generates an output bitstream including several independently encoded compression units including the encrypted portions of the compression units.

[0007] In a further embodiment of the present invention, a compression unit is an independently decodable portion of a particular frame of video such that it does not depend on another compression unit within the particular frame in order to be decoded.

[0008] In yet a further embodiment of the present invention, the method further parses the metadata header to identify a location of the compression unit within a frame of the video, and encrypts a portion of the video bitstream based on the location of the compression unit.

[0009] In yet a further embodiment of the present invention, the method encrypts a portion of each compression unit of a plurality of compression units by determining that the compression unit is enabled based on information in a header associated with the video bitstream.

[0010] Still in yet a further embodiment of the present invention, the method further comprises encrypting a portion of each compression unit within a frame of the video.

[0011] In yet another embodiment of the present invention, the portion is selected from the group consisting of: i) the first N bytes of the compression unit, ii) the last N bytes of the compression unit, iii) a central portion of N bytes within the compression unit, and v) a pattern of N bytes within the compression unit.

[0012] In yet another embodiment of the present invention, the compression units are tiles in the High Efficiency Video Coding (HEVC) standard, and the video bitstream is coded based on the HEVC standard.

[0013] Still further, in yet another embodiment of the present invention, the method further includes parsing a picture parameter set (PPS) of the HEVC video bitstream to identify a structure of tiles within the video bitstream, and encrypting multiple portions of the tiles based on the structure.

[0014] Again, in another embodiment of the present invention, the method further encrypts a portion of each of the several compression units using a common encryption format (CENC) for encrypting multiple portions.

[0015] Yet another embodiment of the present invention includes a content encoder including a processor configured to communicate with a memory, the memory containing an encoder application that directs the processor to receive a video bitstream including several frames, each frame including several independently encoded compression units within the frame, encrypt a portion of each compression unit of the several compression units in the several frames, and generate an output bitstream including the several independently encoded compression units including the encrypted portions of the compression units.

[0016] In another embodiment of the present invention, a compression unit is an independently decodable portion of a particular frame of video such that it does not depend on other compression units within that particular frame in order to be decoded.

[0017] In yet another embodiment of the present invention, the encoder application further instructs the processor to parse the metadata header to identify the location of the compression unit within a frame of the video, and to encrypt a portion of the video bitstream based on the location of the compression unit.

[0018] In yet another embodiment of the present invention, the step of encrypting a portion of each of the number of compression units includes determining that the compression unit is enabled based on information in a header associated with the video bitstream.

[0019] Again, in yet another embodiment, the encoder application further directs the processor to encrypt a portion of each compression unit in a frame of video.

[0020] Again, in another embodiment of the present invention, the portion is selected from the group consisting of: i) the first N bytes of the compression unit, ii) the last N bytes of the compression unit, iii) a central portion of N bytes within the compression unit, and v) a pattern of N bytes within the compression unit.

[0021] In another further embodiment of the present invention, the compression units are tiles in the High Efficiency Video Coding (HEVC) standard, and the video bitstream is coded based on the HEVC standard.

[0022] Again, in yet another embodiment of the present invention, the encoder application further instructs the processor to parse a picture parameter set (PPS) of the HEVC video bitstream to identify the structure of tiles within the video bitstream, and to encrypt multiple portions of the tiles based on the structure.

[0023] Again, in a still further embodiment of the present invention, encrypting a portion of each compression unit of the plurality of compression units includes using a common encryption format (CENC) to encrypt the portions.

[0024] In another embodiment of the present invention, a content decoder includes a processor configured to communicate with a memory, the memory containing a decoder application that directs the processor to receive a video bitstream including several frames, each frame including multiple independently encoded compression units within the frame, decrypt a portion of each of the several compression units within the several frames, and generate decoded video that is output for playback.

[0025] In yet another embodiment of the present invention, a compression unit is an independently decodable portion of a particular frame of video such that it does not depend on other compression units within that particular frame in order to be decoded.

[0026] Again, in yet another embodiment of the present invention, the decoder application further instructs the processor to parse the metadata header to identify the location of the compression unit within the frame of the video, and to decrypt a portion of the video bitstream based on the location of the compression unit.

[0027] Again, in yet another embodiment of the present invention, the step of decrypting a portion of each of the number of compression units includes determining that the compression unit is enabled based on information in a header associated with the video bitstream.

[0028] In yet another further embodiment of the present invention, the decoder application further directs the processor to decode a portion of each compression unit in a frame of video.

[0029] Again, in yet another embodiment of the present invention, the portion is selected from the group consisting of: i) the first N bytes of the compression unit, ii) the last N bytes of the compression unit, iii) a central portion of N bytes within the compression unit, and v) a pattern of N bytes within the compression unit.

[0030] Still in a further embodiment of the present invention, the compression unit is a tile in the High Efficiency Video Coding (HEVC) standard, and the video bitstream is decoded based on the HEVC standard.

[0031] Yet, in another embodiment of the present invention, the decoder application further instructs the processor to parse a picture parameter set (PPS) of the HEVC video bitstream to identify the structure of tiles within the video bitstream, and to decode portions of the tiles based on the structure.

[0032] In yet another embodiment of the present invention, decrypting a portion of each of the plurality of compression units includes using a common encryption format (CENC) to decrypt the portions. The present specification also provides, for example, the following items: (Item 1) A non-transitory machine-readable medium containing processor instructions, execution of the instructions by a processor causing the processor to: receiving a video bitstream comprising a plurality of frames, each frame comprising a plurality of independently encoded compression units within said frame; encrypting a portion of each of a plurality of compression units in a plurality of frames; generating an output bitstream comprising the plurality of independently encoded compressed units, including the encrypted portions of the compressed units; A non-transitory machine-readable medium for causing a process to occur, comprising: (Item 2) Item 10. The non-transitory machine-readable medium of item 1, wherein a compression unit is an independently decodable portion of a particular frame of video such that it does not depend on another compression unit within the particular frame to be decoded. (Item 3) parsing a metadata header to identify a location of the compression unit within a frame of the video; encrypting a portion of the video bitstream based on the location of the compression unit; Item 1. The non-transitory machine-readable medium of item 1, further comprising: (Item 4) 2. The non-transitory machine-readable medium of claim 1, wherein encrypting the portion of each compression unit of the plurality of compression units includes determining that a compression unit is enabled based on information in a header associated with the video bitstream. (Item 5) Item 10. The non-transitory machine-readable medium of item 1, further comprising encrypting a portion of each compression unit in a frame of the video. (Item 6) Item 6. The non-transitory machine-readable medium of item 5, wherein the portion is selected from the group consisting of: i) the first N bytes of the compression unit, ii) the last N bytes of the compression unit, iii) a central portion of N bytes within the compression unit, and iv) a pattern of N bytes within the compression unit. (Item 7) Item 1. The non-transitory machine-readable medium of item 1, wherein the compression units are tiles within a High Efficiency Video Coding (HEVC) standard, and the video bitstream is encoded based on the HEVC standard. (Item 8) parsing a picture parameter set (PPS) of the HEVC video bitstream to identify a structure of the tiles within the video bitstream; encrypting portions of the tiles based on the structure; 8. The non-transitory machine-readable medium of item 7, further comprising: (Item 9) 2. The non-transitory machine-readable medium of claim 1, wherein encrypting the portion of each compression unit of the plurality of compression units includes using a Common Encryption Format (CENC) to encrypt the portions. (Item 10) 1. A content encoder comprising: a processor configured to communicate with a memory, the memory containing an encoder application; Equipped with The encoder application causes the processor to: receiving a video bitstream comprising a plurality of frames, each frame comprising a plurality of independently encoded compression units within said frame; encrypting a portion of each of a plurality of compression units in a plurality of frames; generating an output bitstream comprising the plurality of independently encoded compressed units, including the encrypted portions of the compressed units; The content encoder is instructed to: (Item 11) Item 11. The content encoder of item 10, wherein a compression unit is an independently decodable portion of a particular frame of video such that it does not depend on another compression unit within the particular frame to be decoded. (Item 12) The encoder application further causes the processor to: Parsing the metadata header to identify the location of the compression unit within a frame of the video; encrypting a portion of the video bitstream based on the location of the compression unit; Item 11. A content encoder according to item 10, instructing the encoder to: (Item 13) Item 11. The content encoder of item 10, wherein encrypting the portion of each compression unit of the plurality of compression units includes determining that the compression unit is enabled based on information in a header associated with the video bitstream. (Item 14) Item 11. The content encoder of item 10, wherein the encoder application further instructs the processor to encrypt a portion of each compression unit in a frame of video. (Item 15) Item 15. The content encoder of item 14, wherein the portion is selected from the group consisting of: i) the first N bytes of the compression unit, ii) the last N bytes of the compression unit, iii) a central portion of N bytes within the compression unit, and iv) a pattern of N bytes within the compression unit. (Item 16) Item 11. The content encoder of item 10, wherein the compression units are tiles within the High Efficiency Video Coding (HEVC) standard, and the video bitstream is encoded based on the HEVC standard. (Item 17) The encoder application further causes the processor to: parsing a picture parameter set (PPS) of the HEVC video bitstream to identify a structure of the tiles within the video bitstream; encrypting portions of the tiles based on the structure; Item 17. A content encoder according to item 16, instructing the encoder to: (Item 18) Item 11. The content encoder of item 10, wherein encrypting the portion of each compression unit of the plurality of compression units includes using a common encryption format (CENC) to encrypt the portions. (Item 19) 1. A content decoder, comprising: a processor configured to communicate with a memory, the memory containing a decoder application; Equipped with The decoder application causes the processor to: receiving a video bitstream comprising a plurality of frames, each frame comprising a plurality of independently encoded compression units within said frame; Decoding a portion of each of the plurality of compression units in the plurality of frames; generating an output decoded video for playback; Instructs the content decoder to: (Item 20) 20. The content decoder of claim 19, wherein a compression unit is an independently decodable portion of a particular frame of video such that it does not depend on another compression unit within the particular frame in order to be decoded. (Item 21) The decoder application further causes the processor to: Parsing the metadata header to identify the location of the compression unit within a frame of the video; decrypting a portion of the video bitstream based on the location of the compression unit; 20. A content decoder according to item 19, instructing the decoder to: (Item 22) 20. The content decoder of claim 19, wherein decrypting the portion of each of the plurality of compression units includes determining that a compression unit is enabled based on information in a header associated with the video bitstream. (Item 23) 20. The content decoder of claim 19, wherein the decoder application further directs the processor to decode a portion of each compression unit in a frame of video. (Item 24) Item 24. The content decoder of item 23, wherein the portion is selected from the group consisting of: i) the first N bytes of the compression unit, ii) the last N bytes of the compression unit, iii) a central portion of N bytes within the compression unit, and iv) a pattern of N bytes within the compression unit. (Item 25) 20. The content decoder of claim 19, wherein the compression units are tiles within a High Efficiency Video Coding (HEVC) standard, and the video bitstream is decoded based on the HEVC standard. (Item 26) The decoder application further causes the processor to: parsing a picture parameter set (PPS) of the HEVC video bitstream to identify a structure of the tiles within the video bitstream; Item 26. A content decoder according to item 25, which directs decoding of portions of the tile based on the structure. (Item 27) 20. The content decoder of claim 19, wherein decrypting the portion of each compression unit of the plurality of compression units includes using a common encryption format (CENC) to decrypt the portions. [Brief explanation of the drawings]

[0033] [Figure 1] FIG. 1 is a system diagram of a video encoding and distribution system according to an embodiment of the present invention. [Figure 2A] FIG. 2A conceptually illustrates a content encoder configured to generate partially encrypted content, according to an embodiment of the present invention. [Figure 2B] FIG. 2B conceptually illustrates a content server configured to manage and distribute partially encrypted content, according to an embodiment of the present invention. [Figure 2C] FIG. 2C conceptually illustrates a playback device configured to receive and play partially encrypted content, according to an embodiment of the present invention. [Figure 3] FIG. 3 illustrates a process for partially encrypting content according to an embodiment of the present invention. [Figure 4] FIG. 4 illustrates a process for partially encrypting content according to an embodiment of the present invention. [Figure 5] FIG. 5 illustrates a process for decrypting and playing partially encrypted content according to an embodiment of the present invention. [Figure 6] FIG. 6 illustrates an example of tiles within a frame of video, according to an embodiment of the present invention. [Figure 7] FIG. 7 illustrates an example of a syntax structure for tiles in an HEVC video, according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0034] As described above, different techniques may be used to encrypt content, each of which may consume different amounts of processing resources, in addition to the processing expense associated with the compression technique (e.g., H.264 or HEVC) utilized to compress or encode the video content. Accordingly, many embodiments of the present invention can achieve efficiency in generating protected compressed video sequences having encrypted frames by encrypting only portions of frames rather than entire frames. These techniques may generally be referred to as “partial frame encryption” because they encrypt only portions of frames. One or more portions of a frame of video to be encrypted may be defined within the frame by a starting location and a length. Often, this information is provided in a header associated with the frame and may be used by a decoder to identify the location of the encrypted portion of the frame for decryption.

[0035] In many video compression formats, such as H.264 / MPEG-4 AVC (Advanced Video Coding), there are dependencies within frames (due to the compression algorithm) and across frames. Due to the dependencies, when an encrypted part cannot be decrypted and therefore cannot be played back properly, other parts within the frame or in other frames that depend on the encrypted part also cannot be played back. Therefore, in an AVC-encoded bitstream, encrypting the first x number of bytes of a frame or sequence of units is often sufficient to prevent decoding of many other parts of the frame or other units.

[0036] Many embodiments may utilize the ISO / IEC 23001-7:2012 Common Encryption Scheme for Encryption (CENC) standard, which is an industry encryption standard that defines a standard encryption and key mapping method that can be utilized by one or more digital rights and key management systems (DRM systems) to enable decryption of the same file using different DRM systems. This method allows for multiple, non-contiguous portions of a frame to be encrypted.

[0037] Some video compression formats, such as High Efficiency Video Coding (HEVC), enable simultaneous parallel processing of different portions of a frame video, allowing multiple portions of a frame to be coded and decoded independently without referencing or relying on information in other portions. One such feature designed to enable parallel processing is "tiling" in HEVC. Specifically, by dividing an image into square regions (tiles), where each tile consists of several coding tree units (CTUs), tiles can be used to code and decode multiple portions of a frame simultaneously by different processors.

[0038] A tile can be contained within a single NAL (Network Abstraction Layer) unit or slice. Similar independently decodable portions of a frame can be referred to as compression units (i.e., tiles in HEVC) across different coding formats. Compression units can be processed independently of each other, enabling parallelism when decoding the bitstream. In a tile-enabled HEVC coded stream, if only the first x bytes of a video NAL unit or frame are encrypted, the other portions (tiles) may be fully decodable without the need to decrypt the encrypted portions due to their independence from the encrypted portions.

[0039] Thus, in many embodiments, the security of an encoded bitstream having tiles (or other compression units) can be improved by encrypting at least a portion of multiple tiles within a frame to make more of the frame unrecoverable without decrypting the encrypted portion. In some embodiments, an encoder and / or encoding process can be designed to decode at least a portion of the bitstream to determine where the tiles are located and then encrypt multiple portions of the tiles. The encoder may obtain information about the structure and / or location of the tiles to encrypt information within multiple tiles and protect more of the bitstream from being decrypted without decrypting it. A method for obtaining this information about tiles (or other independently decodable units) may include parsing NAL unit headers to determine the starting locations of one or more tiles. Systems and methods for partial frame encryption of compression units according to embodiments of the present invention are discussed further below.

[0040] System Architecture for Partially Encoding and Playing Video Using Partial Frame Encryption As discussed above, many new compression standards provide new tools that enable parallel processing (i.e., encoding and decoding) of video content on multi-core architectures. These tools include, for example, the use of “tiles” in the HEVC standard, among several types of similar, independently decodable compression units that can be utilized to divide frames of video content into separate decodable units. As described throughout this application, a compression unit (e.g., a tile in HEVC) may generally refer to a divided and / or independently decodable portion of a single frame of video for a given encoding standard. Furthermore, a “tile” is a type of compression unit introduced within the HEVC standard. While many of the following examples describe partial frame encryption of tiles based on video compressed according to the HEVC standard, in accordance with embodiments of the present invention, partial frame encryption may also be used to encrypt video compressed according to any other standard that uses similar types of compression units to divide video frames, as appropriate for the requirements of a specific application.

[0041] Furthermore, to protect digital content compressed using independently decodable compression units, certain encryption techniques may be used that apply partial frame encryption to one or more portions of a compression unit (i.e., tile) within a frame of video. Specifically, in newer standards (e.g., HEVC) that are designed to enable independent decoding of compression units within a frame of video, it may no longer be sufficient to encrypt only a portion of an entire video frame (i.e., video image), based on compression standard designs in which other portions may have inter-frame dependencies that would require proper decryption of the encrypted frame. As discussed above, in these older compression standards, due to dependencies between different portions of a single video frame, when an encrypted portion cannot be decrypted and therefore properly played back, other portions within the frame or other frames that depend on the encrypted portion also cannot be played back. Thus, in many embodiments, partial frame encryption may be applied to multiple portions of one or more compression units within a frame of video. A system for encoding video content using partial frame encryption according to an embodiment of the present invention is illustrated in FIG. 1.

[0042] System 100 includes a content encoder 102 configured to encode source media into encoded video. In some embodiments, the content encoder may encode the content using a compression standard (e.g., the HEVC standard) that enables parallel processing of the content, for example, by generating compression units (e.g., tiles) within each frame of video that enable independent encoding / decoding of multiple portions of the frame without reference to other portions of the frame. Specifically, in some embodiments, the content encoder may encode the content using the HEVC standard to encode frames of video content. The HEVC standard may also generate one or more independently decodable tiles for each frame of video.

[0043] In addition to encoding frames of video based on a compression standard (e.g., HEVC), in many embodiments, the content encoder 106 may also encrypt portions of the video content to protect the content from illegal distribution. To reduce the overhead associated with encrypting video content, in many embodiments, the content encoder 106 encodes the video content using partial frame encryption, whereby only a portion of one or more compression units (i.e., tiles) within a frame of video is encrypted (rather than encrypting the entire frame of video content). In some embodiments, the content encoder encrypts the first x number of bytes of each tile within a frame of video. Other embodiments may encrypt different portions of the tiles, including x bytes located anywhere within the bitstream, the last x bytes, and any other combination of bytes within the tile, as appropriate for the requirements of a particular application. In some embodiments, the content encoder may encrypt the same portions of all tiles within a frame. In other embodiments, the content encoder may encrypt different portions of different tiles. In some embodiments, the content encoder may encrypt portions of only some tiles (e.g., less than all tiles) within a frame of video. As can be easily understood, a container file containing encrypted video may include a separate DRM track containing information regarding the location of the encrypted portions of tiles within a frame and / or cryptographic information used to encrypt all or each of the encrypted portions.

[0044] In some embodiments, the content encoder 106 stores the content in a Matroska (MKV) container file. The Matroska container is a media container developed as an open standards project by the Matroska nonprofit organization (Aussonne, France). The Matroska container is based on the Extensible Binary Meta Language (EBML), a binary derivative of the Extensible Markup Language (XML). Decoding of the Matroska container is supported by many consumer electronics (CE) devices. In other embodiments, any of a variety of container file formats can be used, as appropriate for the requirements of a particular application, including (but not limited to) the MP4 container file format specified by the Motion Picture Experts Group as MPEG-4 Part 14.

[0045] In some embodiments, after the content encoder 106 compresses and / or encrypts the video sequence, the content encoder 106 uploads the encoded video to the content server 102 .

[0046] In many embodiments, the content server 102 facilitates the distribution of source media to one or more playback devices 108-114. The content server 102, according to some embodiments of the present invention, may be responsible for storing protected content for distribution to the playback devices. In many embodiments, the content server receives and processes download requests from various playback devices 108-114 that wish to download encoded video. In some embodiments, a device may request either (i) downloading the entire file or (ii) receiving streamed video for playback in either an incremental or adaptive streaming mode. When the distribution server receives a download request from a playback device, it can provide the encoded video to the playback device for storage and / or playback.

[0047] The downloaded video file may include one or more headers containing data describing the structure of compression units (e.g., tiles in HEVC encoded video) within frames of the video. The headers may include pointers to the starting locations of one or more tiles. In some embodiments, the locations of the tiles within an encoded HEVC video sequence may be specified in a Picture Parameter Structure (PPS), which provides information about the tile structure within one or more frames of the video. In some embodiments, tiles may be fixed at certain locations within a frame, while in other embodiments, tiles may be in different locations for different frames of the video. A decoder on the playback device may use this information to determine the portions of frames that need to be decoded to play the video file.

[0048] In some embodiments, the content server 102 receives stream requests from various playback devices and later streams the encoded video to the playback devices for progressive playback and / or as part of an adaptive bitrate streaming system. In some embodiments, the various playback devices may use HTTP or another suitable stateless protocol to request streams over a network 104, such as the Internet. In some embodiments, the various playback devices may use RTSP, whereby the distribution server records the state of each playback device and determines which video to stream based on instructions received from the playback device and stored data representing the state of the playback device.

[0049] In some embodiments, a DRM server 116 (Digital Rights Management) facilitates authorization and access to source media, including managing the keys needed to encrypt / decrypt the source media.

[0050] A DRM server 116 according to an embodiment of the present invention may be responsible for storing protected streams and / or files of content for distribution (e.g., streaming and / or download) to playback devices. The DRM server may also store common cryptographic information used to protect the content. In some embodiments, the common cryptographic information is identified using an identifier associated with the common cryptographic information and a portion of the content.

[0051] In the illustrated embodiment, the playback devices include personal computers 108-110 and mobile phones 112-114. In other embodiments, the playback devices may include consumer electronic devices such as DVD players, Blu-ray players, televisions, set-top boxes, video game consoles, tablets, and other devices capable of connecting to a server via HTTP and playing encoded video.

[0052] In the illustrated embodiment, the content encoder, content server, and DRM server are server applications configured to run on server computer hardware. In other embodiments, the content encoder, content server, and DRM server may be any processing device that includes a processor and has sufficient resources to perform encryption, distribution, and digital rights management of source media, including, but not limited to, video, audio, and / or subtitles. While a specific architecture is shown in Figure 1, any of a variety of architectures that allow a playback device to request video encoded using partial frame encryption can be utilized, as appropriate for the requirements of a specific application according to embodiments of the present invention.

[0053] The basic architecture of a content encoder 202 according to an embodiment of the present invention is illustrated in Figure 2A. The content encoder 202 includes a processor 204 in communication with non-volatile memory 208, volatile memory 206, and a network interface 214. In the illustrated embodiment, the non-volatile memory includes a content encoder application 210 that configures the processor to encode content 212. In some embodiments, the content encoder application 210 encrypts the content using partial frame encryption such that only portions of one or more compression units (e.g., tiles) are encrypted within a frame of video, rather than entire frames, to reduce the overhead associated with encrypting compressed video.

[0054] In some embodiments, the network interface 214 may be in communication with the processor 204, the volatile memory 206, and / or the non-volatile memory 208. Although a particular content encoder architecture is illustrated in Figure 2A, any of a variety of architectures can be utilized to implement a content encoder according to embodiments of the present invention, including an architecture in which the content encoder application is located on a disk or some other form of storage device and loaded into volatile memory at runtime.

[0055] The basic architecture of a content server 222 according to an embodiment of the present invention is illustrated in Figure 2B. The content server 222 includes a processor 224 in communication with non-volatile memory 228, volatile memory 226, and a network interface 234. In the illustrated embodiment, the non-volatile memory includes a content distribution application 230 that configures the processor to distribute content 232. In some embodiments, the network interface 234 may be in communication with the processor 224, the volatile memory 226, and / or the non-volatile memory 228. Although a specific content server architecture is illustrated in Figure 2B, any of a variety of architectures can be utilized to implement a content server according to an embodiment of the present invention, including an architecture in which the content distribution application resides on a disk or some other form of storage device and is loaded into volatile memory at runtime.

[0056] The basic architecture of a playback device according to an embodiment of the present invention is illustrated in Figure 2C. The playback device 252 includes a processor 254 in communication with non-volatile memory 258, volatile memory 256, and network interface 240. In the illustrated embodiment, the non-volatile memory includes a decoder application 260 that configures the processor to decode content 262. In some embodiments, the decoder application 260 uses information provided in the video container file and / or video stream to identify the location of compression units within frames of the video, and decrypts only certain portions of the compression units to decode the video.

[0057] In some embodiments, network interface 264 may communicate with processor 254, volatile memory 256, and / or non-volatile memory 258. Although a particular playback device architecture is illustrated in Figure 2C, any of a variety of architectures can be utilized to implement a playback device according to embodiments of the present invention, including an architecture in which a decoder application is located on a disk or some other form of storage device and loaded into volatile memory at runtime.

[0058] Systems and methods for partial frame encryption As discussed above, some video compression formats (e.g., HEVC) allow multiple portions of a frame (e.g., compression units or tiles) to be independently encoded and decoded without referencing or relying on information in other portions of the frame (or other frames). These independently decodable portions of a frame may be referred to as compression units across different coding formats. Thus, during encryption of a stream with independent compression units, if only the first x bytes of the frame are encrypted, the other portions (compression units or tiles) may be fully decodable without the need to decrypt the encrypted portions of the compression units due to their independence from the encrypted compression units. Thus, the security of an encoded bitstream having tiles (or other compression units) can be improved by encrypting at least a portion of multiple tiles within a frame to make more portions of the frame unrecoverable without decrypting the encrypted portions. A process for partial frame encryption of compression units of a video bitstream according to an embodiment of the present invention is illustrated in FIG. 3.

[0059] The process receives (at 302) video data. In some embodiments, the process may download the video data from one or more content distributors. In other embodiments, the process may stream the video data while the video is playing.

[0060] The process determines (at 304) the locations of multiple compression units within the video data. The locations may be determined based on information provided by one or more headers associated with a frame of video. In some embodiments, the headers may provide information regarding the starting location of each compression unit within the frame. In some embodiments, the location of each compression unit may be fixed within each frame of video and therefore may not need to be identified by a header. For example, the encoder may be pre-programmed with information regarding the structure of the video sequence.

[0061] The process determines (at 306) a portion of each compression unit within a frame of video to encrypt. In some embodiments, the process determines that a fixed x bytes of each compression unit should be encrypted. In some embodiments, the process determines different portions of different compression units based on characteristics of the compression units. In other embodiments, the process may encode the middle or last x number of bytes in one or more compression units for a frame of video. In some embodiments, the process may not encrypt certain frames of video while encrypting only portions of other frames of the video. As can be readily appreciated, the specific portions of a particular frame to be encrypted and the manner of encryption will typically depend on the requirements of the application.

[0062] The process encrypts (at 308) the portions of the compression unit. In some embodiments, the process encrypts the portions using standard DES and / or AES encryption. Other embodiments may use other encryption mechanisms as appropriate for the requirements of a particular application.

[0063] The process generates (at 310) an output bitstream containing the compressed units with the encrypted portions. The process then ends.

[0064] Although a specific process for encrypting portions of a compression unit is described in FIG. 3, any of a variety of processes may be utilized to encrypt portions of a compression unit as appropriate for the requirements of a particular application according to an embodiment of the present invention.

[0065] (Overview of the HEVC standard) As discussed above, the HEVC video compression standard includes several new tools designed for playback of video content using multi-core architectures that support parallel processing. These tools include wavefront parallel processing (WPP) and tiling, in addition to a slice structure. When WPP and / or tiling are used, a video bitstream corresponding to one image may be packetized into independently decodable subsets of the bitstream. Specifically, HEVC includes independently decodable tiles that divide a frame of video into rectangular regions of a certain size. An example of tiles within a frame of video according to an embodiment of the present invention is illustrated in FIG. 6. Specifically, FIG. 6 is a diagram illustrating an example of evenly dividing a frame in the horizontal and vertical dimensions into nine tiles, from tile 1 in the upper left corner to tile 9 in the lower right corner. Each tile includes a coding tree unit.

[0066] Tile-related parameters may be signaled in a Picture Parameter Set (PPS) in HEVC. Within a video sequence, different pictures may be allowed to use different PPSs. Tile parameters may vary from picture to picture within the same video sequence. In most video applications, the number of tiles and the locations of the tiles are likely to remain the same within a video sequence (e.g., a series of images), but situations may arise where not only the configuration of tiles may be allowed to vary from picture to picture within the same video sequence, but also the groups of tiles may be allowed to vary from picture to picture.

[0067] Figure 7 illustrates an example of a syntax structure for tiles in a picture parameter set (PPS) in an HEVC video. If tiles_enabled_flag is turned on, the number of tiles in each dimension may be signaled. If tiles are uniformly sized (e.g., uniform_spacing_flag is 1), no additional information may be signaled. The width and height of the tiles may be signaled. For example, as shown in Figure 7, num_tile_columns_minus1 and num_tile_rows_minus1 may be set to 2, and uniform_spacing_flag may be set to 1.

[0068] The encoder may change how tiles are divided for each frame by signaling a new PPS with new tile division parameters. In many embodiments, tiles need not be uniformly sized compared to each other or remain the same size compared to the same tiles in previous instances. Specifically, the encoder may signal a new PPS with new tile division parameters that will apply to a new set of one or more frames.

[0069] (Partial frame encryption in HEVC) As discussed above, the HEVC standard introduces certain tools that support high-level parallelism. Specifically, HEVC includes tiles, which allow a frame to be divided into rectangular regions, which can then be independently encoded and decoded. A frame may be uniformly or non-uniformly divided into tiles. The entry point of each tile may be defined in a slice header. To enable partial encryption of video files using the HEVC standard, many embodiments of the present invention may partially encrypt multiple tiles to encrypt video content. A process for partial encryption of HEVC tiles according to an embodiment of the present invention is illustrated in FIG. 4.

[0070] The process determines (at 402) whether a tile is enabled. In many embodiments, when a tile is enabled, the bitstream may contain an entry point offset that indicates the starting location of each image partition, which is necessary for each core to immediately access the partition.

[0071] The process determines (at 404) the structure of NAL units within a frame and / or bitstream.

[0072] The process determines (at 406) the structure of tiles within the NAL unit. In some embodiments, the process parses the NAL header to determine the starting location of each tile within a frame of video. In some embodiments, HEVC tiles may divide an image into rectangular regions of a certain size. The parameter structure of tiles may be specified in HEVC in the Picture Parameter Set (PPS), Video Usability Information (VUI), and / or Supplementary Enhancement Information (SEI) messages. An example of a PPS in HEVC is illustrated in FIG. 7. If tiles_enabled_flag is turned on, the number of tiles in each dimension may be signaled. In some embodiments, if the tiles are uniformly sized (e.g., if uniform_spacing_flag is 1), no additional information may be signaled. The PPS may also signal the width and height of the tiles.

[0073] The process selects (at 408) some NAL units. In some embodiments, the process may select all of the NAL units. In certain embodiments, the process may select one or more NAL units.

[0074] The process selects (at 410) several tiles within each selected NAL unit. In some embodiments, the encoder may change how tiles are divided per image by signaling a new PPS with new tile division parameters. Figure 7 illustrates an example of signaling tiles within a PPS. In some embodiments, tiles may be different sizes compared to each other or compared to the same tile in a previous instance. In some embodiments, the encoder may signal a new PPS with new tile division parameters for each new image or when the tile partition changes from the previous image.

[0075] The process encrypts at least a portion of a selected tile. In some embodiments, the process may encrypt the first x number of bytes, the last x number of bytes, or a certain x number of bytes located within a certain portion of the tile's bitstream. In some embodiments, the process may encrypt several blocks within the tile. Other embodiments may encrypt other portions of the tile as appropriate for the requirements of a particular application. In many embodiments, the process encrypts portions of the tile using the Common Encryption Format (CENC), which uses a common specification for how to encrypt bitstreams. CENC defines an industry-standard encryption and key mapping method that can be used by DRM systems to enable file decryption. The scheme works by defining a common format for encryption-related metadata needed to decrypt protected streams. The scheme leaves the details of copyright mapping, key acquisition and storage, and DRM compliance rules, among other considerations, to DRM systems that support the CENC scheme. Furthermore, in many embodiments, the encryption information may be stored within the MKV container.

[0076] The process then ends. Although a particular process for encrypting a portion of a tile in HEVC video content is described in Figure 4, any of a variety of processes may be utilized to encrypt multiple portions of a tile, as appropriate for the requirements of a particular application according to embodiments of the present invention.

[0077] (Decrypt partially encrypted video) A process for decrypting partially encrypted video according to an embodiment of the present invention is illustrated in FIG.

[0078] The process receives (at 502) encrypted video data. In some embodiments, the process may download, stream, and / or stream to download video content from a content provider. In other embodiments, the video data may be stored on disk or obtained by any other mechanism, as appropriate for the requirements of a particular application.

[0079] The process determines (at 504) the locations of multiple compression units (e.g., tiles in HEVC) within the video data. In some embodiments, the locations of the tiles may be fixed within one or more frames of the video. In other embodiments, the locations of the tiles may vary between frames or sets of frames. The locations of the tiles may be determined based on information contained in a PPS corresponding to the frame. Specifically, the process may parse the PPS to identify particular bytes within the encrypted tiles.

[0080] The process determines (at 506) whether the compressed unit is encrypted and decrypts the encrypted compressed unit. In some embodiments, the process may obtain a decryption key for decrypting the encrypted content. The decryption key may be obtained based on authorization received from a DRM service associated with the content.

[0081] The process decodes (at 508) the compressed unit. In many embodiments, the process decodes the content based on the particular compression standard used to encode the video (e.g., HEVC video).

[0082] The process produces (at 510) the output decoded video for playback. The process then ends.

[0083] Although a specific process for decrypting portions of compressed units in video content is described in FIG. 5, any of a variety of processes may be utilized to decrypt portions of compressed units in video content as appropriate for the requirements of a particular application in accordance with embodiments of the present invention.

[0084] While the present invention has been described in certain specific aspects, many additional modifications and variations will become apparent to those skilled in the art. It is therefore to be understood that the invention may be practiced otherwise than as specifically described. The present embodiments, therefore, are to be considered in all respects as illustrative and not restrictive.

[0085] Furthermore, the foregoing discussion discloses and describes merely exemplary embodiments of the present invention. Those skilled in the art will readily recognize from such discussion and from the accompanying drawings that various changes, modifications, and variations can be made without departing from the spirit and scope of the present invention. Therefore, the present invention may not be limited to the particular embodiments disclosed, but it is intended that the present invention will include all embodiments falling within the scope of the appended claims.

Claims

1. A content decoder, The aforementioned content decoder is Memory containing the decoder application, A processor configured to communicate with the aforementioned memory Equipped with, The decoder application provides the processor with Receiving an encoded video bitstream comprising multiple frames, each frame comprising multiple independently encoded compression units within the frame, each independently encoded compression unit being a tile, For each of the aforementioned multiple frames, Receiving a metadata header that identifies the location of the plurality of independently encoded compression units within the frame, Receiving encrypted information that identifies the location of the encrypted portion of the plurality of independently encoded compression units within the frame, and Decrypting the encrypted portion of each of the multiple compression units in the frame based on the received metadata header and the received encryption information, wherein decrypting the encrypted portion of the multiple compression units means decrypting the multiple compression units. To execute and A content decoder that instructs the system to perform certain actions.

2. The content decoder according to claim 1, wherein the compression unit is an independently decodeable portion of a particular frame of video and does not depend on another compression unit within the particular frame for decoding.

3. The content decoder according to claim 1, wherein each of the plurality of compression units includes at least one portion protected using encryption and at least one portion that is not encrypted.

4. The content decoder according to claim 1, wherein each of the encrypted portions is selected from the group consisting of i) the first N bytes of the compression unit, ii) the last N bytes of the compression unit, iii) the central portion of the N bytes in the compression unit, and iv) a pattern of the N bytes in the compression unit.

5. The content decoder according to claim 1, wherein the encrypted information is contained in a separate DRM track, at least a portion of which is located in a container file containing the encoded video bitstream, and the encrypted information identifies a portion of the frame for decryption before the plurality of compression units are decrypted.

6. The content decoder according to claim 1, wherein the encoded video bitstream further comprises at least one unit containing a set of parameters that identify the location of the plurality of compression units within the frame.

7. The content decoder according to claim 6, wherein the parameters associated with each compression unit within the plurality of compression units are transmitted in the parameter set.

8. The content decoder according to claim 1, wherein the encrypted information identifies the number of bytes of data in the frame for decryption before decrypting the plurality of compression units.

9. The content decoder according to claim 1, wherein the metadata header comprises a pointer, each pointer being a pointer to the starting location of one of the plurality of compression units.

10. The content decoder according to claim 1, wherein the plurality of compression units are decoded in parallel with each other.

11. The content decoder according to claim 10, wherein the plurality of compression units are decoded by a plurality of processors.

12. A method for decoding a video, wherein the method is: In a content decoder, the function is to receive an encoded video bitstream comprising multiple frames, wherein each frame comprises multiple independently encoded compression units, and each independently encoded compression unit is a tile. For each of the aforementioned multiple frames, Receiving a metadata header that identifies the location of the plurality of independently encoded compression units within the frame, Receiving encrypted information that identifies the location of the encrypted portion of the plurality of independently encoded compression units within the frame, and Decrypting the encrypted portion of each of the multiple compression units in the frame based on the received metadata header and the received encryption information, wherein decrypting the encrypted portion of the multiple compression units means decrypting the multiple compression units. To execute and Methods that include...

13. The method according to claim 12, wherein the compression unit is an independently decodeable portion of a particular frame of video and does not depend on another compression unit within the particular frame for decoding.

14. The method according to claim 12, wherein each of the plurality of compression units includes at least one portion protected using encryption and at least one portion that is not encrypted.

15. The method according to claim 12, wherein each of the encrypted portions is selected from the group consisting of i) the first N bytes of the compressed unit, ii) the last N bytes of the compressed unit, iii) the central portion of the N bytes in the compressed unit, and iv) a pattern of the N bytes in the compressed unit.

16. The method according to claim 12, wherein the encrypted information is contained in a separate DRM track, at least a portion of which is located in a container file containing the encoded video bitstream, and the encrypted information identifies a portion of the frame for decryption before the plurality of compression units are decrypted.

17. The method according to claim 12, wherein the encrypted information identifies the number of bytes of data in the frame for decryption before decrypting the plurality of compression units.

18. The method according to claim 12, wherein the plurality of compression units are decoded in parallel with each other.

19. The method according to claim 18, wherein the plurality of compression units are decoded by a plurality of processors.

20. A content decoder, The aforementioned content decoder is Memory containing the decoder application, A processor configured to communicate with the aforementioned memory Equipped with, The decoder application provides the processor with Receiving an encoded video bitstream comprising multiple frames, each frame comprising multiple independently encoded compression units within the frame, each independently encoded compression unit being a tile, For each of the aforementioned multiple frames, Receiving a metadata header that identifies the location of the plurality of independently encoded compression units within the frame, Receiving encrypted information that identifies the location of the encrypted portion of the plurality of independently encoded compression units within the frame, and Decrypting the encrypted portion of each of the multiple compression units in the frame based on the received metadata header and the received encryption information, wherein decrypting the encrypted portion of the multiple compression units involves decrypting the multiple compression units in parallel with each other. To execute and A content decoder that instructs the system to perform certain actions.

Images