This international application claims priority to U.S. Application Serial No. 10/940,631, filed on September 15, 2004, entitled, "Preview of Payable Broadcasts," of which the entire contents is incorporated by reference herein.

FIELD OF THE INVENTION

[0001] The present invention relates to wireless communications. More particularly, the present invention relates to techniques delivering previews of payable transmissions.

BACKGROUND OF THE INVENTION

[0002] In digital broadcast systems, streaming content, such as television programming, is transmitted to consumers in encrypted form. To view this content, consumers must purchase rights to do so. In return, paying consumers receive one or more keys to decrypt the content upon reception.

[0003] Examples of such systems include direct video broadcast (DVB) systems, such as DVB-T and DVB-C networks, where certain television programs may be broadcast in encrypted form and can be viewed for payment. The term conditional access (CA) is often used to describe the encryption/decryption solution. This solution typically involves a set top box (STB) at a consumer's premises that is equipped with a vendor- specific CA module. This CA module stores the keys and performs the decryption process.

[0004] IP datacast (IPDC) over DVB-H (i.e. digital video broadcast to handheld devices) network is a new system that provides for the broadcast of various types of content using Internet Protocol (IP) transmissions across DVB transport systems. A DVB-H network has a fixed total capacity. The channel's exact capacity depends on the employed modulation parameters. For DVB-H, capacity is typically between 5 and 15 megabits per second (Mbps) for mobile and indoor reception. In DVB-H, this total bandwidth is divided into a number of timeslice channels that each have a static bit rate to facilitate mobility and handover.

[0005] Providers of streaming content (e.g., broadcasters of television programs) often wish to supply potential consumers with previews of the content. Thus, while an entire television program is viewable only for payment, short previews of the program may be viewed free of charge.

[0006] Providing such previews is technically challenging because such content streams are typically broadcast encrypted. Current technical challenges involve broadcasting an unencrypted (or plaintext) content stream without duplicating the required broadcast bandwidth and limiting the preview to short time periods while giving consumers the chance to freely pick the time of their preview.

SUMMARY OF THE INVENTION

[0007] The present invention provides techniques for delivering previews of content. Accordingly, in a aspect of the present invention, a system and method designate one or more portions of a content item for previewing; generate an electronic services guide (ESG) having information regarding the one or more designated portions; transmit the one or more designated portions in a plaintext form across a network; and transmit the remaining portions of the content item in an encrypted form across the network.

[0008] In a further aspect of the present invention, a method and system designate one or more portions of a content item for previewing; generate an electronic services guide (ESG) having information regarding the one or more designated portions; transmit the content item in an encrypted form across a network; transmit a plurality of content keys across the network in an encrypted form, each of the plurality of keys for decrypting a corresponding portion of the content item; and transmit one or more of the plurality of content keys across the network in plaintext form, wherein the one or more of the plurality of keys correspond to the one or more designated portions of the content item.

[0009] In a yet a further aspect of the present invention, a method and system transmit a content item in an encrypted form across a network; transmit a plurality of content keys across the network in an first encrypted form, each of the plurality of keys for decrypting a corresponding portion of the content item; transmit one or more of the plurality of content keys across the network in a second encrypted form; transmit a subscriber rights key across the network for decrypting the plurality of content keys in the first encrypted form; and transmit a preview rights key across the network for decrypting the one or more content keys in the second encrypted form.

[0010] The present invention also provides for terminal devices. One such terminal device includes means for receiving an electronic services guide (ESG), the ESG having information regarding one or more portions of a content item that are designated for previewing; means for receiving the one or more designated portions of the content item in a plaintext form; and means for receiving the remaining portions of the content item in an encrypted form.

[0011] A further terminal device includes means for receiving an electronic services guide (ESG), the ESG having information regarding one or more portions of a content item that are designated for previewing; means for receiving the content item in an encrypted form; and means for receiving one or more content keys in plaintext form, wherein the one or more keys correspond to the one or more designated portions of the content item.

[0012] Still a further terminal device includes means for receiving a content item in an encrypted form; means for receiving a plurality of content keys in an encrypted form, each of the plurality of keys for decrypting a corresponding portion of the content item; and means for receiving a preview rights key across the network for decrypting the one or more content keys in the second encrypted form.

[0013] The present invention also provides systems having multiple servers. In one such system including two servers, a first server provides an electronic services guide (ESG) having information regarding one or more portions of a content item that are designated for previewing. A second server provides the one or more designated portions of the content item in a plaintext form and the remaining portions of the content item in an encrypted form.

[0014] Another system includes three servers. In this system, a first server provides an electronic services guide (ESG) having information regarding one or more portions of a content item that are designated for previewing. A second server provides the content item in an encrypted form. A third server provides one or more content keys in plaintext form and one or more keys in encrypted form. The one or more content keys in plaintext form are for decrypting the one or more designated portions of the content item, and the one or more content keys in encrypted form are for the remaining portions of the content item.

[0015] The present invention advantageously provides for the delivery of content previews without in a manner that efficiently utilizes communications resources and bandwidth. Further features and advantages of the present invention will become apparent from the following description and accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In the drawings, like reference numbers generally indicate identical, functionally similar, and/or structurally similar elements. The drawing in which an element first appears is indicated by the leftmost digit(s) in the reference number. The present invention will be described with reference to the accompanying drawings, wherein:

[0017] FIG. 1 is a diagram of an exemplary operational environment;

[0018] FIG. 2 is a diagram of a timeslicing technique;

[0019] FIG. 3 is a diagram showing an example of plaintext and encrypted streaming content;

[0020] FIG. 4 is a flowchart of an operation, according to aspects of the present invention;

[0021] FIG. 5 is a diagram showing an example of plaintext and encrypted content keys broadcast in parallel;

[0022] FIG. 6 is a flowchart of an operation, according to aspects of the present invention; [0023] FIG. 7 A and 7B are diagrams of transmission using preview rules in rights objects;

[0024] FIG. 8 is a flowchart of an operation, according to aspects of the present invention;

[0025] FIG. 9, 1OA, and 1OB are diagrams of exemplary transmission schemes according to aspects of the present invention;

[0026] FIG. 11 is a diagram of an exemplary terminal device architecture;

[0027] FIG. 12 is a diagram of an exemplary terminal device implementation; and

[0028] FIG. 13 is a diagram of an exemplary computer system.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

I. Operational Environment

[0029] FIG. 1 is a diagram of a broadcast environment in which the present invention may be employed. This environment involves multiple packet-based networks 102 and a broadcast network 104.

[0030] Packet-based networks 102 perform communications through the exchange of packets, such as Internet Protocol (IP) packets, through various protocols. Accordingly, networks 102 may be of various types. For instance, the environment shown in FIG. 1 includes a packet-based network 102a that is the Internet, and a packet- based network 102b that is a local area network (such as an Ethernet).

[0031] Broadcast network 104 provides point-to-multipoint type communications over a broadcast transmission medium. Each broadcast network may employ various wired or wireless technologies. For instance, FIG. 1 shows a broadcast network 104 as a DVB-H network. However, broadcast network 104 may be a DVB-T network, a cable network such as a Data Over Cable Service Interface Specification (DOCSIS) network, or the like.

[0032] The environment of FIG. 1 includes a plurality of multimedia streaming servers (M-SRVs) 106 that are coupled to one or more of packet-based networks 102. Servers 106 produce multimedia streams containing content such as audio, video, and/or text. For example, a particular server 106 may provide multiple audio streams via multiple audio channels. In addition, this server may provide video streams and/or text streams that are synchronized with corresponding audio streams.

[0033] In addition, the environment of FIG. 1 includes an electronic service guide (ESG) server (ESG-SRV) 108 that provides ESG information to terminals in network 104. An ESG is a set of metadata that is used to describe "programs", sessions, services and other information that a broadcast service provides. An ESG provides device users with information regarding, for example, programs, services, costs, and the like. An ESG also provides a device with information so that the device may receive the services.

[0034] FIG. 1 also includes a rights obj ect server (RO-SRV) 110 that provides rights objects to terminal devices. These rights objects contain information, such as keys (referred to herein as rights keys), that allow for the decryption of content keys. This decryption of content keys provides for the consumption of content items, such as multimedia content streams from sources, such as M-SRVs 106. hi addition to rights keys, rights objects may contain rules which specify the manner in which rights keys may be used. As described herein, different types of rights objects (e.g., preview ROs or subscriber ROs) may be delivered to terminal devices.

[0035] Each of servers 106 may distribute their streams to one or more destinations across packet-based networks 102. Such distribution may involve IP multicasting protocols. The combined bit rate of all streams produced by a particular server typically varies over time. In embodiments, these variations are around a stable average.

[0036] FIG. 1 shows multiple IP encapsulators (IPEs) 110 that are each coupled to one or more of packet-based networks 102. IPEs 110 receive packet streams produced by servers and operate as gateways between packet-based networks 102 and broadcast network 104. In particular, IPEs 110 convert received packet streams into broadcast network transport streams (e.g., DVB-H transport streams).

[0037] For broadcast network 104, FIG. 1 shows a multiplexer (MUX) 112, a modulator (MOD) 114, and a transmitter (TX) 116. MUX 112 is coupled to each IPE 110, while MOD 114 is coupled between MUX 112 and TX 116. [0038] MUX 112 combines transport streams from one or more different sources (such as different IPEs 110) into a single transmission stream. This single stream is sent to MOD 114, which converts the transmission stream from a digital representation into a radio frequency (RF) signal. TX 116 amplifies the RF signal and transmits it (or broadcasts) the signal to the devices in broadcast network 104 via an antenna 117.

[0039] FIG. 1 shows that broadcast network 104 includes one or more receivers (RXs) 120, which are also referred to herein as terminal devices. These devices receive and process RF signals transmitted by TXs 116. This allows the devices to present the services (e.g., streams) conveyed by the RF signals to its end-users. Devices 120 may include portable handheld devices (such as wireless telephones and PDAs), as well as televisions, set-top boxes, and personal computers.

[0040] In addition, FIG. 1 shows a wireless network 122. This network maybe, for example, a cellular communications network or a short-range wireless communications network. Examples of short-range communications networks include Bluetooth, wireless local area networks (WLANs), and radio frequency identification (RFID) networks. As shown in FIG. 1, various servers may deliver information to terminal devices across network 122. Examples of such information include rights objects and/or rights keys from RO-SRV 110, and ESGs from ESG-SRV 108.

[0041] The present invention may be employed in a IP datacast (IPDC) system over DVB-H (i.e., digital video broadcast to handheld devices). However, the scope of the present invention covers other systems as well.

[0042] FIG. 2 is a diagram showing a timesslicing technique, that may be employed in broadcast systems, such as DVB-H networks.. As shown in FIG. 2, a plurality of time slots 202 exist in succession. A service, such as a streaming video program (e.g., an ice hockey game) is transmitted during these time slots. In particular, FIG. 2 shows the service starting stream at a time slot 202i and ending at a time slot 2029.

[0043] The service stream is transmitted according to a time-slicing technique. That is, the service stream is fragmented into burst transmissions (or packets) 204, which occur in particular portions of time slots 202. These particular portions are referred to as time slices. In particular, FIG. 2 shows bursts 204i - 204g occurring within particular time slices of slots 202 i -2028, respectively. [0044] In embodiments, each burst 204 has a fixed duration. Also, consecutive bursts 204 are separated in time by a fixed interval. However, in further embodiments, the duration of a burst and/or the intervals between bursts may vary. Information regarding such variations may be signaled within these bursts so that the bursts can be received by the terminal devices.

[0045] As described above, bursts 204 are received by one or more terminal devices. Upon receipt, each device buffers and processes (e.g., decodes, error corrects, etc.) these bursts. As a result, content such as video and/or audio is rendered for consumption by device users.

[0046] Addresses may be assigned to timeslices. For instance, an individual timeslice may be assigned one or more Internet Protocol (IP) addresses.

II. Distribution Conventions and Notation

[0047] As described above, aspects of the present invention involve the transmission of content streams. A content program may include more than one stream. For instance, a television program may include separate audio and video streams. A description of such exemplary streams is now provided.

[0048] Let S denote a stream of IP packets. This stream is transmitted (e.g., broadcasted) in portions. These portions are also referred to herein as batches. Each batch is encrypted with a corresponding key from a series of content keys. An index, i, is used herein to denote these individual content keys. Thus, the content keys used to encrypt these batches are referred to herein as CKi (e.g., CKl, CK2, etc.).

[0049] The encrypted content stream batches are denoted herein as CKi(S) (e.g., CKl(S), CK2(S), etc.). Therefore, the content key for a particular stream typically changes throughout the duration of the corresponding program.

[0050] To decrypt stream S and present its corresponding content to a user, the terminal must obtain the content keys. These content keys may be sent to the terminal in an encrypted format. For instance, the content keys may be encrypted by a rights key, RK, and transmitted (e.g., broadcasted) to the terminal. [0051] The rights key changes (if at all) on a less frequent basis than the content keys. In fact, the rights key may be common to multiple programs and channels. Thus, for a content stream, S, a terminal receives a stream of encrypted content and a stream of encrypted content keys. For a range of index values, i, the stream of encrypted content is denoted herein by CKi(S) and the stream of encrypted content keys is denoted herein by RK(CKi).

[0052] Therefore, according to this scheme, the terminal needs to obtain the rights key, RK, to decrypt the content keys CKi, and to then decrypt the content stream, S.

III. Plaintext and Encrypted Streaming Content Coordinated by ESG

[0053] As described above, the present invention provides various approaches for delivering program previews, without simultaneously transmitting content in both plaintext and normal encrypted form. One of these approaches involves switching between plaintext and encrypted broadcasting during a single program (or streaming content channel in general).

[0054] For instance, one or more predetermined time intervals (such as the first five minutes of each file or the first five minutes of each program) may be designated as preview periods.

[0055] Based on such designations, an ESG may be generated that automatically informs consumers (e.g., terminal users) of designated preview periods corresponding to particular content. Such ESGs may be directed to consumers that have not purchased the particular content. These consumers are referred to herein as previewers.

[0056] In contrast, consumers that have purchased the rights to view the content (referred to herein as subscribers) may consume (e.g., view) the content completely. Thus, based on this information in the ESG, a subscriber's terminal can seamlessly switch between decoding plaintext preview portions of the content and decoding the remaining encrypted portions.

[0057] According to an aspect of this approach, one or more preview channels may be provided. These channels combine preview periods of different channels into a continuous "channel hopping" preview program. This preview channel may be advertised in an ESG.

[0058] For example, assume a broadcaster supplies six payable channels to consumers. During each half an hour, each channel has a fixed preview period of 5 minutes, but at different times. ESG then describes a preview channel (in addition to the channels proper) combining the preview periods of different channels into a continuous programming, where the channel proper changes at 5 minute intervals.

[0059] FIG. 3 is a diagram illustrating an example of this approach. In particular, FIG. 3 shows transmissions across multiple channels along a time axis 300. These channels include a content channel 302, a rights key (RK) channel 304, and a ESG channel 306.

[0060] Content, such as a program or file, is transferred across content channel 302. Content keys encrypted with a rights key is transferred across content channel 304. ESG channel 306 convey guide information, such as designated preview periods and their corresponding channels.

[0061] Several time intervals 310 exist along time axis 300. Interval 310a is designated a preview interval. Accordingly, during this interval, content, S, is transmitted in plaintext form so that previewers may obtain the content. In addition, subscribers may obtain this content by foregoing decryption. However, FIG. 3 shows that content S is encrypted by content keys, CKi, during intervals 3 lOb-d. Therefore, only subscribers having these content keys may obtain the content during these intervals.

[0062] FIG. 4 is a flowchart showing an operation, according to an aspect of the present invention. This operation may be performed by one or more servers, such as a content server and an ESG server.

[0063] As shown in FIG. 4, the operation of FIG. 4 includes a step 402 in which one or more portions of a content item are designated for previewing. In a step 404, an ESG having information regarding the one or more designated portions is generated. This ESG may also include other information regarding the content item, such as descriptive text and channel information. In embodiments, this channel information may include network address and port information. [0064] In a step 406, the ESG is transmitted across one or more networks. With reference to FIG. 1, this network may be DVB-H network 104. FIG. 4 shows that in a step 408, the one or more designated portions are transmitted in a plaintext (i.e. unencrypted) form. However, in step 410, the remaining portions of the content item are transmited in an encrypted form. Thus, while previewers may consume the portions transmitted in plaintext form, only subscribers may consume the portions transmitted in encrypted form.

IV. Plaintext and Encrypted Content Keys Broadcast in Parallel

[0065] Another approach of the present invention involves transmitting plaintext content keys CKi in parallel with encrypted content keys RK(CKi). Thus, content S is always sent encrypted by content keys, CKi(S). However, for one or more predetermined previewing time intervals, the content keys are transmitted in two different forms: encrypted with a rights key (i.e., RK(CKi)) for subscribers; and in plaintext (i.e., CKi) for previewers. For times other than these predetermined interval(s), the plaintext content keys CKi are not transmitted. Therefore, at these times, only subscribers can continue obtain the content.

[0066] An example of a predetermined time interval includes ther beginning of content transmission, but up the content portion corresponding to a particular content key, CKi.

[0067] One or more preview channels may be provided, according to an aspect of this approach. These channels combine preview periods of different content channels into a continuous "channel hopping" preview program. This preview channel may be advertised in an ESG.

[0068] For example, assume a broadcaster supplies six payable channels to consumers. During each half an hour, each channel has a fixed preview period of 5 minutes, but at different times. ESG then describes a preview channel (in addition to the channels proper) combining the preview periods of different channels into a continuous programming, where the channel proper changes at 5 minute intervals. [0069] FIG. 5 is a diagram illustrating an example of this approach. In particular, FIG. 5 shows transmissions across multiple channels along a time axis 500. These channels include a content channel 502, content key (CK) channel 504, a rights key (RK) channel 506, and an ESG channel 508.

[0070] As shown in FIG. 5, several time intervals 510 exist along time axis 500. Of these, intervals 510a, 510b, and 510c are designated a preview intervals. However, interval 51Od (the remaining interval) is designated for subscribers only. Accordingly, during these designated preview intervals, content key channel 504 conveys corresponding content keys, CKi. However, during interval 510d, a content key is not transmitted across content key channel 504.

[0071] FIG. 5 also shows that, for all time intervals 510, content keys are transmitted in encrypted form (encrypted with a rights key, RK) across rights key channel 506. Subscribers, will be able to decrypt these keys, and consequently decrypt the content transmission across channel 502 for all time intervals.

[0072] FIG. 6 is a flowchart showing an operation, according to an aspect of the present invention. As in the operation of FIG. 4, the operation of FIG. 6 may be performed by one or more servers, such as a content server and/or an ESG server.

[0073] The operation of FIG. 6 includes a step 602 in which one or more portions of a content item are designated for previewing. In a step 604, an ESG having information regarding the one or more designated portions is generated. This ESG may also include other information regarding the content item, such as descriptive text and channel information, hi embodiments, this channel information may include network address and port information.

[0074] In a step 605, the ESG is transmitted across one or more form across one or more networks. These network(s) may include a broadcast network, such as DVB-H network 104 of FIG. 1. Also, in a step 606, the content item is transmitted across these network(s) in an encrypted form.

[0075] FIG. 6 shows that in a step 608, a plurality of content keys are transmitted in an encrypted form. Each of these content keys is for decrypting a corresponding portion of the content item. Also, in a step 610, one or more of these content keys (which in step 608 were transmitted in encrypted form) are transmitted in plaintext form. These one or more content keys in plaintext form correspond to the one or more portions of the content item designated for previewing. Accordingly, with these plaintext keys, a previewer can decrypt the portions of the content item that were designated for previewing.

V. Preview Rules in Rights Object

[0076] Rights objects (such as OMA DRM ROs) can contain various rules. For example, these rules may specify how many times the corresponding rights key can be used, and for which duration. Thus, in approaches of the present invention, previewers may be supplied with preview ROs having preview rules. These preview rules may state, for instance, that the rights keys conveyed with these ROs may be used for consuming (e.g., viewing) content for a maximum number of times, where each time has a maximum duration. An example of such rules is 10 times for 5 minutes at a time. Thus, this rules based approach offers freely selectable preview periods.

[0077] An exemplary technique for implementing this approach involves transmitting two encrypted sequences of content keys. A first of these content key sequences is encrypted by a preview rights key RKp and denoted by RKp(CKi). RKp may have been delivered to previewers in a corresponding preview RO. A second of these content key sequences is encrypted by the "normal" rights key RKs that is provided to subscribers. This encrypted sequence of content keys is denoted herein by RKs(CKi). Thus, the overall broadcast (for one television channel) is the following:

[0078] FIG. 7A is a diagram illustrating an example of this approach. In particular, FIG. 7A shows transmissions across multiple channels along a time axis 700. These channels include a content channel 702, preview rights key channel 704, a subscriber rights key channel 706, and an ESG channel 708.

[0079] Content, such as a program or file, is transferred across content channel 702 in an encrypted form. As shown in FIG. 7 A, a plurality of time intervals 710 exist. During each of these time intervals, the transmitted content is encrypted with a corresponding content key CKi. These content keys are transmitted across channels 704 and 706 in encrypted form. For instance, the content keys transmitted across channel 704 are encrypted with a preview rights key (RKp) and the content keys transmitted across channel 706 are encrypted with a subscriber rights key (RKs). As described above, the preview rights key is delivered to terminal devices in an RO having one or more usage rules that govern the manner in which previewers may preview the content.

[0080] Alternatively, ordinary generic rights key that are given to subscribers can be limited in such a way that they become preview keys. This means that the content packages need to be encrypted only once, for the encryption number (contained in the RO) is the same both to RKs and RKp, whereas the "usage rights" are different for RKs and RKp. Moreover, in this approach, the preview key RKp is specific to a channel, and not applicable across multiple channels in a sliding time window.

[0081] However, in embodiments, the preview rights key RKp may be common to multiple channels (e.g., multiple television channels), while subscribers' rights keys RKs are channel specific. Thus, a benefit to this approach is that preview rights keys RKp may be common to multiple channels. In further embodiments, each RO may contain multiple preview rights keys (RKpI, RKp2, ..., RKpn). This allows for different preview rights keys to be governed by the same rules.

[0082] This approach provides for limited previewing as long as terminals obey the preview rules. In the context of OMA DRM, it is assumed that terminals are reliable in this sense. However, to increase the security of this approach, preview rights keys may be transmitted only during predetermined time intervals, such as the first half of each program. An example of this feature is shown in FIG. 7B.

[0083] FIG. 7B is a diagram showing transmissions across channels 702-708. These transmission are similar to the ones in FIG. 7A. However, in FIG. 7B, transmissions across preview rights key channel 704 only occur for a preview period that includes time intervals 710a, 710b, and 710c.

[0084] Thus, this approach flexibly provides for tradeoffs between key safeness and free selectability of the preview periods. In further embodiments, preview ROs can also be "revoked" (i.e., made useless) and/or replaced by new ones. Thus, old preview rights key can be simply discontinued, allowing new ones to take effect. Such changes do not affect the subscribers, since they have subscribers rights keys. [0085] FIG. 8 is a flowchart showing an operation according to an aspect of the present invention. As in the operations of FIGs. 4 and 6, this operation may be performed, for example, by content and ESG servers.

[0086] The operation of FIG. 8 includes a step 802, in which a content item is transmitted in encrypted form across one or more networks. These one or more networks may include a broadcast network, such as DVB-H network 104.

[0087] In a step 804, a plurality of content keys are transmitted in an first encrypted form. Each of these keys is for decrypting a corresponding portion of the content item transmitted in step 802. hi a step 806, one or more of these content keys is transmitted in a second encrypted form.

[0088] The operation of FIG. 8 includes a step 808 in which a subscriber rights key is transmitted. This key is for decrypting the plurality of content keys in the first encrypted form. Also, in a step 810, a preview rights key for decrypting the one or more content keys in the second encrypted form is transmitted. Thus, by making the preview rights key available to previewers, flexibility is provided in the selection of preview times.

VI. Secure Transmission

[0089] The approaches described above for providing previews involve the transmission of encrypted information, such as content and various keys. Exemplary implementations for the transmission of such information are now described.

[0090] The above approaches may employ a content encryption protocol, such as IPsec ESP. hi this protocol, each packet of a content stream (S) that is encrypted with a content key (CK) can be abstracted as [said, CKsaid(S)], where said denotes a security association (SA) identifier and CKsaid(S) denotes content S encrypted with content key CKsaid.

[0091] hi embodiments, CKsaid is given to an IPsec stack within the terminal in a security association (SA) having information that can abstracted as [said, CKsaid]. Therefore, the IPsec stack of the terminal automatically uses the said to decrypt content S with the appropriate content key as the content stream's packets are received.

[0092] Content items may include multiple streams. For instance, a television program may include separate audio and video streams. An exemplary television program is denoted herein as [S5S] = [audio, video] = [A, V]. hi embodiments, such audio and video streams may be transmitted to the same IP address, but to different ports. Moreover, a different destination IP address is used to transmit security associations (SAs) as packets encrypted above the IPsec stack layer. In IPDC implementations, a next higher IP address may be used so that the SAs are broadcast in the same IPDC burst as the content.

[0093] Such SAs contain information, which may be abstracted as [said, rkid, RKrkid(CKsaid)]. hi this abstraction, rkid is an identifier of a rights key (RKrkid) in plaintext. RKrkid(CKsaid) is the content key, CKsaid, encrypted by RKrkid. hi approaches where content keys are transmitted in plaintext, corresponding SAs are transmitted as [said, "none", CKsaid]. With reference to the examples described herein, CKsaid is an instantiation of CKi. hi approaches that employ encrypted content keys, terminals may decrypt CKsaid with RK and then compute the SA.

[0094] Terminal devices may provide SAs to their IPsec stack for decrypting content streams, such as audio stream A and video stream V. In embodiments, SA packets may be encrypted above the IPsec. This means that they are plaintext from the IPsec stack perspective, and then decrypted by a DRM mechanism.

[0095] When a terminal "knows" a rights key RK, it is able to compute content key CKi from encrypted content key RK(CKi). Terminals may obtain rights keys (RKs) in various ways. As described above, rights keys may be obtained in rights objects (ROs) along with various rules.

[0096] Digital rights management (DRM) systems, such as OMA DRM 2.0, may be used for the distribution of such ROs. Such systems may involve RO purchase channels, allowing ROs to be obtained through e-commerce transactions. Terminals may include a DRM client. Within this client (and nowhere else) the terminals receive ROs. The ROs may include information, such as a rights key identifier and its corresponding rights key (denoted as [rkid, RKrkid]). [0097] The DRM client never reveals RKrkid. However, when presented with the encrypted data for an SA (i.e., [ ..., rkid, RKrkid(CKsaid)]), the DRM client internally matches rkid and uses RKrkid to decrypt CKsaid. The DRM client then makes CKsaid available to the rest of the terminal (e.g., the terminal's software).

VII. Transmission Examples

[0098] FIGs. 9-11 illustrate further examples of transmissions involving previews according to aspects of the present invention. In these examples, content key simultaneously change at 15 minute intervals. For instance, FIG. 9 shows such time intervals 910 placed along a time axis 900. FIG. 9 further shows transmissions associated with a channel chl in subchannels 901, 902, and 903. These subchannels are each designated by IP address and port. However, other designation techniques may be employed.

[0099] For one hour of channel chl (shown in FIG. 9 as being between 12:00 to 13:00) , we have the following broadcast to IP addresses (say 1 and 2) and ports (say 1 for audio, 2 for video, and 3 for content keys):

[00100] Thus channel chl sends its audio stream Achl and its video stream Vchl in plaintext for the first 15 minutes. However, subsequent audio and video transmissions are encrypted with content keys. Three such content keys are shown in FIG. 9: CK2chl, CK3chl, and CK4chl.

[0100] Consumers are informed that the first 15 minutes constitute a fixed preview period. This may be done through an ESG. An example of such an ESG, which describes channel chl (or the current program on it) between 12:00 and 13:00 is provided below in Table 1. Table 1

[0101] A subscriber that has the RO containing RKchl s, may select chl (or a program on it) from the ESG. This selection instructs the terminal to receive audio and video from the given IP address and ports. From 12:00 to 12:15, the terminal does not apply content keys to receive the chl transmissions. However at 12:15, the terminal automatically switches to also receiving the content keys from subchannel 903. This automatic switching is based on information received in the ESG.

[0102] The received content keys are decrypted by the DRM client within the terminal and handed to the terminal's IPsec stack. The IPsec stack decrypts the audio and video streams of subchannels 901 and 902.

[0103] Meanwhile, a previewer can preview channel chl from 12:00 until 12:15. At that time the previewer's terminal observes that it does not have RKchl s required for decrypting RKchl s(CK2chl). When this occurs, the terminal may suggest that the previewer subscribe to the channel to continue viewing.

[0104] Hence, to summarize, FIG. 9 provides an example of a server-end defining content protection in such a way that a free preview window exists in the content stream. During this preview window, both subscribers and previewers receive content at their terminals in plain unencrypted form.

[0105] After this preview window is over, previewers can no longer consume any content. However, subscriber terminals (based on information from an ESG) start receiving the encrypted portion of the content and decrypting it with a rights key that is available in the terminal. [0106] FIG. 10 provides an example in which multiple channels can be previewed in such a way that each individual channel can be watched for 15 minutes of each hour, at different times. Thus these channels together constitute a preview channel where the channel proper changes at 15 minute intervals. FIG. 10 shows 15 minute time intervals 1020 placed along a time axis 1000. These intervals occur between the hours of 12:00 and 13:00.

[0107] As shown in FIG. 10, channels ch2 through ch5 each include 3 subchannels, as follows: channel ch2 includes subchannels 1001, 1002, and 1003; channel ch3 includes subchannels 1004, 1005, and 1006; channel ch4 includes subchannels 1007, 1008, and 1009; and channel ch5 includes subchannels 1010, 1011, and 1012. These subchannels are each designated by IP address and port. However, other designation techniques may be employed.

[0108] For each channel shown in FIG. 10, the content keys are broadcast in plaintext for 15 minutes preview periods. These preview periods are from 12:00 to 12:15 for channel ch2, from 12:15 to 12:30 for channel ch3, from 12:30 to 12:45 for channel ch4, and from 12:45 to 13:00 for channel ch5. Previewers cannot preview a particular channel outside of its preview period. However, subscribers holding the rights keys can.

[0109] An ESG that describes the preview features of FIG. 10 may contain the information provided below in Table 2.

Table 2

[0110] FIG. 10 and Table 2 show that channels ch2 through ch5 need no reception changes during the hour for subscribers. In addition to the 15 minutes per channel preview periods shown in FIG. 10, Table 2 describes a continuous preview channel for previewers. This preview channel is received by hopping from the IP addresses of one channel to the IP addresses of another, at the times when the unencrypted content key of one channel expires and the unencrypted content key of the other channel becomes available.

[0111] Thus, the ESG outlined in Table 2, which is broadcast to terminals, describes five TV services that are each broadcast over a separate channels. In DVB-H networks, these separate channels maybe transmitted at different timeslices. hi addition, the ESG describes a "preview TV " service, which is a logical entity rather than a physical entity. This is because this service does not have its own dedicated channel (e.g., a dedicated DVB-H timeslice). Instead, this service provides extracts from each of the five existing channels.

[0112] FIG. 1 OB shows an exemplary transmission scheme in which DRM clients of previewer terminals receive ROs having rules associated with preview rights keys. As described above, DRM clients may receive an SA including a rights key identifier and a corresponding rights key. Alternatively, previewer terminals may receive ROs including information denoted as [p, RKp, "10 times for 5 minutes"]. In this notation, p is a preview rights identifier, RKp is a corresponding preview rights key, and "10 times for 5 minutes" is a usage rule for the preview rights key. Thus the preview rights key RKp may be used no more than 10 times, and not exceeding 5 minutes at a time.

[0113] Previewers are granted new preview ROs according to a policy, such as upon request. However, granting limits may be imposed, such no more than once per week. Such policies can be enforced by further information in each preview RO.

[0114] The transmission scheme shown in FIG. 1 OB is similar to the scheme of FIG. 1OA. However, in FIG. 1OB, the fixed preview periods described above are complemented with freely selectable preview periods option through broadcast upgrades to channels ch2,...,ch5. In particular, encrypted content keys that can be decrypted with preview rights keys are transmitted. These encrypted content keys are shown in FIG. 1OB as RKρ(CKichn) (e.g., RKp(CK4ch5)). Thus holders of the preview RO, whose terminals can make use of rights key RKp as constrained by the preview rule, can take freely selectable preview periods on channels ch2 and ch3 at any time, but at channels ch4 and ch5 during the first half an hour only.

VIII. Terminal Device

[0115] FIG. 11 is a block diagram showing a wireless communications device architecture, which may be used for terminals, such as terminal devices 120. This architecture includes a host 1102, a control interface 1104, a controller 1106, a security module 1107, a DVB-H radio 1108, a cellular radio 1110, and a short-range wireless radio 1124.

[0116] Host 1102 is responsible for functions involving user applications and higher protocol layers. Such applications and protocol layers may involve, for example, the rendering of multimedia content (such as television broadcasts) to users. Host 1102 exchanges information with controller 1106 across control interface 1104. This information may include commands received from host 1102, and information transmitted to host 1102. control interface 1104 defines a set of messages, which provide for this exchange of information.

[0117] Controller 1106 performs functions related to link set-up, security and control. These functions may involve communicating with remote devices according to one or more protocols (such as the Bluetooth link manager protocol). To perform these functions, such protocols provide messages, which are also referred to as protocol data units (PDUs). Controller 1106 exchanges these PDUs with corresponding controllers at remote devices. In addition, controller 1106 buffers and schedules data for transmission to other mesh network nodes.

[0118] FIG. 11 shows that controller 1106 is coupled to both DVB-H radio 1108, cellular radio 1110, and short-range wireless radio 1124. These radios are responsible for lower layer communications protocols, hi particular, DVB-H radio 1108 is responsible for the reception of information broadcast across DVB-H networks, and cellular radio 1110 is responsible for the exchange of information (e.g., telephony, messaging, and data traffic) with remote devices across cellular networks. Short-range wireless radio 1124 is responsible for the exchange of information with remote devices across short-range networks.

[0119] FIG. 11 shows that DVB-H radio 1108 includes a link controller 1112, a DVB-H receiver 1114, and an antenna 1116. Link controller 1112 operates as an intermediary between controller 1106 and transceiver 1114. Link controller 1112 also performs baseband processing for received DVB-H transmissions, such as error correction decoding.

[0120] DVB-H receiver 1114 is coupled to an antenna 1116. Receiver 1114 includes electronics that allow the device architecture of FIG. 11 (in conjunction with antenna 1116) to receive wireless broadband DVB-H signals transmitted by remote devices. Such electronics include modulators, demodulators, amplifiers, and filters.

[0121] FIG. 11 shows that cellular radio 1110 includes a link controller 1118, a cellular transceiver 1120, and an antenna 1122. Link controller 1118 operates as an intermediary between controller 1106 and cellular transceiver 1120. Link controller 1118 also performs baseband processing for cellular transmissions. Such processing may include such as error correction encoding and decoding, synchronization with GSM time division multiple access frames, and the formation of packets.

[0122] Cellular transceiver 1120 is coupled to antenna 1122. Cellular transceiver 1120 includes electronics, such as modulators, demodulators, amplifiers, and filters. Such electronics allow the device of FIG. 11, in conjunction with antenna 1122, to exchange (i.e., transmit and receive) wireless cellular signals with remote devices. Such signals may be in accordance with various cellular standards, such as GSM.

[0123] Short-range wireless radio 1124 provides for communications across one or more types of short-range networks, such as IEEE 802.11 wireless local area networks (WLANs) and/or Bluetooth networks. In addition, short-range wireless radio 1124 may provide for communications with radio frequency identification (RFID) tags. As shown in FIG. 11, short-range wireless radio 1124 includes a link controller 1126, a short-range transceiver 1128, and an antenna 1130. Link controller 1126 operates as an intermediary between controller 1106 and transceiver 1114. Link controller 1112 also performs baseband processing for short-range communications, such as error correction encoding and decoding.

[0124] Short-range transceiver 1128 is coupled to antenna 1130. Transceiver 1114 includes electronics that allow the device architecture of FIG. 11 (in conjunction with antenna 1116) to exchange wireless signals transmitted by remote devices. Such electronics include modulators, demodulators, amplifiers, and filters.

[0125] As shown in FIG. 11 , security module 1107 is coupled to controller 1106. Security module 1107 may store material (i.e., information) related to encryption, such as keys, rights objects, and/or usage rules. In embodiments, such information is not accessible to other portions of the terminal device. Accordingly, security module 1107 may be a secure module, such as a DRM (e.g., an OMA DRM) client. Information contained in security module 1107 (such as OMA DRM ROs) may be obtained in various ways. For example, the information may be delivered via a cellular or mobile phone network through radio 1120 and controller 1106. Alternatively, this information may be downloaded from short-range encounters with remote devices (such as kiosks and/or access points) using short-range communications technologies, such as WLAN and Bluetooth.

[0126] Device architectures, such as the architecture of FIG. 11 , may be implemented in hardware, software, firmware, or any combination thereof. One such implementation is shown in FIG. 12. This implementation includes a processor 1210, a memory 1212, and a user interface 1214. In addition, the implementation of FIG. 12 includes Bluetooth transceiver 1114, antenna 1116, UWB transceiver 1120, antenna 1122, short-range transceiver 1128, and antenna 1130. These components may be implemented as described above with reference to FIG. 11. However, as described above, the implementation of FIG. 12 maybe modified to include different transceivers that support other wireless technologies.

[0127] Processor 1210 controls device operation. As shown in FIG. 12, processor 1210 is coupled to receiver 1114, and transceivers 1120 and 1128. Processor 1210 may be implemented with one or more microprocessors that are each capable of executing software instructions stored in memory 1212.

[0128] Memory 1212 includes random access memory (RAM), read only memory (ROM), and/or flash memory, and stores information in the form of data and software components (also referred to herein as modules). These software components include instructions that can be executed by processor 1210. Various types of software components may be stored in memory 1212. For instance, memory 1212 may store software components that control the operation of receiver 1114, transceiver 1120, and transceiver 1128. Also, memory 1212 may store software components that provide for the functionality of host 1102, control interface 1104, controller 1106, security module 1107, as well as link controllers 1112, 1118, and 1126.

[0129] In addition, memory 1212 may store software components that control the exchange of information through user interface 1214. As shown in FIG. 12, user interface 1214 is also coupled to processor 1210. User interface 1214 facilitates the exchange of information with a user. FIG. 12 shows that user interface 1214 includes a user input portion 1216 and a user output portion 1218.

[0130] User input portion 1216 may include one or more devices that allow a user to input information. Examples of such devices include keypads, touch screens, and microphones. User output portion 1218 allows a user to receive information from the device. Thus, user output portion 1218 may include various devices, such as a display, and one or more audio speakers (e.g., stereo speakers) and a audio processor and/or amplifier to drive the speakers. Exemplary displays include color liquid crystal displays (LCDs), and color video displays.

[0131] The elements shown in FIG. 12 may be coupled according to various techniques. One such technique involves coupling receiver 1114, transceivers 1120 and 1128, processor 1210, memory 1212, and user interface 1214 through one or more bus interfaces. In addition, each of these components is coupled to a power source, such as a removable and/or rechargeable battery pack (not shown).

[0132] Terminal devices, such as the devices described above with reference to FIGs. 11 and 12, may receive information transmitted according to the techniques described herein. For instance, terminal devices implemented according to the architecture of FIG. 11 may receive content items through DVB-H radio 1108. ESGs, rights keys, and ROs may be received through any one of radios 1108, 1110, or 1124.

[0133] For instance, embodiments, rights keys and ROs are transmitted (e.g., from a RO server) to terminal device(s) across cellular networks. Accordingly, such transmissions are received through cellular radio 1110. Moreover, obtaining such information (i.e., ROs and/or rights keys) may be arranged through communications involving cellular radio 1110, such as e-commerce transactions, across a cellular network. Similar communications may be performed across short-range network, thus involving short-range wireless radio 1124.

IX. Computer System

[0134] The features of the present invention may be implemented with one or more computer systems. For example, computer systems may be used to implement techniques employed by content and ESG servers. An example of a computer system 1301 is shown in FIG. 13. Computer system 1301 represents any single or multi¬ processor computer. Single-threaded and multi-threaded computers can be used. Unified or distributed memory systems can be used.

[0135] Computer system 1301 includes one or more processors, such as processor 1304. One or more processors 1304 can execute software implementing the process described above ith reference to FIG. 4. Each processor 1304 is connected to a communication infrastructure 1302 (for example, a communications bus, cross-bar, or network). Various software embodiments are described in terms of this exemplary computer system. After reading this description, it will become apparent to a person skilled in the relevant art how to implement the invention using other computer systems and/or computer architectures.

[0136] Computer system 1301 also includes a main memory 1307 which is preferably random access memory (RAM). Computer system 1301 may also include a secondary memory 1308. Secondary memory 1308 may include, for example, a hard disk drive 1310 and/or a removable storage drive 1312, representing a floppy disk drive, a magnetic tape drive, an optical disk drive, etc. Removable storage drive 1312 reads from and/or writes to a removable storage unit 1314 in a well known manner. Removable storage unit 1314 represents a floppy disk, magnetic tape, optical disk, etc., which is read by and written to by removable storage drive 1312. As will be appreciated, the removable storage unit 1314 includes a computer usable storage medium having stored therein computer software and/or data.

[0137] In alternative embodiments, secondary memory 1308 may include other similar means for allowing computer programs or other instructions to be loaded into computer system 1301. Such means can include, for example, a removable storage unit 1322 and an interface 1320. Examples can include a program cartridge and cartridge interface (such as that found in video game devices), a removable memory chip (such as an EPROM, or PROM) and associated socket, and other removable storage units 1322 and interfaces 1320 which allow software and data to be transferred from the removable storage unit 1322 to computer system 1301.

[0138] Computer system 1301 may also include a communications interface 1324. Communications interface 1324 allows software and data to be transferred between computer system 1301 and external devices via communications path 1327. Examples of communications interface 1327 include a modem, a network interface (such as an Ethernet card), a communications port, etc. Software and data transferred via communications interface 1327 are in the form of signals 1328 which can be electronic, electromagnetic, optical or other signals capable of being received by communications interface 1324, via communications path 1327. Note that communications interface 1324 provides a means by which computer system 1301 can interface to a network such as the Internet. [0139] The present invention can be implemented using software running (that is, executing) in an environment similar to that described above with respect to FIG. 13. In this document, the term "computer program product" is used to generally refer to removable storage units 1314 and 1322, a hard disk installed in hard disk drive 1310, or a signal carrying software over a communication path 1327 (wireless link or cable) to communication interface 1324. A computer useable medium can include magnetic media, optical media, or other recordable media, or media that transmits a carrier wave or other signal. These computer program products are means for providing software to computer system 1301.

[0140] Computer programs (also called computer control logic) are stored in main memory 1307 and/or secondary memory 1308. Computer programs can also be received via communications interface 1324. Such computer programs, when executed, enable the computer system 1301 to perform the features of the present invention as discussed herein. In particular, the computer programs, when executed, enable the processor 1304 to perform the features of the present invention. Accordingly, such computer programs represent controllers of the computer system 1301.

[0141] The present invention can be implemented as control logic in software, firmware, hardware or any combination thereof. In an embodiment where the invention is implemented using software, the software may be stored in a computer program product and loaded into computer system 1301 using removable storage drive 1312, hard drive 1310, or interface 1320. Alternatively, the computer program product may be downloaded to computer system 1301 over communications path 1327. The control logic (software), when executed by the one or more processors 1304, causes the processor(s) 1304 to perform the functions of the invention as described herein.

[0142] In another embodiment, the invention is implemented primarily in firmware and/or hardware using, for example, hardware components such as application specific integrated circuits (ASICs). Implementation of a hardware state machine so as to perform the functions described herein will be apparent to persons skilled in the relevant art(s). X. Conclusion

[0143] While various embodiments of the present invention have been described above, it should be understood that they have been presented by way of example only, and not in limitation. For instance, although examples have been described involving DVB-H technologies, other communications technologies are within the scope of the present invention.

[0144] Accordingly, it will be apparent to persons skilled in the relevant art that various changes in form and detail can be made therein without departing from the spirit and scope of the invention. Thus, the breadth and scope of the present invention should not be limited by any of the above-described exemplary embodiments, but should be defined only in accordance with the following claims and their equivalents.