KR20020091254A - Method and apparatus for enabling random access to individual pictures in an encrypted video stream - Google Patents

Abstract

The present invention is a system for providing conditional access to packetized pictures (video), audio or other data. The system selectively encrypts the packetized data 105 such that the transport packets 130, 150 including the header data 131, 151 are unencrypted, while all other transport packets 140, 141 that do not contain the header data are encrypted. This allows transport packets with header data 230,310 to be randomly accessed from memory 230,310, which is particularly advantageous for performing "trick modes" such as fast forward, fast reverse, for example in VOD services. After the transport packet is optionally encrypted and stored, the transport scrambling and control bits 132, 142, 152 for each packet 130, 140, 150 can be accessed to determine if the packet is encrypted and, as a result, whether the packet contains header data. have. If the packet contains header data, it provides data from the beginning of the video, audio, or other data packet, which is suitable for use in trick mode.

Description

TECHNICAL AND APPARATUS FOR ENABLING RANDOM ACCESS TO INDIVIDUAL PICTURES IN AN ENCRYPTED VIDEO STREAM}

VOD is an interactive video service typically provided via a point-multipoint distribution system such as a cable television system. According to VOD, subscribers can order video (movies, sports, etc.) or other forms of content at any time without being obsessed with a predefined show schedule. A full-function VOD system provides subscribers with a video control recorder (VCR) with motion control functions such as pause (stop frame), fast forward, fast reverse, and slow reverse. Variously known as trick play, trick mode, or motion control, these features enhance the subscriber's viewing experience and mimic (or exceed) the level of control the subscriber expects from a typical video tape that can be purchased or rented normally. .

In a VOD system, content is stored in a video server, which is a specialized high capacity file server. The content is played from the stored file upon purchase by the subscriber. To facilitate remultiplexing and error correction, digital video content is typically packetized in fixed size units. This is the case for the popular MPEG-2 standard (ITU-T Rec. H.222.0 | ISO / IEC 13818) used in digital television.

To perform motion control, the video server controller responds to motion control commands from the set-top box and changes the way content is played. For fast forward and fast reverse, the video server will skip the selected picture to cause a speeded up version of the video. According to the adopted method, it may be necessary to have fast, random access to the individual pictures of the video file. In order to reduce storage requirements and allow for flexible control of the speed-up factor, the pictures in the fast forward and fast reverse sequences are often extracted in real time from a typical video file containing all the pictures in a movie or other program.

There are two ways to retrieve the image displayed in the scan forward / backward sequence. The first is to scan the main video file to find the beginning of the picture continuously. Another way is to build an auxiliary index file for the starting point of the picture in the main video file.

However, another concern is controlling access to, for example, VOD programs, to maintain the financial capacity of the system. In particular, conditional access structures are implemented to deny access to services or content by unauthorized third parties. Conditional access is a trusted mechanism for classifying users with other groups, and authorization is granted. Requires enforcement mechanisms to deny access to groups of users who are not.

Encryption is often used to control access to content carried by a carrier signal. A common approach to encrypted content for VOD distribution is to have a real-time encryption device on the delivery path between the video server and the subscriber. This approach works well when the number of subscribers is relatively small. However, as the number of subscribers increases, the number of encryption devices and their physical space requirements become burdensome. Since the same content stream is shared by all subscribers and the number of encryption devices does not increase with the number of subscribers, this spatial problem does not exist in traditional broadcast service.

An alternative to real-time encryption of VOD content is off-line, pre-encryption. In this approach, video content is processed and encrypted before being loaded into the video server. The advantage of pre-encryption is that it eliminates the need for an encryption device on the video delivery path, making the VOD service substantially lower cost and larger. Pre-encryption can be done centrally at the content preparation site that is separate from the location (headend) where the VOD service is deployed. Once the video is pre-encrypted at the central site, the same encrypted copy can be distributed to multiple headends where the VOD is deployed.

However, pre-encrypted VOD content introduces the problem of an interface with the position detection of the starting point of individual pictures in the video file. In general, video servers do not have the capability or authority to decrypt pre-encrypted video content. As a result, by scanning the file, it becomes impossible to place individual pictures in the encrypted video file. Where time-consuming and computationally thorough about having to decode all pictures to locate a particular picture, a similar problem is encountered when encrypted content is stored in a decoder before being displayed.

Therefore, it is desirable to provide a system in which the above issues are addressed.

The system may be in modes such as fast forward, fast reverse, pause, restart, slow motion (forward or reverse), one frame or another incremental frame advance or scan (e.g., N frame advance at the same time, where N> 1). For use, random access to individual pictures in an encrypted video file must be enabled.

The system must allow secure VOD systems to be deployed at reduced cost.

The system must be compatible with packetized data communication structures such as MPEG-2.

The present invention should be compatible with user devices that store encrypted video files, such as personal video recorders (PVRs), personal computer hard disks, and the like.

The present invention provides a system having the above and other advantages.

The present invention relates to an encrypted packetized data processing system and is particularly suitable for use in video-on demand (VOD) where motion control ("trick mode") such as fast forward and fast reverse mode is required.

1 is a view showing the form of a transport packet according to the present invention,

2 shows an encoder according to the invention,

3 illustrates a user device / decoder according to the present invention.

The present invention relates to an encrypted packetized data processing system.

According to a first aspect of the invention, a particular method for providing at least partially encrypted packetized data comprises receiving input digital data from a data source, such as a video server. The input digital data includes a number of encoded data segments associated with data headers as found in MPEG-compliant Packetized Elementary Stream (PES) packets. The input digital data is subdivided to continuously transmit transport packets, and thus includes a first form that includes at least a portion of an associated data header, and at least a portion of an associated encoded data segment but not a predetermined portion of the data header. At least two types of transport packets are provided, including a second type.

The transport packet of the second form is encrypted while the transport packet of the first form is unencrypted. An identifier is provided for each transport packet to indicate whether each transport packet is encrypted or deencrypted.

This allows transport packets with header data to be randomly accessed from memory, which is particularly advantageous for performing "trick modes" such as fast forward and fast reverse, for example in VOD services. If the packet contains header data, it provides data from a video, audio or other data packet, which is suitable for use in trick mode.

In another aspect of the present invention, a method for decoding at least partially encrypted packetized data includes receiving consecutive transport packets from a transport stream. The transport packet includes digital data comprising a plurality of encoded data segments associated with the data header, the first encrypted form comprising at least a portion of the associated data header, and at least a portion of the associated encoded data segment. The predetermined portion of the data header is formed by subdividing it into a second, non-encrypted form that does not contain it. An identifier is provided for each transport packet to indicate whether each transport packet is encrypted or deencrypted.

The transport packet is provided to the storage, and the identifier is used to randomly access the transport packet of the first type from the storage without performing decryption. For example, a PVR or other user device may be used that stores partially encrypted transport packets. The packet is actually placed when the user wants to see the data.

Corresponding apparatus is also provided.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

The present invention relates to an encrypted data processing system.

1 is a diagram showing the form of a transport packet according to the present invention.

To facilitate the description, an implementation of the present invention in a typical packetized digital video format such as MPEG-2 is described. However, the present invention can be applied to other digital formats that share a similar configuration.

In the MPEG-2 format, video information is digitized and compressed before being encoded. Compression can be a significant part of the encoding. The compressed video from the program 100 is divided into variable length units called Packetized Elementary Streams (PES), such as PES packets 105 and 110, each containing a variable number of encoded pictures. For example, PES packet 105 includes encoded pictures 119,121, ---, 124.

The PES packet 105 has a header 116 and a payload portion 117. Moreover, each picture of the PES packet 105 is prefixed by a header containing information related to the picture. For example, image 119 has a header 118, image 121 has a header 120, and image 124 has a header 123.

For transmission and storage purposes, PES packets are further classified into fixed length units called transport packets such as transport packets 130, 140 and 150. According to the MPEG-2 standard, each transport packet has 188 bytes. In general, the PES packet length is larger than the size of the transport stream packet. Each transport packet has a header and a payload portion. The header of the transport packet includes two transport scrambling control bits that indicate the encryption (scrambled) status of the packet among other information.

In the MPEG-2 standard, the scrambling control bits are designated by the field "transport_scrambling_control". A scrambling control value of "00" indicates that the transport packet is not scrambled, while the values "01", "10", and "11" may be user defined. Here, the value "11" is used as an example to indicate a scrambled or encrypted transport packet. Certain forms of analog architecture may be used to indicate the encryption status of transport packets.

The transport packet 130 includes a header 131, a scrambling control bit 132 (which indicates an unencrypted transport packet), and a payload 133. The transport packet 140 includes a header 141, a scrambling control bit 142 (which indicates an unencrypted transport packet), and a payload 143. The transport packet 150 includes a header 151, a scrambling control bit 152 (which indicates an unencrypted transport packet), and a payload 153.

Each transport packet is formed by subdividing the content of consecutive portions of the PES packet. For example, the payload 133 of the transport packet 130 includes a PES header 116, a picture header 118, and a portion of the picture data 119 of the PES payload 117. The payload 143 of the transport packet 140 includes a continuous portion of the image data 119 of the PES payload 117. The payload 153 of the transport packet 150 includes an image header 120 and a portion of the image data 121 of the PES payload 117.

It should be noted that Figure 1 is shown in simplified form in practice, since data from one picture is typically carried in the payload of several transport packets. Moreover, the amount of image data (eg, fields 119, 121, 124) is often greater than the amount of corresponding image header data (eg, fields 118, 120, 123, respectively). As a result, most of the transport packets carry only picture data without carrying picture header data, so that relatively few transport packets are unencrypted, and most of the transport packets are encrypted. Thus, a user who is mostly not authorized to fit an encrypted program will not be able to watch the program with clear understanding.

Transport packets are typically assembled into transport streams and, although computer networks are also critically mediated communications such as are also possible, typically user terminals (eg, set-ups) via satellite, cable, or hybrid fiber / cable networks. Top box). Once prepared at the central content preparation site, the transport stream may be provided to one or more headends before being served to the user terminal.

In general, the data may be prepared at the central preparation site by the state-owned provider at the headend, or each content seller may be arranged for its own content preparation, for example according to certain specific needs of the equipment.

As is known, transport streams are multiplexing formed by interleaving transport packets belonging to one or more programs. Transport packets belonging to different programs of the transport stream are identified by PID (Packet Identifer) in their header. A single program transport stream contains transport packets of only one program.

2 is a diagram illustrating an encoder according to the present invention. The encoder 200 is equipped with equipment for performing selective packet encryption. The described equipment may be located at a central content preparation site or headend, for example.

The present invention overcomes the problem of locating the image start point caused by the use of pre-encryption. This is accomplished by placing a non-encrypted selected (transport stream) packet in the video file as described. The equipment set-up 200 to accomplish this pre-processing for generating one or more digital video sources 210 and auxiliary data files, as well as for labeling selected packets for encryption. Workstation 215, encryption device 220, encryption controller 205, conditional post-processing for processing encrypted video (e.g., adjusting time information that may be disrupted by encryption). post-processing workstation 225, and storage 230 for storing processed data prior to providing it to the headend or end user.

In encoder set-up 200, the digital video source 210 supplies a digital video stream to be encrypted. The video source may be a digital video encoder or a file server that plays pre-encoded video files. The digital video stream is fed to a pre-processing workstation 215 whose main function is to identify and label the transport packet for encryption. The packet is selected for encryption if it contains no picture header or part thereof, and thus does not need to be tested by the video server during motionshire control (trick mode). The transport packet selected for encryption is labeled by having the transport scrambling control bit set to a certain specific value (eg, "11").

Packets left unencrypted are likewise labeled using other specific values (eg, "00"). The pre-processing step conditionally generates an auxiliary data file used in the delivery of the VOD service.

Encryption of the pre-processed video stream is in turn performed by the encryption device 220 under the control of the device controller 205 in response to the encryption control parameters. Any suitable encryption scheme can be used. Encryption control parameters may include, for example, information relating to the program being encrypted, or to a particular encryption session, or both. When encryption is performed, the encryption apparatus 220 tests the transmission scrambling control bit of each transport packet. For example, a packet with two bits set to "00" remains unencrypted, while a packet with bits set to "11", for example, is encrypted.

The output of the encryption device 220, optionally with an encrypted video stream, is conditionally processed through a post-processing stage (eg, workstation 225) before being stored in storage 230. Post-processing may or may not be necessary depending on the design and implementation of the VOD service equipment.

During trick mode play, the video server continuously scans the transport packets in the video file to retrieve the starting point of the picture in the pre-encrypted video file. The transport scrambling control bit in each transport packet header indicates whether the packet is encrypted. If the packet is encrypted, it can be inferred that it does not contain the picture header. If the packet is unencrypted, the payload can be tested to locate the picture header.

The video server can still read other kinds of information embedded in pre-encrypted video files, such as personal data in the field of application of transport packet headers.

3 illustrates a user device / decoder according to the present invention.

Conditionally, program content may be temporarily stored on the user device / decoder prior to play. The device may be a PVR or other terminal or facility in a user's home, or a portable unit carried by a user or used in a vehicle.

For example, rather than playing at a specific time under the control of the headend, a storage device containing programming can be purchased or rented for continuous playback by the user. Under the purchase scenario, the user can enjoy unlimited playback, while under the rental scenario a fixed number or expiration date of the playback can be enforced.

Or, the user may be given the option to save the transport stream before playing.

Thus, the user device / decoder 300 may be provided with the ability to provide motion control (eg, trick mode).

Decoder 300 may include a transport stream having encrypted and unencrypted transport packets as previously stored in storage 230 of FIG. 2 and a demultiplexer 302 (DEMUX) that conditionally receives other programming services. Can be. For example, other necessary components for demodulation, error correction, synchronization, and the like are not shown, but are apparent to those skilled in the art.

DEMUX 302 extracts encrypted and unencrypted packets belonging to a particular program. The extracted stream of packets is provided to a second DEMUX 305 that separates encrypted transport packets from unencrypted transport packets stored in memory 310. For example, the entire movie or the like may be stored in the memory 310 for continuous retrieval and motion control. The memory 310 is similar to the storage device 300 of FIG. 2.

DEMUX 305 includes a scrambling control bit identifier / detector 306 that identifies the scrambling control bit of each transport packet to determine whether the packet has been encrypted or unencrypted.

The controller 335, such as the CPU, provides supervision of various functions at the decoder 300.

The user interface 340 receives commands from a user, for example, via a handheld remote controller to view content in a normal play mode or trick mode. In response to this request, interface 340 provides a signal corresponding to controller 335 instructing memory 310 to output the packet to DEMUX 305. The video / audio / data processing function 320 receives unencrypted packets from the decoder 315 and the DEMUX 305.

Data from the function unit 320 is provided to an output device 325 such as a television, a personal computer, a speaker, or the like. The output device 325 may provide a graphical user interface (GUI) or other mechanism to assist the user in playing programming content in normal or trick mode. The user can also arrange the order for the content via this interface.

Conditional upstream transmitter 330 sends a user request, such as an order for VOD programming, to the headend or other network control facility. The user request may travel over the same or different channel through which the transport stream is received.

It will be apparent that the present invention provides a system for providing conditional access to packetized pictures, audio or other data. The system selectively encrypts the packetized data so that transport packets containing header data are unencrypted, while all other transport packets that do not contain header data are encrypted. This allows transport packets with header data that are randomly accessed from memory, which is particularly advantageous for performing trick modes such as fast forward and fast reverse rotation in, for example, VOD services.

In particular, after transport packets are selectively encrypted and stored, the transport scrambling and control bits for each packet can be accessed to determine whether the packet is encrypted and whether the packet contains header data. If the packet contains header data, it provides data from the beginning of the video, audio, or other data packet, which is suitable for use in trick mode.

The present invention is not limited to the above embodiments, and of course, various modifications can be made within the scope not departing from the gist of the present invention.

For example, an optionally encrypted transport packet does not need to be sent to the subscriber terminal and can be provided to storage for continued retrieval by a user, such as at a PVR.

Claims (29)

(a) receiving, from a data source, input digital data comprising a plurality of encoded data segments having respective data headers; (b) at least two forms of transmission comprising a first form comprising at least a portion of an associated data header and a second form comprising at least a portion of an associated encoded data segment but not including a predetermined portion of the data header Subdividing the input digital data to continuously transmit the transport packet such that the packet is provided; (c) encrypting the second type of transport packet while deciphering the first type of transport packet; (d) providing an identifier for each transport packet to indicate whether each transport packet is encrypted or unencrypted. The method of claim 1, wherein at least one of the transport packets of the second type comprises data from multiple data segments. 2. The method of claim 1, wherein the input digital data is received in packetized elementary stream packets. 2. The method of claim 1, wherein an identifier is provided in each header of each transport packet. The method of claim 1, further comprising storing the transport packet in a storage device; And wherein the identifier can randomly access the first type of transport packet from the storage device without performing decryption. 6. The method of claim 5, further comprising randomly accessing at least one first type of transport packet to provide a trick mode for the transport packet. 7. The method of claim 6, wherein the trick mode comprises at least one of fast forward, slow forward, fast reverse, slow reverse, pause, redo, and incremental frame motion. 6. The method of claim 5 wherein the storage device comprises a video server. The method of claim 1, further comprising: storing the transport packet in storage; Responsive to a user request, retrieving a transport packet from storage and providing the retrieved transport packet to a user device via a network. 10. The method of claim 9, wherein the retrieved transport packet is provided to a user device in a VOD service. 10. The method of claim 9, further comprising: providing information to a user for decrypting a second type of transport packet; Providing a display from the transport packet of the first form and the decrypted transport packet of the second form. The method of claim 1 wherein the data source comprises a digital video encoder. 2. The method of claim 1, wherein the data source comprises a file server that plays pre-encoded video files. The method of claim 1, wherein the at least one first type of transport packet also includes at least a portion of an associated encoded data segment. 2. The method of claim 1 wherein the input digital data comprises at least one of video and audio data. 2. The method of claim 1, wherein a transport packet with each identifier is provided at a central content preparation site for continuous distribution to at least one subscriber network headend. (a) receiving consecutive transport packets from the transport stream; (b) storing the transport packet in storage; (c) using the identifier to randomly access at least one first type of transport packet from storage without performing decryption; The data packet includes a portion of the encoded data segment including at least a portion of the encoded data segment associated with at least a first form comprising at least a portion of the associated data header. A predetermined portion of is formed by subdividing into at least two types of transport packets including a second type not including; The transport packet of the second form is encrypted while the transport packet of the first form is unencrypted; And an identifier is provided for each transport packet to indicate whether each transport packet is encrypted or unencrypted. 18. The method of claim 17, wherein at least some of the second types of transport packets include data from multiple data segments. 18. The method of claim 17, wherein the digital data is subdivided from packetized elementary stream packets. 18. The method of claim 17, wherein said using step comprises recovering an identifier from each header of each transport packet. 18. The method of claim 17, wherein at least one first type of transport packet is randomly accessed to provide a trick mode for the transport packet. 22. The method of claim 21, wherein the trick mode comprises at least one of fast forward, slow forward, fast reverse, slow reverse, pause, redo, and incremental frame motion. 18. The method of claim 17, wherein the storage device comprises a decoder memory. 18. The method of claim 17, wherein the transport packet is provided to a user device in a VOD service. 18. The method of claim 17, further comprising: decrypting a transport packet of a second type; And providing a display from the transport packet of the first form and the decrypted transport packet of the second form. 18. The method of claim 17, wherein the at least one first type of transport packet also includes at least a portion of an associated encoded data segment. 18. The method of claim 17, wherein the digital data comprises at least one video and audio data. Means for receiving input digital data from a data source, the input digital data comprising a plurality of encoded data segments having respective data headers; At least two forms of transport packets comprising a first form comprising at least a portion of an associated data header and a second form comprising at least a portion of an associated encoded data segment but not including a predetermined portion of the data header Preferably, means for subdividing the input digital data for continuously transmitting the transport packet; Means for encrypting a second type of transport packet while unencrypting the first type of transport packet; And means for providing an identifier for each transport packet to indicate whether each transport packet is encrypted or unencrypted. Means for receiving consecutive transport packets from the transport stream; Means for storing a transport packet in storage; Means for using the identifier to randomly access at least one first type of transport packet from storage without performing decryption; The data packet includes a portion of the encoded data segment including at least a portion of the encoded data segment associated with at least a first form comprising at least a portion of the associated data header. A predetermined portion of is formed by subdividing into at least two types of transport packets including a second type not including; The transport packet of the second form is encrypted while the transport packet of the first form is unencrypted; And an identifier is provided for each transport packet to indicate whether each transport packet is encrypted or unencrypted.