Abstract: Techniques for embedding secure feature selection at content delivery network (CDN) edge are described. In accordance with various embodiments, server(s) in a cloud receive from a client device a request for a media URL associated with a media asset. The server(s) identify feature state(s) associated with the client device and the media asset on a CDN edge node hosting the media asset. The server(s) then selectively generate a unique token or a common token specifying the feature state(s) before sending the media URL including the unique token or the common token to the client device. Upon receiving the media URL, the CDN edge node in an edge node with features deployed, determines whether the media URL causes a cache miss. Upon determining that the media URL causes the cache miss, the CDN edge node changes a feature state of a feature, applies the feature, and provides the media asset.

Abstract: Techniques for securing client watermarks are described herein. In accordance with various embodiments, a server receives a request from a client device for authorizing rendering a media content item at the client device. A validation engine on the server obtains at least a portion of an image representing a screen capture of rendering the media content item including a client watermark and/or metadata associated with the rendering. The validation engine then validates the watermark based at least in part on at least the portion of the image and/or the metadata. Having invalidated the client watermark, the server causes disruption of rendering the media content item at the client device. On the client side, a watermark engine captures the image of rendering the media content item including the client watermark and requests the server to validate the client watermark and renew the authorization based on the validation.

Abstract: Techniques for zero-trust cloud deployment are described herein. In accordance with various embodiments, a device including a processor and a non-transitory memory derives a key from deployment metadata of a virtual machine, where the deployment metadata change with each deployment of the virtual machine. The device then encrypts secrets using the key to bind the key to the virtual machine. The device further deploys the virtual machine in a cloud using the deployment metadata, including loading the encrypted secrets to the deployed virtual machine in the cloud.

Abstract: Various embodiments include facilitating video playback, based on an HTML iframe and a headless browser. To that end, in some embodiments, a method is performed at a first device, which may be referred to as a receiving device. The first device includes a processor, a non-transitory memory, and a communication interface. The communication interface enables commutation with a second device, which may be referred to as a sending device. The method includes receiving the HTML iframe from the second device. The HTML iframe may include a video tag, or the video tag may be nested in another HTML iframe. Moreover, the method includes playing a video stream that is identified by the video tag. Playing the video stream includes executing the HTML iframe via the headless browser to retrieve the video stream based on the video tag, and transmitting the video stream to a display device.

Abstract: Common timeline processing techniques for generating unique manifests are described herein. In accordance with various embodiments a method is performed at one or more servers that include one or more processors, one or more non-transitory memory, and one or more network interfaces. The method includes receiving a request from a client for a unique manifest, wherein the request indicates a recording timeline and includes a recording identifier (ID). The method further includes constructing the unique manifest in response to the request according to the recording timeline, including obtaining at least a portion of the unique manifest from a cache in accordance with determining a corresponding portion of the recording timeline exists in the cache. The method additionally includes appending the recording ID of the request to a URL prefix in the unique manifest. The method also includes sending the unique manifest to the client.

Abstract: Techniques for providing multimedia content in a virtual set top system are described. In some embodiments, a stream switchover method for UI rendering is performed at a device (e.g., a server) with one or more processors and a non-transitory memory. The server distributes a first stream that includes a plurality of frames. The server receives a request for a user interface (UI) from a client. In response to receiving the request, the server generates a second stream by locating an encoder to encode the plurality of frames into the second stream based on the first stream, instructing the encoder to accelerate encoding of the plurality of frames and facilitating blending of the UI into the second stream with the plurality of frames. The server then switches the client from the first stream to the second stream.

Abstract: Techniques for measuring cloud-based input latency are described herein. In accordance with various embodiments, a server including one or more processors and a non-transitory memory receives from a client an input event corresponding to a request for a TV user interface (UI). The server adds a tag to each of a set of screens corresponding to the TV UI and records event data corresponding to the input event prior to rendering the set of screens into a set of rendered frames. The server additionally decodes the tag in the set of rendered frames to generate metadata that associate the event data with the set of rendered frames prior to encoding the set of rendered frames into a set of encoded frames. The server also transmits to the client the set of encoded frames and the metadata.

Abstract: Techniques for switching a client device to play low latency content are described. In accordance with various embodiments, the client device switching method is performed at a device (e.g., a client device) with a processor and a non-transitory memory. The client device detects a request for a user interface (UI) while playing a media content item from a buffer and sends to a server the request and status of playing the media content item from the buffer. The client device then receives from the server a switch point determined by the server based at least in part on the status and the requested UI. The client device further determines whether the buffer has sufficient UI frames rendered by the server at the switch point. Upon determining that the buffer has sufficient UI frames, the client device switches to playing the UI frames from the buffer at the switch point.

Abstract: Techniques for enhancing security for thin client devices in hybrid edge cloud systems are described. In accordance with various embodiments, the hybrid system includes a cloud computing platform (e.g., the cloud) and an edge device (e.g., the edge). The cloud extracts key(s) for authentication and session establishment. The cloud also utilizes the key(s) to establish a session between the edge and a client device. The cloud additionally authorizes a content request from the client device for a media content item over the session and extracts a content key upon successful authorization. The edge caches the key(s), obtains the content key at the time of receiving the content request from the client device and transmits the content key and the key(s) with the media content item to the client device.

Abstract: Various implementations disclosed herein include devices, systems, and methods for reducing a decode delay at a client device. In some implementations, a device includes one or more processors and a non-transitory memory. In some implementations, a method includes determining that a client device is being switched from a real-time content presentation mode in which the client device presents real-time content to a buffered content presentation mode in which the client device presents buffered content. In some implementations, the method includes transmitting, to the client device, video frames corresponding to the buffered content at a first transmission rate. In some implementations, the method includes changing the first transmission rate to a second transmission rate based on an indication that a number of bits stored in a buffer of the client device satisfies a decode threshold.

Abstract: Techniques for embedding watermarks are described. In accordance with various embodiments, a server (e.g., a cloud in a core network) generates a profile for an encoded media content item and packages the profile as corresponding watermark metadata. The server then transmits the encoded media content item and the corresponding watermark metadata to at least one edge node in an edge cloud. A respective edge node in the edge cloud, upon receiving a request from a client device for the encoded media content item, where the request includes a client identifier associated with the client device, obtains a first portion of the encoded media content item and the corresponding watermark metadata. A watermark embedder of the edge node then embeds the client identifier in the embedded media content item according to the watermark metadata and transmits the watermark embedded media content item to the client device.

Abstract: Techniques for publishing key pictures at a server and using the key picture information for operations on a client device are described herein. In accordance with various embodiments, the server creates an intermediate unit including key picture(s) from media content. The server then generates map(s) specifying for each key picture, a type, properties, and an association to the intermediate unit. The server also packages the intermediate unit into key picture unit(s) according to the map(s). The client device obtains a manifest for the media content referencing the key picture(s) and the type of each key picture. Upon receiving a request to perform operation(s) on a respective key picture, the client device obtains a corresponding key picture unit and parses the manifest to determine a respective type. Based on the respective type matches a criterion, the client device performs the operation(s) on the key picture unit.

Abstract: In some implementations, a device includes one or more processors and a non-transitory memory. In some implementations, a method includes obtaining a request for a sequence of video frames that corresponds to a user interface operation being performed at a client device. In some implementations, the sequence of video frames is to be presented at the client device at a first frame rate. In some implementations, the method includes determining an availability of computing resources associated with providing the sequence of video frames to the client device. In some implementations, the method includes generating, based on the availability of computing resources, the sequence of video frames at a second frame rate that is greater than the first frame rate. In some implementations, the method includes triggering the client device to present the sequence of video frames at the first frame rate.

Abstract: Techniques for a trusted system for secure content distribution and trusted recording of content consumption are described. In some embodiments, the trusted system transcodes and transcrypts a media content item using a key obtained from a content provider and one or more keys based on an entitlement from a service provider to generate an encrypted media content item. The trusted system further receives a request to provide the media content item to a client device. The trusted system also obtains a signed audit token recording the request upon an authorization by the service provider based on the entitlement and a confirmation by the content provider, where the signed audit token is signed by the content provider and the service provider. The trusted system additionally provides the one or more keys for decrypting the encrypted media content item and reports the signed audit token.

Abstract: Techniques for broadcast in-home streaming are described. In some embodiments, the method is performed at a gateway device. The gateway device demultiplexes a broadcast stream to a plurality of streams, including a first stream and a second stream and anchors a first presentation time range of a first segment based on a random access point in the first stream and a first frame in the second stream. The gateway device also identifies one or more frames in the first stream based on presentation timestamps and decoding timestamps of a last frame in the first presentation time range and a first frame in a second presentation time range. The gateway device further captures frames from the second stream within the first presentation time range and generates the first segment having the first presentation time range, including the random access point, the one or more frames, the first frame, and the frames.

Abstract: Techniques for countering cheats in a multi-player gaming environment are described herein. In accordance with various embodiments, a server includes a cheating analyzer running on processor(s) and a non-transitory memory for storing cheat data and counter cheat data. The server identifies suspected cheating in a game and determines a probability of the suspected cheating based on the cheat data. The server also selects a counter cheat of the suspected cheating corresponding to the probability value based on the cheat data and the counter cheat data. The server then applies the counter cheat approximate the probability value in the game. In some embodiments, the server deploys local copies of the cheating analyzer to client devices, including sending at least a portion of the cheat data and/or counter cheat data. The local copies facilitate the cheat identification, the probability determination, the counter cheat selection, and/or the application of the counter cheat.

Abstract: Techniques for selecting TV user interface (UI) transition characteristics are described. In accordance with various embodiments, a transition characteristics selection method is performed at a device (e.g., a cloud UI engine on a server) with one or more processors and a non-transitory memory. The UI engine receives a request for transitioning from a first screen to a second screen on a client device while in a real-time content presentation mode. In response to receiving the request and while in the real-time content presentation mode, the UI engine obtains one or more presentation conditions of the client device and selects one or more transition characteristics for transitioning from the first screen to the second screen based on costs associated with the one or more transition characteristics and the one or more presentation conditions.

Abstract: Techniques for preventing rendering content from content delivery network (CDN) to unauthorized users are described herein. In accordance with various embodiments, a CDN includes one or more processors and a non-transitory memory. The CDN receives a request from a client device for a media content item, where the request indicates an identifier of a client. The CDN further provisions an encrypted media content item corresponding to the media content item for the client, where at least a portion of the encrypted media content item is encrypted using at least one personalized key assigned to the client. The CDN also facilitates obtaining a manifest corresponding to the encrypted media content item, where the manifest specifies encryption metadata for retrieving the at least one personalized key by the client. The CDN additionally sends the encrypted media content item and the manifest to the client device.

Abstract: Techniques for a smartphone-based conditional access (CA) system are described. In some embodiments, a headend in the CA system obtains a security profile associated with a pair of receiving devices used by a user, e.g., a first device (e.g., a smartphone) and a second device (e.g., a set-top-box or a TV). The headend dynamically regulates user access to requested media content during each entitlement period by assigning and distributing separate keys to the first and second device based on the security profile. The headend also uses the distributed keys to protect the media content before broadcasting. On the receiving end, one receiving device receives the media content and determines whether it is decryptable by the device. If decryptable, the receiving device (e.g., the set-top-box/TV) decrypts the media content using the keys assigned by the headend. Otherwise, the receiving device forwards the media content to the pairing device for decryption.

Abstract: A method for identifying a data segment includes receiving a first data segment associated with a first recording time; receiving a second data segment associated with a second recording time, comparing: the first recording time with the second recording time, a first time reference value with a second time reference value, and a first length enumeration for first data packets with a second length enumeration for second data packets; determining, based on the comparing, a match between the first data segment and the second data segment; and identifying the first data segment as the same as the second data segment based on the determining.