CN1452840A - Method and apparatus for random access to individual images in an encrypted video stream - Google Patents

Abstract

A system for providing conditional access to packaged image (video), audio, or other data. The system selectively encrypts the packaged data (105), leaving transport packets (130, 150) including header data (131, 151) unencrypted while leaving all other transport packets (140, 141) that do not include header data encrypted. The system allows random access to transport packets (130, 150) including header data from a memory (230, 310), which is particularly advantageous for performing "trick modes" such as fast forward and fast rewind in video-on-demand services. After the transport packets are selectively encrypted and stored, the transport privacy and control bits (132, 142, 152) of each packet (130, 140, 150) can be accessed to determine whether the packet is encrypted and whether the packet includes header data. If the packet includes header data, it is suitable for trick modes because it provides data from the beginning of the video, audio, or other data packet.

Description

Method and apparatus for random access to individual images in an encrypted video stream

Background of the invention

The present invention relates to an encrypted packetized data processing system. The invention is particularly applicable to video-on-demand (VOD) systems where motion control ("trick modes"), such as fast-forward and fast-rewind modes, are required.

Video on Demand (VOD) is an interactive video service usually provided via a point-to-multipoint distribution system, such as a cable television system. Through the video-on-demand system, users can order videos (such as movies, sports games, etc.) or other types of content at any time without being restricted by a pre-specified program schedule. A full-featured VOD system can provide users with motion control functions similar to a video cassette recorder (VCR), such as: pause (freeze frame), fast forward, fast rewind and slow rewind. These features, also known as trick play, trick mode, or motion control, deepen the user's viewing experience and equal (or exceed) user expectations with typical videotapes, such as those commonly available for purchase or rental. level of control.

In the VOD system, the playback content is stored in the video server, which is a specialized high-capacity file server. After the user purchases, the content can be played from the stored file. To facilitate remultiplexing and error correction, digital video content is usually packaged in units of fixed size. Thus conforming to the MPEG-2 standard (ITU-T Rec.H.222.0, ISO/IEC13818) commonly used in digital televisions.

To implement motion control, the video server controller responds to motion control commands from the set-top box and changes the way content is played back. In fast-forward and fast-rewind modes, the video server skips selected images, producing accelerated video. Depending on the method used, fast random access to individual images in the video file must be possible. In order to reduce storage requirements and enable flexible control of the acceleration factor, images in fast-forward and fast-rewind sequences are usually extracted in real time from a normal video file containing all images of a movie or other program.

There are two ways to find files to display in a scan forward/backward sequence. First, the main video file needs to be browsed sequentially, looking for the starting point of the image. Another method is to create a secondary index file for the picture start points in the main video file.

However, another problem that needs to be solved is controlling access to VOD programming in order to keep the system economically viable. Specifically, a conditional access scheme is implemented whereby access to services or content is denied to unauthorized parties. Conditional access requires a reliable mechanism to classify users into different groups, and an enforcement mechanism to deny access to unauthorized groups of users.

Encryption is often used to control access to the content carried by the carrier signal. A common method for encrypting VOD distribution content is to arrange a real-time encryption device on the transmission path between the video server and the user. This method works well when the number of users is relatively small. However, as the number of users increases, the number of encryption devices and their physical space requirements become a heavy burden. This space problem does not exist in traditional broadcast-type services, because all users share the same content data stream, and the number of encryption devices does not increase with the number of users.

An alternative to real-time encryption of VOD content is offline pre-encryption. In this method, video content is processed and encrypted before being loaded into a video server. The advantage of pre-encryption is that no encryption device is required in the video transmission path, which significantly reduces the cost of VOD services and makes them more scalable. Pre-encryption can be done at a set of content preparation sites separate from the location (headend) where the VOD service is provisioned. After the video is pre-encrypted at the central site, the same encrypted copy can be distributed to multiple headends configured for VOD.

However, pre-encryption of VOD content creates a problem: it prevents the detection of the start point positions of individual images in the video file. Typically, video servers do not have the capability or authorization to decrypt pre-encrypted video content. Therefore, they cannot locate individual images in encrypted video files just by scanning the file. A similar problem arises when encrypted content is stored in a decoder prior to display, and deciphering all images to locate a specific image takes time and is computationally intensive.

Therefore, there is a need to provide a system that avoids the above-mentioned problems.

The system shall support random access to individual images in encrypted video files for modes such as: fast forward, fast rewind, pause, resume playback, slow motion (forward or rewind), frame by frame, or other enhanced Incremental frame advance (incremental frame advance) or browsing (for example: advance N frames at a time, where N>1), and so on.

The system should allow a secure video-on-demand system to be deployed at low cost.

The system should be compatible with packetized data communication schemes such as MPEG-2.

The invention should be compatible with user devices that store encrypted video files, such as personal video recorders (PVRs), PC hard drives, or similar devices.

The present invention provides a system having the above advantages and others.

Contents of the invention

The present invention relates to an encrypted packaged data processing system.

According to one aspect of the present invention, a particular method for providing at least partially encrypted packaged data includes the step of receiving input digital data from a data source, such as a video server. The input digital data includes a number of encoded data segments with corresponding data headers, such as data in MPEG-compatible Packetized Elementary Stream (PES) packets. Subdividing input digital data for transmission in consecutive transport packets, the invention provides at least two types of transport packets, wherein a first type includes at least a portion of the associated data header and a second type includes at least a portion of the associated encoded data segment part but not including any part of the data header.

The second type of transport packets are encrypted while the first type of transport packets are not encrypted. An identifier (identifier) is set for each transmission packet, indicating that each transmission packet is encrypted or not encrypted.

This method allows random access through memory to transport packets with header data, which is particularly advantageous for performing "trick modes" in video-on-demand services, such as fast forward and fast rewind. If a transport packet includes header data, it is suitable for use in trick mode because it provides data from the beginning point of a video, audio or other data packet.

In another aspect of the invention, a method of decoding at least partially encrypted packetized data includes the step of receiving successive transport packets from a transport stream. The transport packets are composed by subdividing the digital data (which includes a number of encoded data segments with respective data headers) into encrypted first-type transport packets including at least a portion of the relevant data headers; and unencrypted second-class A Type 2 transport packet that includes at least a portion of the associated encoded data segment, but does not include any portion of the data header. The transmission packets are respectively provided with identifiers, which indicate whether each transmission packet is encrypted or not.

The transport packets are stored in storage means, and the identifier is used to randomly access the transport packets of the first type from the storage means without decryption. For example, a personal video recorder or other user device that stores partially encrypted transport packets may be employed. Thereafter, when the user wishes to view the data, the transfer packet is decrypted.

The invention also provides corresponding devices.

Description of drawings

Fig. 1 shows the structure of a transport packet according to the present invention.

Figure 2 shows an encoder according to the invention.

Figure 3 shows a user device/decoder according to the invention.

Detailed ways

The invention relates to an encrypted and packaged data processing system.

Fig. 1 shows the construction of a transport packet according to the present invention.

For brevity, only the implementation of the invention in a typical packetized digital video format, such as the MPEG-2 format, will be discussed. However, the invention is applicable to other digital formats with similar characteristics.

In the MPEG-2 format, video information is digitized and compressed prior to encoding. Compression can be considered a part of encoding. The compressed video from program 100 is divided into units of variable length called Packetized Elementary Stream (PES) packets, such as PES packets 105 and 110, each containing a variable number of encoded pictures. For example, PES packet 105 includes encoded images 119 , 121 , . . . , 124 .

The example PES packet 105 has a header 116 and a payload portion 117 . In addition, each picture in PES packet 105 is prefixed with a header containing information about the picture. For example, image 119 has head 118 , image 121 has head 120 , and image 124 has head 123 .

In order to transmit and store data, the PES packet is further subdivided into fixed-length units called transport packets, such as: transport packets 130 , 140 and 150 . According to the MPEG-2 standard, each transport packet consists of 188 bytes. Typically, the length of a PES packet is much larger than the size of a Transport Stream packet. Each transport packet has a header and a payload section. The transport packet header includes, among other information, two transport scrambling control bits indicating the encryption (scrambling) status of the packet.

In the MPEG-2 standard, the coded privacy control bits are specified by the field "Transmission Privacy Control". The security control value "00" indicates that the transmission packet is not confidential, while the values "01", "10" and "11" can be defined by the user. The value "11" is used here as an example, indicating a confidential or encrypted transport packet. Any type of similar scheme may be employed to represent the encryption status of transmitted packets.

Transport packet 130 includes header 131 , privacy control bits 132 (which represent an unencrypted transport packet) and payload 133 . Transport packet 140 includes header 141 , privacy control bits 142 (which represent an encrypted transport packet) and payload 143 . Transport packet 150 includes header 151 , privacy control bits 152 (which represent an unencrypted transport packet) and payload 153 .

Each transport packet is constituted by subdividing the contents of consecutive parts of the PES packets. For example, payload 133 of transport packet 130 includes PES header 116 , image header 118 , and a portion of image data 119 of PES payload 117 . The payload 143 of the transport packet 140 includes a contiguous portion of the image data 119 of the PES payload 117 . The payload 153 of the transport packet 150 includes the image header 120 and part of the image data 121 of the PES payload 117, and so on.

Please note that what is shown in Figure 1 is a simplified form, in practice, the data of an image is usually carried in the payload of several transport packets. In addition, the amount of image data (eg, fields 119, 121, 124) is usually much larger than the corresponding amount of image header data (eg: fields 118, 120, 123, respectively). Therefore, most transport packets only carry image data, not image header data, resulting in most transport packets being encrypted and relatively few transport packets not being encrypted. Therefore, unauthorized users who tune into most encrypted programs cannot view the program normally.

The transport packets are combined into transport streams and delivered to user terminals (eg set-top boxes) usually via satellite, cable or hybrid fiber/cable networks, but communication can be via virtually any network such as a computer network. If provisioned at the central content preparation site, the transport stream may be provided to one or more headends before being provided to user terminals.

Typically, the data can be provisioned at, for example, a central staging site or headend for a national service provider, or each content vendor can arrange its own content staging according to any special needs of its own equipment.

As is well known, a transport stream is multiplexed and formed by interleaving transport packets belonging to one or more programs. Transport packets belonging to different programs in a transport stream are distinguished by a packet identifier (PID) in their header. A single program transport stream consists of only one program transport stream.

Figure 2 shows an encoder according to the invention. Encoder 200 includes a device for performing selective packet encryption. The devices shown may be located, for example, at a central content preparation site or headend.

The invention can overcome the problem of image starting point location caused by pre-encryption. As mentioned above, this is achieved by leaving some selected (transport stream) packets in the video file unencrypted. An equipment configuration 200 for this purpose includes one or more digital video sources 210, a pre-processing workstation 215 for generating auxiliary data files and marking selected encrypted packets, encryption means 220, encryption means controller 205, An optional post-processing workstation 225 of the video (eg, to adjust timing information that may be scrambled by encryption procedures), and a storage device 230 to store the processed data before it is provided to the headend or end user.

In encoder configuration 200, digital video source 210 provides a digital video stream to be encrypted. The video source can be a digital video encoder, or a file server that plays back pre-encoded video files. The digital video stream is fed to a pre-processing workstation 215 whose main function is to identify and mark encrypted transport packets. Packets that do not contain the image header or part thereof are selected for encryption, so they do not need to be checked by the video server during motion control (trick mode). Mark transfer packets selected for encryption by setting the transfer privacy control bit to a specific value (eg "11").

Also, unencrypted packets are marked with a different specific value (eg "00"). The preprocessing step optionally generates ancillary data files for delivery of VOD services.

The encryption of the preprocessed video stream is performed by the encryption device 220 under the control of the device controller 205, and corresponds to the encryption control parameters in sequence. Any suitable encryption scheme may be employed. Encryption control parameters may include, for example, information related to encrypted programs and/or specific encrypted sessions. When performing encryption, the encryption device 220 checks the transport security control bits of each transport packet. Two control bits set to, for example, "00" do not encrypt, while those set to, for example, "11" encrypt.

The output of encryption device 220 , which contains selectively encrypted video streams, is optionally passed through a post-processing stage (eg, workstation 225 ) before being stored in storage device 230 . Post-processing may or may not be required, depending on the design and implementation of the VOD service equipment.

In order to search for an image start point in a pre-encrypted video file during trick mode playback, the video server sequentially scans transport packets in the video file. The transfer privacy control bit in the header of each transfer packet indicates whether the packet is encrypted. If the packet is encrypted, it can be inferred that it does not contain a file header. If the packet is not encrypted, the payload can be inspected to locate the image header.

The video server can also read other types of information embedded in the pre-encrypted video file, such as: private data in the adaptation field of the transport packet header.

Figure 3 shows a user device/decoder according to the present invention.

Optionally, program content may be temporarily stored at the user device/decoder prior to playback. The device may be a personal video recorder, or other terminal or device in the user's home, or even a portable device that may be carried by the user or used in a car.

For example, a user may purchase or lease a storage device containing a program for subsequent rebroadcast rather than playing it at a specific time under the control of the headend. In the case of purchase, the user can replay unlimitedly, while in the case of rental, the user can replay only a fixed number of times or within a valid period.

Alternatively, the user may be given the option to store the transport stream prior to playback.

Therefore, the UE/decoder 300 may be capable of providing motion control (eg, trick mode).

Decoder 300 may include a demultiplexer (demux) 302 that receives a transport stream with encrypted and unencrypted transport packets (such as those previously stored in the storage device shown in FIG. 2 ) and optionally Receive other programming services. Other necessary components, such as components for demodulation, error correction, synchronization, etc., are not shown in the figure, but the components are obvious to those skilled in the art.

The demultiplexer 302 extracts encrypted or unencrypted packets belonging to a particular program. The transport stream of extracted packets is stored in the memory 310, or provided to the second demultiplexer 305, which separates encrypted transport packets from unencrypted transport packets. For example: storing a complete movie etc. in the memory 310 for subsequent retrieval and motion control. The memory 310 is similar to the storage device 210 shown in FIG. 2 .

Demultiplexer 305 includes a security control bit identifier/detector 306 for identifying the security control bits of each transmitted packet to determine whether the packet is encrypted.

A controller 335 , such as a central processing unit (CPU), provides monitoring of various functions within the decoder 300 .

User interface 340 receives commands from the user (eg, via a hand-held remote control) to view programs in normal play mode or trick mode. In response to such a request, interface 340 provides a corresponding signal to controller 335 instructing memory 310 to output the packet to demultiplexer 305 . Video/audio/data processing functional block 320 receives unencrypted packets from decryptor 315 and demultiplexer 305 .

Data from function 320 is provided to output device 325, such as: a television, personal computer, speakers, etc. Output device 325 may provide a graphical user interface (GUI) or other mechanism to assist the user in playing program content in normal or trick mode. Users can also order programs through this interface.

An optional upstream transmitter 330 transmits user requests (eg, ordering a VOD program) to a headend or other network control facility. The user request may be transmitted over the same or a different channel than the received transport stream.

It should now be appreciated that the present invention provides a system for conditional access to packaged image, audio or other data. The system selectively encrypts packetized data so that packets that include header data are not encrypted, while all other packets that do not include header data are encrypted. The system allows random access from memory to transport packets including header data, which is particularly advantageous for performing trick modes such as fast forward and fast rewind in video-on-demand services.

In particular, when transport packets are selectively encrypted and stored, the transport security and control bits of each packet can be accessed to determine whether the packet is encrypted, and subsequently determine whether the packet includes header data. If a packet includes header data, it is suitable for trick mode because it provides data from the beginning point of the video, audio or other data packet.

Although various specific embodiments have been combined when describing the present invention, those skilled in the art should understand that various adjustments and modifications can be made to the present invention without departing from the spirit and scope of the claims of the present invention. .

For example, instead of being transmitted to a user terminal, a selectively encrypted transport packet may be transmitted to a storage device, such as a personal video recorder (PVR), for later retrieval by the user.

Claims (29)

1. one kind is used to provide the method to the packing data of small part encryption, and its step comprises:

(a) reception is from the input digital data of data source;

Wherein this input digital data comprises a plurality of coded data sections of data head separately that have;

(b) described input digital data is segmented so that transmit with continuous transmission bag, thereby provide at least two classes to transmit bag, wherein the first kind comprises at least a portion of related data head, and second class comprises at least a portion of correlative coding data segment but do not comprise any part of described data head;

(c) described second class is transmitted bag and encrypt, do not encrypt and the described first kind is not transmitted bag; And

(d) described transmission bag is provided with identifier respectively, encrypts or do not encrypt to show that this transmission bag is respectively.

2. method according to claim 1, wherein: described second class transmits in the bag has data that comprise from a plurality of described data segments at least.

3. method according to claim 1, wherein: in the Packet Elementary Stream bag, receive described input digital data.

4. method according to claim 1, wherein: in the head separately of each described transmission bag, identifier is set.

5. method according to claim 1, its step further comprises:

Described transmission bag is stored in the storage device;

Wherein said identifier makes it possible to from described storage device the described first kind of arbitrary access and transmits bag and need not to be decrypted.

6. method according to claim 5, its step further comprises:

At least one described first kind of arbitrary access transmits bag, so that the special-effect mode of described transmission bag to be provided.

7. method according to claim 6, wherein said special-effect mode comprises following at least a: F.F., slow-motion, fall, fall slowly, suspend, recover to play and the delta frame motion soon.

8. method according to claim 5, wherein: described storage device comprises a video server.

9. method according to claim 1, its step further comprises:

Described transmission bag is stored in the storage device; And

According to user's request, from described storage device, retrieve described transmission bag, and this transmission bag that is retrieved is offered the user by network.

10. method according to claim 9, wherein: in video-on-demand service, the described transmission bag that is retrieved is offered this user.

11. method according to claim 9, its step further comprises:

Be provided for deciphering the information that described second class transmits bag to described user; And

Transmit bag and provide demonstration by the described first kind through described second class transmission bag of deciphering.

12. method according to claim 1, wherein: described data source comprises a digital video code.

13. method according to claim 1, wherein: described data source comprises the file server of a playback through the video file of precoding.

14. method according to claim 1, wherein: at least one described first kind transmits at least a portion that also comprises a correlative coding data segment in the bag.

15. method according to claim 1, wherein: described input digital data comprise video and voice data at least one of them.

16. method according to claim 1 wherein, provides the described transmission bag with corresponding described identifier at central content preparation website, to be assigned at least one user network headend subsequently.

17. a method that decodes to the packing data that small part is encrypted, its step comprises:

(a) receive transmission bag continuously from transmitting stream; Wherein

This transmission bag forms in the following manner: will comprise a plurality ofly having separately the coded data section of data head and be subdivided at least two classes and transmit bag, wherein the first kind transmits at least a portion that comprises the related data head, and second class transmits any part that comprises at least a portion of correlative coding data segment but do not comprise described data head;

Described second class is transmitted packet encryption, and described first kind transmission bag is not encrypted; And

Described transmission bag is provided with identifier respectively, encrypts or do not encrypt to show that this transmission bag is respectively;

(b) described transmission bag is stored in the storage device; And

(c) utilize described identifier at least one described first kind of arbitrary access from this storage device to transmit bag, and need not to be decrypted.

18. method according to claim 17, wherein: at least some described second classes transmit the data that comprise from a plurality of described data segments.

19. method according to claim 17, wherein: the described numerical data in the Packet Elementary Stream bag is segmented.

20. method according to claim 17, the wherein said step of utilizing comprises: by the corresponding head recovery described identifier separately of each described transmission bag.

21. method according to claim 17, wherein: at least one described first kind of arbitrary access transmits bag, so that the special-effect mode of this transmission bag to be provided.

22. method according to claim 21, wherein said special-effect mode comprises following at least a: F.F., slow-motion, fall, fall slowly, suspend, recover to play and the delta frame motion soon.

23. method according to claim 17, wherein: described storage device comprises a decoder memory.

24. method according to claim 17, wherein: in video-on-demand service, described transmission bag is offered the user.

25. method according to claim 17, its step further comprises:

Described second class is transmitted the bag deciphering; And

Transmit bag and provide demonstration by the described first kind through described second class transmission bag of deciphering.

26. method according to claim 17, wherein: at least one described first kind transmits at least a portion that also comprises a correlative coding data segment in the bag.

27. method according to claim 17, wherein: described numerical data comprise video and voice data at least one of them.

28. one kind is used to provide the device to the packing data of small part encryption, it comprises:

Be used to receive device from the input digital data of data source;

Wherein this input digital data comprises a plurality of coded data sections of data head separately that have;

Described input digital data is segmented so that transmit with continuous transmission bag, thereby provide at least two classes to transmit bag, wherein the first kind comprises at least a portion of related data head, and second class comprises at least a portion of correlative coding data segment but do not comprise any part of described data head;

Be used for described second class is transmitted the device that bag is encrypted and described first kind transmission bag is not encrypted; And

Be used for that described transmission bag is provided with identifier (identifier) respectively and be respectively the device of encrypting or not encrypting to show this transmission bag.

29. a device that is used to decode to the packing data that small part is encrypted, it comprises:

Be used for receiving the device that transmits bag continuously from transmitting stream; Wherein

This transmission bag forms in the following manner: will comprise a plurality ofly having separately the coded data section of data head and be subdivided at least two classes and transmit bag, wherein the first kind transmits at least a portion that comprises the related data head, and second class transmits any part that comprises at least a portion of correlative coding data segment but do not comprise described data head;

Described second class is transmitted packet encryption, and described first kind transmission bag is not encrypted; And

Described transmission bag is provided with identifier respectively, encrypts or do not encrypt to show that this transmission bag is respectively;

Be used for described transmission bag is stored in the device of a storage device; And

The device that utilizes described identifier at least one described first kind of arbitrary access from this storage device to transmit bag and need not to be decrypted.

Images