A robust, computationally-efficient and secure system is described for streaming content from a server to a client device via the Internet or another digital network. Various aspects relate to automated processes, systems and devices for securing a media stream with efficient yet effective digital cryptography. In particular, content may be transmitted in transport stream (TS) format in which all packets are encrypted (e.g., using a cipher block chain), in which control packets are exempted from encryption (e.g., using an electronic codebook), or in any other manner.

A content protection system for satellite-based content delivery is provided, including a satellite content receiver. The satellite content receiver may include one or more processors and a non-transitory processor readable medium, and be in communication with a satellite antenna. The satellite content receiver may receive a first portion of streaming media content, transmitted by a content security host system using multicast communication. The first portion of the streaming media content may be stored, and later accessed in response to a user command. A second portion of the streaming media content including data missing from the first portion of the streaming media content may be identified. The second portion may be requested from the content security host system and received by the satellite content receiver. The first and second portions of the streaming media content may be combined to reconstruct the streaming media content, which may then be output.

Embedding of digital tokens within a digital video can occur cryptographically using a public key in some embodiments. The digital video may be altered in a variety of ways so that the video itself contains an integrated token that can represent various quantities. Audiovisual data can be altered to contain both a token and a perceptible user auditory or visual cue as to the presence of the encrypted digital token. A video with an embedded digital token may be sent to users on the Internet. A video recipient may be able to view the video and also take additional action or gain additional functionality from the digital token embedded in the video. Tokens can be embedded by altering video metadata so that the perceptible video content itself is not changed in some embodiments.

A system for securely providing streaming media content on-demand may include a plurality of receiving devices in which each receiving device may request the same or different streaming media content (e.g., stored at a content storage system of a content delivery network) on-demand using VOD or other available on-demand services and/or applications associated with, in communication with or running on the respective receiving devices. In response, the content storage system of the content delivery network will encrypt the requested content uniquely for each received request (e.g., according to an encryption key that is unique for each or virtually each request) and deliver the encrypted requested content to the appropriate respective receiving device of the receiving devices. The respective receiving devices will then each decrypt the streaming content as it is being received according to the corresponding decryption key communicated from a respective individual secure remote to the respective receiving device.

An apparatus for decoding a media stream includes a memory module, a processor module coupled to the memory module, wherein the memory module contains instructions that when executed by the processor cause the apparatus to perform the following: receive a media stream including a segment signaling information and a plurality of segments, wherein the plurality of segments includes encoded and unencoded segments, wherein the segment signaling information includes identification of at least two segment groups each including at least one segment, identify at least one segment group using the segment signaling information in the media stream, identify at least one segment decoding algorithm for the at least one segment group, identify at least one decoding key for the at least segment group, and decode each encoded segment within the at least segment group using the at least segment decoding algorithm and the at least one decoding key.

A method is provided for delivering a streaming media asset to a client device. For the method, a request is received over a communication network from a client device for playing a media asset in accordance with a streaming media technique. Prior to fully authorizing the client device to play the media asset, the client device is provided with access to a first cryptographic key that decrypts a subset of the media asset so that the client device is able to render the subset of the media asset before completion of the authorization. The subset of the media asset is less than all of the media asset. Subsequent to successfully fully authorizing the client device to play the media asset, the client is provided with access to at least one additional cryptographic key that decrypts a remainder of the media asset.

A method of encoding and encrypting input data (D1) to generate corresponding encoded and encrypted data (E2) is provided. The input data (D1) is encoded to generate intermediate encoded data streams. The intermediate encoded data streams include at least one critical data stream that is critical and essential for subsequent decoding of one or more remaining data streams of the intermediate encoded data streams. The at least one critical data stream is encrypted using one or more encryption algorithms to generate at least one intermediate encrypted data stream. Subsequently, unencrypted portions of the intermediate encoded data streams are merged together with the at least one intermediate encrypted data stream to generate the encoded and encrypted data (E2).

Systems and methods for partial frame encryption in accordance with embodiments of the invention are disclosed. In one embodiment, the method receives a video bitstream that includes several frames, each frame including several independently encoded compression units within the frame, encrypts a portion of each of several compression units in several frames, and generates an output bitstream that includes the several independently encoded compression units including the encrypted portions of the compression units.

A play method for a streaming media file, and a display apparatus are provided. The method comprises: in response to a command for playing a streaming media file on a display of the display apparatus, obtaining the streaming media file and determining a state of the streaming media file; in response to the state of the streaming media file being encrypted state, flowing video data in the streaming media file into a trusted execution environment of the display apparatus, and determining a state of the video data in the trusted execution environment; and in response to the state of the video data being encrypted state, decrypting the video data, decoding the decrypted video data, and then playing the decoded video data.

A non-transitory tangible recording medium stores recorded AV data. The AV data includes a system stream file played by a playback device and a management information file having management information corresponding to the system stream file. The system stream file includes a first segment including repeated a first data unit that be decrypted using a first decryption key that the playback device individually has and a second data unit that cannot be decrypted by the first decryption key. The system stream file also includes a second segment which can be decrypted using a second decryption key that the playback device has in common with another playback device. The management information file has a start source packet number, which identifies a start source packet out of a plurality of source packets storing an I-picture that is a random access point, and the start source packet is situated in the second segment.