HLS Content Key Conversion via Double Encryption and Segmented Channels
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current HLS-based content security systems face issues with key information being easily extracted for decrypting encrypted content, and lack content authentication, leading to inadequate protection against unauthorized access.
Innovation Solution
A security processing system and method that uses a content key conversion device to securely provide encryption keys from a server to a client, employing double encryption and DRM for per-content viewing authorization, where the content provider generates index files containing address information for encrypted content and encryption keys, and a content proxy device manages key decryption and transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If key information is transmitted to terminal together with content information for decryption, then content can be decrypted and replayed, but key information can be easily extracted for unauthorized decryption
Solution Approach 1:
The system segments the key transmission process into two separate channels: content information is transmitted via HTTP while key information is transmitted via HTTPS. This segmentation ensures that even if content is intercepted, the encryption keys remain protected through the secure HTTPS channel, preventing unauthorized decryption while maintaining content accessibility.
Solution Approach 2:
The system introduces an intermediary mechanism where key information is not directly provided to the terminal but is instead obtained through a secure key server via HTTPS. This intermediary approach allows the terminal to decrypt content only after establishing a secure key retrieval process, adding a layer of protection against key extraction while preserving decryption functionality.
2Reliability
If HTTPS is used for transmitting key information, then user authentication is allowed, but content authentication is not allowed
Solution Approach 1:
The system merges two authentication mechanisms: HTTPS-based user authentication and content-based authentication. By combining these approaches, the system achieves both user verification (through HTTPS) and content-specific authorization (through content-based authentication), enabling comprehensive security control that supports both authenticated users and content-locked access.
Solution Approach 2:
The security system is designed with multi-functionality to handle both user authentication (via HTTPS) and content authentication (via content-based security). This universal approach allows the same system to serve multiple security purposes: verifying user identities and controlling access to specific content, thereby achieving both reliability and adaptability.
3Device complexity
If conventional progressive download method is used, then content transmission is simple, but illegal copying of contents cannot be prevented
Solution Approach 1:
The system performs preliminary encryption of content before transmission, dividing it into encrypted segments. This preliminary action ensures that even though the transmission mechanism remains simple (HTTP-based streaming), the content is already protected against illegal copying. The encryption is applied in advance, so receivers cannot easily copy or redistribute the content without proper decryption keys.
Solution Approach 2:
The system dynamically controls content access by providing decryption keys only to authorized terminals through HTTPS authentication. This dynamic approach maintains the simplicity of HTTP streaming while adding protective layers: content is transmitted openly but remains unusable without proper authorization, effectively preventing illegal copying while preserving transmission simplicity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed are a security processing system and method for HLS transmissions. An aspect of the invention provides a content key conversion device connected over a network to a content proxy device configured to provide encryption key information to a content operating device for a content received from a content provider device of an external network. The content key conversion device includes: a reception part that receives a double encryption key of a content from the content proxy device; an interface part that receives key decryption information corresponding to the double encryption key from an encryption key provider device of an external network; a decryption part that decrypts the double encryption key of the content using the key decryption information and thereby converts the double encryption key to an encryption key; and a transmission part that transmits the encryption key converted by the decryption part to the content proxy device.