Systems and methods for protecting a base bitstream incorporating independently encoded tiles

Abstract

To provide a suitable system and method for protecting an elementary bitstream that incorporates an independently encoded tile.SOLUTION: There are provided a system and a method for partial frame encryption according to an embodiment of the present invention. In one embodiment, the method receives a video bitstream including a number of frames, each frame including a number of independently encoded compression units, and encrypts some of the number of compression units of the number of frames and generates an output bitstream that includes a number of independently encoded compression units, including some of encrypted compression units.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to the field of encryption and decryption of video information. More specifically, the present invention is directed to a method and system for generating a protected stream of compressed digital video using partial frame encryption.

Background Art

[0002] Existing digital video compression techniques are complex processes that rely on various techniques when converting units of uncompressed video data into an encoded form (i.e., “encoding”). Such encoding enables fewer bits to be used when representing the content of the original uncompressed video data. The resulting encoded data can be converted using the reverse process (i.e., “decoding”) that results in digital video units of data that are either visually similar or identical to the original data. Modern techniques of digital video compression can achieve very high levels of compression.

[0003] The Motion Pictures Experts Group (MPEG) and the International Standards Organization (ISO) have produced various international standards that define video compression and decompression algorithms for video encoding. These standards include the more recent High Efficiency Video Coding (HEVC) standard, which has significantly improved compression efficiency over MPEG-1, MPEG-2, MPEG-4, H.261, H.264, and their predecessors. Specifically, HEVC can achieve a compression ratio twice as high at the same subjective quality compared to the previous H.264 standard. To achieve these compression optimizations, the HEVC standard has introduced several new tools that are designed specifically for the parallel processing of video content, especially on multi-core processor architectures. Specifically, many of the smartphone and tablet architectures currently available on the market utilize multi-core processors and can therefore play HEVC content using their multi-core architectures. Additionally, with the increasing video traffic across networks, the HEVC standard provides certain tools that reduce some of the bandwidth requirements for distributing high-quality content.

[0004] Protecting the distribution of digital content from copyright infringement and other types of illegal distribution is yet another concern for content providers. The term Digital Rights Management (DRM) is used to represent access control technologies that are used to control access to and / or the copying of digital content. DRM systems typically involve the use of cryptographic information to control access to or protect a portion of the content. Content protection is typically achieved using cryptographic information such as one or more encryption keys (but not limited to) to encrypt the content.

[0005] Currently, there are various types of encryption methods that can be used to protect data. In the digital world, encryption is often implemented by using a set of bits of a certain length, known as a "key", to perform a predictable transformation on a unit of data. This results in another unit of data that cannot be "read" without knowledge of the key used to perform the transformation. The encryption process is only easily reversible to the extent that the encryption key or its counterpart (e.g., a "public" key) is available for use in transforming or "decrypting" the encrypted data back to its original form. Video data is often encrypted using symmetric block ciphers that follow, for example, the Data Encryption Standard (DES) or the Advanced Encryption Standard (AES). However, the specific techniques used to encrypt digital content can consume additional processing resources that need to be considered with respect to the encoding and distribution of content across a network.

Summary of the Invention

Means for Solving the Problems

[0006] A system and method for partial frame encryption according to an embodiment of the present invention are disclosed. In one embodiment, the method receives a video bitstream including a number of frames, where each frame includes a number of independently encoded compression units within the frame, encrypts a portion of each of the compression units among a number of compression units in a number of the frames, and generates an output bitstream including the independently encoded compression units including the encrypted portions of the compression units.

[0007] In a further embodiment of the present invention, the compression units are independently decodable portions of a particular frame of the video such that they do not depend on another compression unit within the particular frame for decoding.

[0008] In still further embodiments of the present invention, the method further analyzes a metadata header to identify the location of compression units within a frame of the video and encrypts a portion of the video bitstream based on the location of the compression units.

[0009] In still further embodiments of the present invention, the method encrypts a portion of each of a plurality of compression units by determining that a compression unit is enabled based on information within a header associated with the video bitstream.

[0010] Still further, in yet further embodiments of the present invention, the method further includes encrypting a portion of each compression unit within a frame of the video.

[0011] In yet another embodiment of the present invention, the portion is selected from the group consisting of: i) the first N bytes of the compression unit, ii) the last N bytes of the compression unit, iii) a central portion of N bytes within the compression unit, and v) a pattern of N bytes within the compression unit.

[0012] In still yet another embodiment of the present invention, the compression unit is a tile within the High Efficiency Video Coding (HEVC) standard, and the video bitstream is encoded based on the HEVC standard.

[0013] Still yet further, in yet another embodiment of the present invention, the method further includes analyzing a Picture Parameter Set (PPS) of the HEVC video bitstream to identify the structure of tiles within the video bitstream and encrypting multiple portions of the tiles based on the structure.

[0014] Again, in another embodiment of the present invention, the method further encrypts a portion of each of some of the compression units using a Common Encryption Format (CENC) for encrypting the multiple portions.

[0015] Yet another embodiment of the present invention includes a content encoder that includes a processor configured to communicate with a memory, the memory containing an encoder application, the encoder application instructing the processor to receive a video bitstream including a plurality of frames, each frame including a plurality of independently encoded compression units, encrypt a portion of each of the plurality of compression units among the plurality of frames, and generate an output bitstream including the plurality of independently encoded compression units including the encrypted portions of the compression units.

[0016] In another embodiment of the present invention, the compression unit is an independently decodable portion of a particular frame of video such that it does not depend on another compression unit within the particular frame to be decoded.

[0017] In yet another embodiment of the present invention, the encoder application further instructs the processor to analyze a metadata header to identify the location of the compression units within the frames of the video and encrypt a portion of the video bitstream based on the location of the compression units.

[0018] In still yet another embodiment of the present invention, the step of encrypting a portion of each of the plurality of compression units includes determining that the compression unit is enabled based on information within a header associated with the video bitstream.

[0019] Once again, in still yet another embodiment, the encoder application further instructs the processor to encrypt a portion of each compression unit within the frames of the video.

[0020] Once again, in another embodiment of the present invention, the portion is selected from the group consisting of: i) the first N bytes of the compression unit, ii) the last N bytes of the compression unit, iii) the central portion of N bytes within the compression unit, and v) a pattern of N bytes within the compression unit.

[0021] In yet another further embodiment of the present invention, the compression unit is a tile within the High Efficiency Video Coding (HEVC) standard, and the video bitstream is encoded based on the HEVC standard.

[0022] Again, in yet another further embodiment of the present invention, the encoder application further analyzes the Picture Parameter Set (PPS) of the HEVC video bitstream to identify the structure of the tiles within the video bitstream and instructs the processor to encrypt multiple parts of the tiles based on the structure.

[0023] Again, in yet another further embodiment of the present invention, the step of encrypting a portion of each of the plurality of compression units includes the step of using a Common Encryption (CENC) format to encrypt the multiple parts.

[0024] In another embodiment of the present invention, the content decoder includes a processor configured to communicate with a memory, the memory contains a decoder application, and the decoder application instructs the processor to receive a video bitstream including several frames, where each frame includes a plurality of independently encoded compression units within the frame, decrypt a portion of each of the several compression units among the several frames, and generate a decoded video output for playback.

[0025] In yet another further embodiment of the present invention, the compression unit is an independently decodable portion of a particular frame of the video such that it does not depend on another compression unit within the particular frame for decoding.

[0026] Again, in yet another further embodiment of the present invention, the decoder application further analyzes the metadata header to identify the location of the compression units within the frame of the video and instructs the processor to decrypt a portion of the video bitstream based on the location of the compression units.

[0027] Again, in still another embodiment of the present invention, the step of decoding a part of each of several compression units includes the step of determining that a compression unit is enabled based on information in a header associated with a video bitstream.

[0028] In still another further embodiment of the present invention, the decoder application further instructs the processor to decode a part of each compression unit in a video frame.

[0029] Again, in yet another embodiment of the present invention, the part is selected from the group consisting of: i) the first N bytes of a compression unit, ii) the last N bytes of a compression unit, iii) a central portion of N bytes within a compression unit, and v) a pattern of N bytes within a compression unit.

[0030] Still, in a further embodiment of the present invention, the compression unit is a tile within the High Efficiency Video Coding (HEVC) standard, and the video bitstream is decoded based on the HEVC standard.

[0031] Still, in another embodiment of the present invention, the decoder application further analyzes the Picture Parameter Set (PPS) of the HEVC video bitstream to identify the structure of tiles in the video bitstream, and based on the structure, instructs the processor to decode multiple parts of the tiles.

[0032] In yet still another embodiment of the present invention, the step of decoding a part of each of a plurality of compression units includes the step of using a Common Encryption Format (CENC) to decode multiple parts. This specification also provides, for example, the following items. (Item 1) A non-transitory machine-readable medium containing processor instructions, execution of the instructions by a processor causes the processor to Receiving a video bitstream comprising a plurality of frames, each frame comprising a plurality of independently encoded compression units within the frame; Encrypting a portion of each of the plurality of compression units among the plurality of frames; Generating an output bitstream comprising the plurality of independently encoded compression units, including the encrypted portion of the compression unit; A non-transitory machine-readable medium that causes a process to include the above steps. (Item 2) The non-transitory machine-readable medium according to item 1, wherein the compression unit is an independently decodable portion of a specific frame of video such that it does not depend on another compression unit within the specific frame for decoding. (Item 3) Analyzing a metadata header to identify the location of compression units within a frame of video; Encrypting a portion of the video bitstream based on the location of the compression unit; The non-transitory machine-readable medium according to item 1, further including the above steps. (Item 4) The non-transitory machine-readable medium according to item 1, wherein the step of encrypting a portion of each of the plurality of compression units includes determining that the compression unit is enabled based on information in a header associated with the video bitstream. (Item 5) The non-transitory machine-readable medium according to item 1, further including encrypting a portion of each compression unit within a frame of video. (Item 6) The non-transitory machine-readable medium according to item 5, wherein the portion is selected from the group consisting of: i) the first N bytes of the compression unit, ii) the last N bytes of the compression unit, iii) a central portion of N bytes within the compression unit, and iv) a pattern of N bytes within the compression unit. (Item 7) The compression unit is a tile within the High Efficiency Video Coding (HEVC) standard, and the video bitstream is encoded based on the HEVC standard, the non-transitory machine-readable medium according to item 1. (Item 8) Analyzing a Picture Parameter Set (PPS) of the HEVC video bitstream to identify the structure of the tile within the video bitstream; Encrypting a plurality of parts of the tile based on the structure; and The non-transitory machine-readable medium according to item 7, further comprising. (Item 9) The step of encrypting the part of each compression unit among the plurality of compression units includes using a Common Encryption (CENC) format to encrypt a plurality of parts, the non-transitory machine-readable medium according to item 1. (Item 10) A content encoder, A processor configured to communicate with a memory, the memory containing an encoder application, the processor Comprising, The encoder application causes the processor to Receive a video bitstream comprising a plurality of frames, each frame comprising a plurality of independently encoded compression units within the frame; Encrypt a part of each compression unit among the plurality of compression units in the plurality of frames; Generate an output bitstream comprising the plurality of independently encoded compression units including the encrypted part of the compression unit; and The content encoder is instructed to perform. (Item 11) The compression unit is an independently decodable part of the specific frame of the video such that it does not depend on another compression unit within a specific frame for decoding, the content encoder according to item 10. (Item 12) The encoder application further causes the processor to analyze a metadata header to identify the location of compression units within a video frame, and encrypt a portion of the video bitstream based on the location of the compression unit The content encoder according to item 10, which instructs to perform the above. (Item 13) The step of encrypting the portion of each compression unit among the plurality of compression units includes a step of determining that the compression unit is enabled based on information in a header associated with the video bitstream. The content encoder according to item 10. (Item 14) The encoder application further causes the processor to encrypt a portion of each compression unit within a video frame. The content encoder according to item 10. (Item 15) The portion is selected from the group consisting of i) the first N bytes of the compression unit, ii) the last N bytes of the compression unit, iii) the central portion of N bytes within the compression unit, and iv) a pattern of N bytes within the compression unit. The content encoder according to item 14. (Item 16) The compression unit is a tile within the High Efficiency Video Coding (HEVC) standard, and the video bitstream is encoded based on the HEVC standard. The content encoder according to item 10. (Item 17) The encoder application further causes the processor to analyze a Picture Parameter Set (PPS) of the HEVC video bitstream to identify the structure of the tile within the video bitstream, and encrypt a plurality of portions of the tile based on the structure The content encoder according to item 16, which instructs to perform the above. (Item 18) The step of encrypting the part of each of the plurality of compression units uses a common encryption format (CENC) to encrypt a plurality of parts, as described in item 10 of the content encoder. (Item 19) A content decoder, A processor configured to communicate with a memory, the memory containing a decoder application, the processor Comprising The decoder application causes the processor to Receive a video bitstream comprising a plurality of frames, each frame comprising a plurality of independently encoded compression units within the frame, Decode a part of each of the plurality of compression units in a plurality of frames, Generate a decoded video output for playback A content decoder that instructs to perform. (Item 20) The compression unit is an independently decodable part of the specific frame of the video so that it does not depend on another compression unit in a specific frame for decoding, as described in item 19 of the content decoder. (Item 21) The decoder application further causes the processor to Analyze a metadata header to identify the location of compression units within a frame of the video, Decode a part of the video bitstream based on the location of the compression unit A content decoder that instructs to perform, as described in item 19. (Item 22) The step of decoding the part of each of the plurality of compression units includes determining that the compression unit is enabled based on information in a header associated with the video bitstream, as described in item 19 of the content decoder. (Item 23) The decoder application further instructs the processor to decode a part of each compression unit in a video frame, the content decoder according to item 19. (Item 24) The part is selected from the group consisting of: i) the first N bytes of the compression unit, ii) the last N bytes of the compression unit, iii) the central part of N bytes within the compression unit, and iv) a pattern of N bytes within the compression unit, the content decoder according to item 23. (Item 25) The compression unit is a tile within the High Efficiency Video Coding (HEVC) standard, and the video bitstream is decoded based on the HEVC standard, the content decoder according to item 19. (Item 26) The decoder application further instructs the processor to analyze a Picture Parameter Set (PPS) of the HEVC video bitstream to identify the structure of the tile within the video bitstream, and based on the structure, instruct the processor to decode a plurality of parts of the tile, the content decoder according to item 25. (Item 27) The step of decoding the part of each compression unit among the plurality of compression units includes using a Common Encryption Cipher (CENC) to decode a plurality of parts, the content decoder according to item 19.

Brief Description of the Drawings

[0033]

Figure 1

Figure 2A

Figure 2B

Figure 2C

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

[0034] As described above, different techniques may be used to encrypt content, each of which may consume different amounts of processing resources in addition to the processing costs associated with the compression techniques (e.g., H.264 or HEVC) utilized to compress or encode video content. Thus, many embodiments of the present invention can achieve the efficiency of generating a protected compressed video sequence having encrypted frames by encrypting only a portion of a frame rather than the entire frame. These techniques are generally referred to as "partial frame encryption" because they encrypt only a portion of the frame. One or more portions encrypted within a frame of video can be defined within the frame by a starting location and a length. In many cases, this information is provided within a header associated with the frame and may be used by a decoder to identify the location of the encrypted portion of the frame for decoding.

[0035] In many video compression formats such as H.264 / MPEG-4 AVC (High Profile Video Coding), there are dependencies within a frame and across multiple frames (due to the compression algorithm). Due to these dependencies, when a part of the encrypted data cannot be decoded and thus cannot be properly played back, other parts in other frames that depend on the frame or the encrypted part also cannot be played back. Therefore, in an AVC-encoded bitstream, encrypting the first x number of bytes at the beginning of a frame or sequence unit is often sufficient to prevent the decoding of many other parts of the frame or other units.

[0036] Many embodiments may utilize the ISO / IEC 23001-7:2012 Common Encryption Scheme (CENC) standard for encryption, which is an industry encryption standard that defines standard encryption and key mapping methods that can be utilized by one or more digital rights and key management systems (DRM systems) to enable the decoding of the same file using different DRM systems. This scheme allows for encrypting multiple discontinuous parts of a frame.

[0037] Some video compression formats such as High Efficiency Video Coding (HEVC) enable the independent encoding and decoding of multiple parts of a frame without referring to or depending on information in other parts, allowing for the simultaneous parallel processing of different parts of the frame video. One such feature designed to enable parallel processing is the "tile" in HEVC. Specifically, tiles can be used to encode and decode multiple parts of a frame simultaneously by different processors by dividing the image into square regions (tiles), where each tile consists of several coding tree units (CTUs).

[0038] Tiles can be contained within a single NAL (Network Abstraction Layer) unit or slice. Similar independently decodable portions of a frame can be referred to as compression units (i.e., tiles in HEVC) across different coding formats. Since compression units can be processed independently of each other, parallelism can be exploited when decoding the bitstream. In an HEVC coded stream where tiles are enabled, if only the first x bytes of a video NAL unit or frame are encrypted, other portions (tiles) can be fully decodable without the need to decrypt the encrypted portion, due to their independence from the encrypted portion.

[0039] Thus, in many embodiments, the security of an encoded bitstream having tiles (or other compression units) can be improved by encrypting at least a portion of the plurality of tiles within a frame such that more portions of the frame are made irrecoverable without decrypting the encrypted portion. In some embodiments, the encoder and / or encoding process can be designed to decrypt at least a portion of the bitstream to determine where the tiles are located and encrypt multiple portions of the tiles. The encoder may obtain information regarding the structure and / or location of the tiles in order to encrypt the information within the plurality of tiles and protect against more portions of the bitstream being decrypted. A method for obtaining this information regarding tiles (or other independently decodable units) can include the step of parsing the NAL unit header to determine the start location of one or more tiles. Systems and methods for partial frame encryption of compression units according to embodiments of the present invention are further discussed below.

[0040] (System Architecture for Partially Encoding and Playing Video Using Partial Frame Encryption) As discussed above, many new compression standards provide new tools that enable parallel processing (i.e., encoding and decoding) of video content on multi-core architectures. These tools include, for example, the use of "tiles" in the HEVC standard among several types of similar independently decodable compression units that can be utilized to divide a frame of video content into separate decodable units. As will be described throughout this application, a compression unit (e.g., a tile in HEVC) can generally refer to a divided and / or independently decodable portion of a single frame of video for a given encoding standard. Further, a "tile" is a type of compression unit introduced within the HEVC standard. Although many of the following examples describe sub-frame encryption of tiles based on video compressed according to the HEVC standard, according to embodiments of the present invention, sub-frame encryption may be used to encrypt video compressed according to any other standard that uses a similar type of compression unit to divide the video frame as appropriate for the requirements of a particular application.

[0041] Furthermore, to protect digital content compressed using independently decodable compression units, a partial frame encryption technique may be used that applies partial frame encryption to one or more portions of the compression units (i.e., tiles) within the frames of the video. Specifically, in newer standards (e.g., HEVC) designed to enable independent decoding of compression units within a video frame, based on the compression standard design where other portions will require proper decoding of the encrypted frame and will have an inter-frame dependency state, encrypting only a portion of all video frames (i.e., the video image) may no longer be sufficient. As discussed above, within these older compression standards, due to the dependency state between different portions of a single video frame, when the encrypted portion cannot be decoded and thus cannot be properly played back, other portions in other frames that depend on the in-frame or encrypted portion also cannot be played back. Thus, in many embodiments, partial frame encryption may be applied to multiple portions of one or more compression units within the frames of the video. A system for encoding video content using partial frame encryption according to an embodiment of the present invention is illustrated in FIG. 1.

[0042] System 100 includes a content encoder 102 configured to encode source media into encoded video. In some embodiments, the content encoder may encode the content using a compression standard (e.g., the HEVC standard) that enables parallel processing of the content by generating compression units (e.g., tiles) within each frame of the video that enable independent encoding / decoding of multiple portions of the frame without referring to other portions of the frame. Specifically, in some embodiments, the content encoder may encode the content using the HEVC standard to encode the frames of the video content. The HEVC standard may also generate one or more independently decodable tiles for each frame of the video.

[0043] In addition to encoding video frames based on a compression standard (e.g., HEVC), in many embodiments, content encoder 106 may further encrypt multiple portions of the video content to protect the content from illegal distribution. To reduce the overhead associated with encrypting the video content, in many embodiments, content encoder 106 encodes the video content using partial frame encryption, whereby only one or more compression units (i.e., tiles) within the frame of the video (rather than encrypting the entire frame of the video content) are encrypted. In some embodiments, the content encoder encrypts the first x number of bytes at the beginning of each tile within the frame of the video. Other embodiments may encrypt different portions of the tile, as appropriate for the requirements of a particular application, including x bytes located anywhere within the bitstream, the last x bytes, and any other combination of bytes within the tile. In one embodiment, the content encoder may encrypt the same portion of all tiles within the frame. In other embodiments, the content encoder may encrypt different portions of different tiles. In some embodiments, the content encoder may encrypt multiple portions of only certain tiles (e.g., less than all tiles) within the frame of the video. As can be readily understood, a container file containing the encrypted video can include a separate DRM track containing information about the location of the encrypted portions of the tiles within the frame and / or encryption information used to encrypt all or each of the encrypted portions.

[0044] In some embodiments, content encoder 106 stores the content in a Matroska (MKV) container file. The Matroska container is a media container developed as an open standard project by the Matroska non-profit organization (Aussonne, France). The Matroska container is based on the Extensible Binary Meta-Language (EBML), which is a binary derivative of the Extensible Markup Language (XML). The decoding of Matroska containers is supported by many consumer electronics (CE) devices. In other embodiments, depending on the specific application requirements, any of a variety of container file formats, including but not limited to the MP4 container file format defined as MPEG-4 Part 14 by the Motion Picture Experts Group, can be used.

[0045] In some embodiments, after content encoder 106 compresses and / or encrypts the video sequence, content encoder 106 uploads the encoded video to content server 102.

[0046] In many embodiments, content server 102 facilitates the distribution of source media to one or more playback devices 108 - 114. Content server 102 according to some embodiments of the present invention may be responsible for storing protected content for distribution to playback devices. In many embodiments, the content server receives and processes download requests from various playback devices 108 - 114 that attempt to download the encoded video. In some embodiments, the device may request either (i) to download the entire file or (ii) to receive a streamed video for playback in either progressive or adaptive streaming mode. When the distribution server receives a download request from a playback device, it can provide the encoded video to the playback device for storage and / or playback.

[0047] The downloaded video file may include one or more headers that contain data representing the structure of compression units (e.g., tiles in an HEVC-encoded video) within the video frames. The header may include a pointer to the start location of one or more tiles. In some embodiments, the location of tiles within an encoded HEVC video sequence may be defined in a picture parameter structure (PPS) that provides information regarding the tile structure within one or more frames of the video. In some embodiments, a tile may be fixed in a location within a frame, while in other embodiments, a tile may be in a different location for different frames of the video. A decoder on a playback device may use this information to determine multiple portions of a frame that need to be decoded to play the video file.

[0048] In some embodiments, content server 102 receives stream requests from various playback devices and later streams the encoded video to the playback devices for progressive playback and / or as part of an adaptive bitrate streaming system. In some embodiments, various playback devices can use HTTP or another suitable stateless protocol to request a stream via a network 104 such as the Internet. In some embodiments, various playback devices can use RTSP, whereby the distribution server records the state of each playback device and determines the video to stream based on commands received from the playback devices and stored data representing the state of the playback devices.

[0049] In some embodiments, a DRM server 116 (Digital Rights Management) facilitates approval and access to source media, including managing keys required for encrypting / decrypting the source media.

[0050] According to an embodiment of the present invention, the DRM server 116 may be responsible for storing protected streams and / or files of content for distribution (e.g., streaming and / or downloading) to playback devices. The DRM server may also be able to store common encryption information used to protect the content. In some embodiments, the common encryption information is identified using an identifier associated with the common encryption information and a portion of the content.

[0051] In the illustrated embodiment, the playback devices include personal computers 108 - 110 and mobile phones 112 - 114. In other embodiments, the playback devices can include consumer electronic devices such as DVD players, Blu-ray (registered trademark) players, televisions, set-top boxes, video game consoles, tablets, and other devices capable of connecting to a server via HTTP and playing back encoded video.

[0052] In the illustrated embodiment, the content encoder, content server, and DRM server are server applications configured to run on server computer hardware. In other embodiments, the content encoder, content server, and DRM server can be any processing device that includes a processor and has sufficient resources to perform encryption, distribution, and digital rights management of source media, including (but not limited to) video, audio, and / or subtitles. Although a specific architecture is shown in FIG. 1, any of a variety of architectures can be used that, as appropriate for the requirements of a specific application according to an embodiment of the present invention, enable a playback device to request encoded video using partial frame encryption.

[0053] The basic architecture of the content encoder 202 according to an embodiment of the present invention is illustrated in FIG. 2A. The content encoder 202 includes a processor 204 that communicates with a non-volatile memory 208, a volatile memory 206, and a network interface 214. In the illustrated embodiment, the non-volatile memory includes a content encoder application 210 that configures the processor to encode content 212. In some embodiments, the content encoder application 210 uses sub-frame encryption to encrypt the content such that only multiple portions of one or more compression units (e.g., tiles), rather than the entire frame, are encrypted within the video frame so as to reduce the overhead associated with the encryption of the compressed video.

[0054] In some embodiments, the network interface 214 may communicate with the processor 204, the volatile memory 206, and / or the non-volatile memory 208. Although a specific content encoder architecture is illustrated in FIG. 2A, any of a variety of architectures, including an architecture in which the content encoder application is located on a disk or some other form of storage device and is loaded into the volatile memory at runtime, may be utilized to implement the content encoder according to an embodiment of the present invention.

[0055] The basic architecture of the content server 222 according to an embodiment of the present invention is illustrated in FIG. 2B. The content server 222 includes a processor 224 that communicates with a non-volatile memory 228, a volatile memory 226, and a network interface 234. In the illustrated embodiment, the non-volatile memory includes a content distribution application 230 that configures the processor to distribute content 232. In some embodiments, the network interface 234 may communicate with the processor 224, the volatile memory 226, and / or the non-volatile memory 228. Although a specific content server architecture is illustrated in FIG. 2B, any of a variety of architectures may be utilized to implement the content server according to an embodiment of the present invention, including architectures in which the content distribution application is located on a disk or some other form of storage device and is loaded into volatile memory at runtime.

[0056] The basic architecture of the playback device according to an embodiment of the present invention is illustrated in FIG. 2C. The playback device 252 includes a processor 254 that communicates with a non-volatile memory 258, a volatile memory 256, and a network interface 240. In the illustrated embodiment, the non-volatile memory includes a decoder application 260 that configures the processor to decode content 262. In some embodiments, the decoder application 260 uses information provided in the video container file and / or video stream to identify the location of compression units within a frame of video and decodes only a portion of the compression units to decode the video.

[0057] In some embodiments, the network interface 264 may communicate with the processor 254, the volatile memory 256, and / or the non-volatile memory 258. Although a specific playback device architecture is illustrated in FIG. 2C, any of a variety of architectures, including an architecture where a decoder application is located on a disk or some other form of storage device and is loaded into volatile memory at runtime, can be utilized to implement a playback device according to embodiments of the present invention.

[0058] (System and Method for Partial Frame Encryption) As discussed above, some video compression formats (e.g., HEVC) allow multiple parts of a frame (e.g., compression units or tiles) to be independently encoded and decoded without referring to or depending on information in other parts of the frame (or other frames). These independently decodable parts of a frame can be referred to as compression units across different coding formats. Thus, during encryption of a stream with independent compression units, if only the first x bytes of a frame are encrypted, other parts (compression units or tiles) may be fully decodable due to their independence from the encrypted compression unit without the need to decrypt the encrypted part of the compression unit. Thus, the security of an encoded bitstream having tiles (or other compression units) can be improved by encrypting at least a portion of multiple tiles within a frame such that more parts of the frame are made irrecoverable without decrypting the encrypted parts. A process for partial frame encryption of compression units of a video bitstream according to embodiments of the present invention is illustrated in FIG. 3.

[0059] The process receives (at 302) video data. In some embodiments, the process may download video data from one or more content distribution sources. In other embodiments, the process may stream video data during video playback.

[0060] This process determines the locations of multiple compression units within the video data (at 304). The locations may be determined based on information provided by one or more headers associated with the frames of the video. In some embodiments, the header may provide information regarding the start location of each compression unit within the frame. In some embodiments, the location of each compression unit may be fixed within each frame of the video and thus may not need to be identified by a header. For example, the encoder may be pre-programmed with information regarding the structure of the video sequence.

[0061] This process determines (at 306) a portion of each compression unit within a frame of the video to be encrypted. In some embodiments, this process determines that a fixed x bytes of each compression unit should be encrypted. In some embodiments, this process determines different portions of different compression units based on the characteristics of the compression units. In other embodiments, this process may encode the middle or last x number of bytes within one or more compression units relative to a frame of the video. In one embodiment, this process may encrypt a frame of the video without encrypting only multiple portions of other frames of the video. As can be readily understood, the specific portions of a particular frame to be encrypted and the manner of encryption typically depend on the requirements of the application.

[0062] This process encrypts (at 308) multiple portions of the compression unit. In some embodiments, this process uses standard DES and / or AES encryption to encrypt the multiple portions. Other embodiments may use other encryption mechanisms as appropriate for the specific requirements of the application.

[0063] This process generates (at 310) an output bitstream containing the compression units with the encrypted portions. The process then ends.

[0064] A specific process for encrypting multiple parts of a compression unit is described in FIG. 3, but depending on the requirements of a specific application according to an embodiment of the present invention, any of various processes can be used to encrypt multiple parts of a compression unit as appropriate.

[0065] (Overview of the HEVC Standard) As discussed above, the HEVC video compression standard includes several new tools designed for the playback of video content that use a multi-core architecture that supports parallel processing. The tools include wavefront parallel processing (WPP) and tiles in addition to the slice structure. When WPP and / or tiles are used, a video bitstream corresponding to one image may be packetized into independently decodable subsets of the bitstream. Specifically, HEVC includes independently decodable tiles that divide a video frame into rectangular regions of a certain size. An example of tiles within a video frame according to an embodiment of the present invention is illustrated in FIG. 6. Specifically, FIG. 6 is a schematic diagram illustrating an example of evenly dividing a frame in the horizontal and vertical dimensions into nine tiles from tile 1 in the upper left corner to tile 9 in the lower right corner. Each tile includes a coding tree unit.

[0066] Tile-related parameters may be signaled in the picture parameter set (PPS) in HEVC. Within a video sequence, different images may be permitted to use different PPSs. Tile parameters may vary by image within the same video sequence. In most video applications, the number and location of tiles are likely to remain the same within a video sequence (e.g., a series of images), but situations can occur where not only is it permitted for the tile configuration to vary by image within the same video sequence, but also for groups of tiles to vary by image.

[0067] FIG. 7 illustrates an example of the syntax structure of tiles in a picture parameter set (PPS) in HEVC video. When the tiles_enabled_flag is turned on, the number of tiles in each dimension may be signaled. When the tiles are uniformly sized (e.g., when the uniform_spacing_flag is 1), no additional information may need to be signaled. The width and height of the tiles may be signaled. For example, as shown in FIG. 7, num_tile_columns_minus1 and num_tile_rows_minus1 may be set to 2, and the uniform_spacing_flag may be set to 1.

[0068] The encoder may change how the tiles are divided per frame by an encoder that signals a new PPS with new tile partitioning parameters. In many embodiments, the tiles need not be sized equally relative to each other or remain the same size compared to the same tiles in previous instances. Specifically, the encoder may signal a new PPS with new tile partitioning parameters that will apply to one or more new sets of frames.

[0069] (Partial Frame Encryption in HEVC) As discussed above, the HEVC standard introduces certain tools that support high-level parallel processing. Specifically, HEVC includes tiles that allow a frame to be divided into rectangular regions, which can then be encoded and decoded independently. The frame may be divided into tiles uniformly or non-uniformly. The entry point for each tile may be defined in the slice header. To enable partial encryption of video files using the HEVC standard, many embodiments of the present invention may partially encrypt multiple tiles to encrypt video content. A process for partial encryption of HEVC tiles according to an embodiment of the present invention is illustrated in FIG. 4.

[0070] This process determines (at 402) whether the tiles are enabled. In many embodiments, when the tiles are enabled, the bitstream may contain an entry point offset that indicates the start position of each image partition that each core needs to access immediately to a partition.

[0071] This process determines (at 404) the structure of the NAL units within the frame and / or bitstream.

[0072] This process determines (at 406) the structure of the tiles within the NAL unit. In some embodiments, this process analyzes the NAL header to determine the start location of each tile within the video frame. In some embodiments, an HEVC tile may divide the image into rectangular regions of a certain size. The tile parameter structure may be defined in the picture parameter set (PPS), video usability information (VUI), and / or supplementary enhancement information (SEI) message in HEVC. An example of a PPS in HEVC is illustrated in FIG. 7. When the tiles_enabled_flag is turned on, the number of tiles in each dimension may be signaled. In some embodiments, when the tiles are uniformly sized (e.g., when the uniform_spacing_flag is 1), no additional information may be signaled. The PPS may also signal the width and height of the tile.

[0073] This process selects (at 408) some of the NAL units. In some embodiments, this process may select all of the NAL units. In one embodiment, this process may select one or more NAL units.

[0074] This process selects some tiles within each selected NAL unit (at 410). In some embodiments, the encoder may change how tiles are divided per image by an encoder signaling a new PPS with new tile partitioning parameters. FIG. 7 illustrates an example of signaling tiles within a PPS. In some embodiments, tiles may be of different sizes compared to each other or compared to the same tile in a previous instance. In some embodiments, the encoder may signal a new PPS with new tile partitioning parameters for each new image or when the tile partition changes from the previous image.

[0075] This process encrypts at least a portion of the selected tiles. In some embodiments, this process may encrypt the first x number of bytes, the last x bytes, or a certain x number of bytes located within a portion of the bitstream of the tile. In some embodiments, this process may encrypt some blocks within the tile. Other embodiments may encrypt other portions of the tile as appropriate for the requirements of a particular application. In many embodiments, this process encrypts multiple portions of the tile using a common encryption format (CENC) that uses a common specification regarding how to encrypt a bitstream. CENC defines industry-standard encryption and key mapping methods that can be used by a DRM system to enable decoding of a file. This system operates by defining a common format for encryption-related metadata required to decrypt a protected stream. This system leaves, among other various considerations, copyright mapping, key acquisition and storage, and details of DRM compliance rules to a DRM system that supports the CENC system. Further, in many embodiments, the encryption information may be stored within an MKV container.

[0076] Next, this process ends. Although a specific process for encrypting a part of a tile in HEVC video content is described in FIG. 4, any of various processes may be used to encrypt multiple parts of a tile, as appropriate, according to the requirements of a specific application according to an embodiment of the present invention.

[0077] (Decrypting a partially encrypted video) A process for decrypting a partially encrypted video according to an embodiment of the present invention is illustrated in FIG. 5.

[0078] This process receives encrypted video data (at 502). In some embodiments, this process may download, stream, and / or stream for download video content from a content provider. In other embodiments, the video data may be stored on a disk or obtained by any other mechanism, as appropriate, according to the requirements of a specific application.

[0079] This process determines (at 504) the locations of a plurality of compression units (e.g., tiles in HEVC) within the video data. In some embodiments, the location of a tile may be fixed within one or more than one frame of the video. In other embodiments, the location of a tile may vary between frames or sets of frames. The location of a tile may be determined based on information contained within the PPS corresponding to the frame. Specifically, this process may parse the PPS to identify specific bytes within the encrypted tile.

[0080] This process determines (at 506) whether a compression unit is encrypted and decrypts the encrypted compression unit. In some embodiments, this process may obtain a decryption key for decrypting the encrypted content. The decryption key may be obtained based on an authorization received from a DRM service associated with the content.

[0081] This process decodes compression units (at 508). In many embodiments, this process decodes the content based on a specific compression standard used to encode video (e.g., HEVC video).

[0082] This process generates the decoded video output for playback (at 510). The process then ends.

[0083] A specific process for decoding multiple parts of compression units in video content is illustrated in FIG. 5, but any of various processes may be utilized to decode multiple parts of compression units in video content, as appropriate for the requirements of a particular application according to embodiments of the present invention.

[0084] The present invention has been described in a particular aspect, but many additional modifications and variations will be apparent to those skilled in the art. It is to be understood, therefore, that the invention can be practiced otherwise than as specifically described. Accordingly, embodiments of the present invention are to be considered in all respects as illustrative and not restrictive.

[0085] Furthermore, the foregoing discussion discloses and describes only exemplary embodiments of the invention. Those skilled in the art will readily recognize from such discussion, as well as from the accompanying drawings, that various changes, modifications, and variations can be made therein without departing from the spirit and scope of the invention. Accordingly, the invention is not intended to be limited to the particular embodiments disclosed, but the invention is intended to include all embodiments that fall within the scope of the appended claims.

Claims

Claim 1 A method for decrypting and decoding an encrypted video, the method comprising: Receiving at least a portion of a container file containing an encrypted video comprising encryption-related metadata and a plurality of encoded frames of the video, wherein each of the plurality of encoded frames of the video comprises a plurality of tiles that divide the encoded frame of the video into rectangular regions and are independently encoded, the plurality of encoded frames of the video comprising partially encrypted frames of the encrypted video using partial frame encryption, each of the plurality of tiles within the partially encrypted frames of the video comprising at least one portion protected using encryption and at least one unencrypted portion, obtaining a decoded frame by decrypting the portion of the partially encrypted frame identified by the encryption-related metadata, decoding the decoded frame A method comprising: Claim 2 The method of claim 1, wherein a tile is an independently decodable portion of a particular frame of the video and does not depend on another compression unit within the particular frame for decoding. Claim 3 The method of claim 1, further comprising parsing a header associated with the frame to identify the structure of the file within the frame. Claim 4 The method of claim 3, wherein the header associated with the frame comprises pointers, each pointer being a pointer to the start location of one of the plurality of tiles. Claim 5 The method of claim 3, wherein the header associated with the frame comprises an offset indicating the start location of the encrypted portion of one of the plurality of tiles within the frame. Claim 6 The method of claim 3, wherein the plurality of tiles are fixed at locations within the partially encrypted frame determined using information from the header. Claim 7 The method of claim 1, further comprising displaying the decoded frame. Claim 8 The method of claim 1, wherein the plurality of tiles are located at different locations for different partially encrypted frames. Claim 9 The method according to claim 1, wherein the encryption-related metadata is contained in a separate DRM track, and at least a part of the separate DRM track is located within the at least one part of the container file.

10. Decrypting the part of the partially encrypted frame includes decrypting each of the at least one part protected by encryption within each of the plurality of tiles in the partially encrypted frame of the video using the AES encryption, the method according to claim 1.

11. The method according to claim 1, wherein the plurality of encoded frames of the video further form part of a video bitstream comprising at least one unit containing a parameter set, and identifying locations of the plurality of tiles within the encoded frames of the video.

12. The method according to claim 11, wherein parameters associated with each tile within the plurality of tiles are signaled within the parameter set.

13. A method for decrypting and decoding encrypted video, the method comprising: receiving at least a part of a container file containing encrypted video comprising encryption-related metadata and a plurality of encoded frames of the video, wherein each of the plurality of encoded frames of the video comprises a plurality of tiles obtained by dividing the encoded frame of the video into rectangular regions and encoded independently, the plurality of encoded frames of the video comprises partially encrypted frames of the encrypted video using partial frame encryption, each of the plurality of tiles within the partially encrypted frames of the video comprising at least one part protected by encryption and at least one part not encrypted, and locations of the plurality of tiles being determined using information from a header associated with the frame, obtaining a decoded frame by decrypting the part of the partially encrypted frame identified by the encryption-related metadata, wherein decrypting the part of the partially encrypted frame includes decrypting each of the at least one part protected by encryption within each of the plurality of tiles in the partially encrypted frame of the video using the AES encryption, Decoding the decoded frame, and displaying the decoded frame A method comprising:

Images