SYSTEMS AND METHODS FOR DATA PROCESSING. STORAGE. AND RETRIEVAL
FROM A SERVER
Cross Reference to Related Applications
[001] This application is a continuation-in-part, and claims the benefit of priority, of United States Patent Application No. 16/660,761, filed on October 22, 2019, currently pending, which is incorporated herein by reference in its entirety.
BACKGROUND Technical Field
[002] The present disclosure relates to systems and methods for establishing data communication with a data storage provider and for exchanging data with the data storage provider. More particularly, various embodiments of the present disclosure relate to transmitting video data to and from the data storage provider. Background Information
[003] Direct to home (DTH) broadcasting occurs when content providers transmit data using satellites (such as satellite television or satellite radio), and digital terrestrial television (DTT) broadcasting occurs when content providers transmit data (e.g., digital television data) over the air with broadcast towers. Combined with cable broadcasts (e.g., using auxiliary cables to cable boxes), these technologies remain a primary source for content distribution to consumers. [004] In addition to DTH, DTT, and cable, over the top (OTT) services include multimedia content providers that stream content directly to viewers over the Internet, bypassing telecommunications, multichannel television, and broadcast television platforms that traditionally act as a content controller or distributor. Users have widely embraced OTT services, such as web-based and video-on-demand services, as alternatives to traditional multimedia platforms.
[005] Developers and broadcasters have turned to digital rights management (DRM) techniques to securely distribute content using OTT services. For example, an application on a user device, such as a smartphone, laptop, or the like, may use a key, certificate, or other encryption protocol to receive copyrighted content and decode die same for playback. Some OTT services may allow for non-transitory storage of copyrighted content on a user device for offline playback. [006] Existing encryption techniques face important challenges that limit the flexibility of storing content transmitted using DTH, DTT, and cable technology. User devices are often not

allowed to transmit or store copyrighted content without encryption. For example, users may retain the key, certificate, or other encryption protocol on the user device to prevent a third party from obtaining unauthorized access to the contents of the encrypted content. However, this leads to redundancies if the user stores the copyrighted content remotely, e.g., using a cloud service or the like. In particular, the remote storage must store each and every user's copy of the copyrighted content in full because the remote storage is unable to determine overlapping (also referred to as common or equivalent) content. Further, reducing the transmission of copyrighted content may reduce security risks, and may lead to better network utilization and storage efficiency. For example, transmitted copyrighted content may be intercepted on a network, and, in some cases, may be decrypted by a bad actor. Therefore, traditional approaches for storing data may result in vulnerabilities and redundancies for copyrighted content. [007] These challenges are also present for content from OTT systems or when DTH, DTT, or cable technologies cooperate with OTT systems for upload and remote storage of content. For example, the same redundancies and vulnerabilities occur if copyrighted content from an OTT system is uploaded to remote storage.
[008] The disclosed systems and methods for recognition, storage, and transmission of encrypted data structures address one or more of the problems set forth above and/or other problems in the prior art.
SUMMARY [009] Embodiments consistent with the present disclosure provide systems and methods for establishing data communication with a data storage provider and for exchanging data with the data storage provider.
[010] Disclosed embodiments may include any one of the following embodiments alone or in combination with one or more other embodiments, whether implemented as a method, by at least one processor, and/or stored as executable instructions on non transitory computer readable media.
[011] Consistent with a disclosed embodiment, a method for identifying a data segment is provided. The method is performed by at least one processor and comprises receiving a first data segment associated with a first recording time, the first data segment comprising one or more first data packets, wherein a starting first data packet includes a first time reference value. The method further includes receiving a second data segment associated with a second recording

time, the second data segment comprising one or more second data packets, wherein a starting second data packet includes a second time reference value. The method also comprises comparing the first recording time with the second recording time, the first time reference value with the second time reference value, wherein comparing the first time reference value and the second time reference value comprises determining whether the first time reference value matches identically the second time reference value. Further, the method includes comparing a first length enumeration for the first data packets with a second length enumeration for the second data packets, wherein comparing the first length enumeration and the second length enumeration comprises determining whether the first length enumeration matches identically the second length enumeration. Also, the method includes determining, based on the comparing a match between the first data segment and (he second data segment; and identifying the first data segment as the same as the second data segment based on the determining. [012] Further, consistent with a disclosed embodiment, the method may include evaluating a time metric by computing an absolute value of a difference between the first recording time and the second recording time, wherein the deterniining further is based on the evaluated time metric, and wherein the identifying further is based on the time metric is within a threshold range. [013] In an example embodiment, the first time reference value comprises a system clock reference of the first data segment, and the second time reference value comprises a system clock reference of the second data segment.
[014] In an example embodiment, the first time reference value comprises a program clock reference of the first data segment, and the second time reference value comprises a program clock reference of the second data segment.
[015] In an example embodiment, the first time reference value comprises a presentation timestamp of the first data segment, and the second time reference value comprises a presentation timestamp of the second data segment.
[016] In an example embodiment, the first length enumeration comprises a number of packets in the first data segment, and the second length enumeration comprises a number of packets in the second data segment.
[017] In an example embodiment, the first length enumeration comprises a number of packets for the first data segment, and the second length enumeration comprises a number of packets for the second data segment.

[018] In an example embodiment, the first length enumeration comprises a first many-to-one
mapping rule between the number of packets for the first data segment and a first unique integer
number, and wherein the second length enumeration comprises a second many-to-one mapping
rule between the number of packets for the second data segment and a second unique integer
number, and wherein the first many-to-one mapping rule is the same as the second many-to-one
mapping rule.
[019] Consistent with a disclosed embodiment, a method for identifying a data segment, the
method being performed by at least one processor comprises receiving a first and a second group
of data segments each data segment in the first and the second group being defined by segment
parameters, the segment parameters comprising a time at which each data segment in the first or
the second group was received, a length enumeration for each data segment in the first or the
second group, and a starting time reference value identified within each data segment in the first
or the second group. The method includes for each first data segment from the first group
determining a matching second data segment from the second group by comparing first segment
parameters of the first data segment with second segment parameters of the second data segment,
resulting in a matching set of pairs of data segments.
[020] Consistent with a disclosed embodiment, the method may further comprise identifying
the matching set of pairs of data segments based on canonical segment parameters.
[021] In an example embodiment, the canonicalized segment parameters for a matching pair of
the first data segment and the second data segment are determined by selecting a time at which
the first data segment was received as a canonical time, selecting a length enumeration for the
first data segment as a canonical data segment length, and selecting a starting time reference
value identified within the first data segment as a canonical starting time reference.
[022] In an example embodiment, the length enumeration comprises a number of packets for
the first data segment.
[023] Consistent with a disclosed embodiment, the method may further comprise determining a
group of pairs from the matching set of pairs.
[024] In an example embodiment, comparing the first segment parameters with the second
segment parameters comprises comparing a first starting time reference value of the first
parameters with a second starting time reference value of the second parameters and determining

whether the first starting time reference value matches identically the second starting time reference value.
[025] In an example embodiment, comparing the first segment parameters with the second segment parameters comprises comparing a first length enumeration of the first parameters and a second length enumeration of the second parameters and determining whether the first length enumeration matches identically the second length enumeration.
[026] In an example embodiment, comparing the first segment parameters with the second segment parameters comprises determining an absolute value of a difference between a first time of the first parameters and a second time of the second parameters, and determining whether the absolute value is below a time threshold.
[027] Consistent with a disclosed embodiment, a method of splitting a data stream into a set of data segments is provided. The method is performed by at least one processor, and includes receiving the data stream, wherein the data stream comprises data packets, with at least some of the data packets having time identifiers, selecting a segment time period and a time domain, subdividing the time domain into a set of time blocks, each one of the set of time blocks having a duration of the segment time period, identifying a set of starting data packets corresponding to the set of time blocks, wherein each one of the set of starting data packets comprises a first data packet having a time identifier in a corresponding each one of the set of time blocks, identifying a set of finishing data packets corresponding to the set of starting data packets, wherein each identified one of the set of finishing data packets immediately precedes each one, except a first one, of the set of starting data packets, identifying a last one of the set of finishing data packets being a last data packet of a last one of the set of time blocks, and identifying the set of data segments based on the corresponding set of starting data packets and the corresponding set of finishing data packets.
[028] In an example embodiment, a data segment from the set of data segments includes a corresponding starting data packet from the set of starting data packets, a corresponding finishing data packet from a set of finishing data packets, and all data packets of the data stream located between the corresponding starting data packet and the corresponding finishing data packet. [029] In an example embodiment, the segment time period is in a range of one to tens of seconds.

[030] In an example embodiment, the segment time period is determined by a number, such
that the segment time period is substantially an exponentiation of two in a power of the number
divided by a frequency of a clock.
[031] In an example embodiment, the data stream comprises compressed video data, and
wherein the clock is a system time clock associated with a decoder for the compressed video
data.
[032] In an example embodiment, the data stream comprises compressed video data, and
wherein the clock is a program clock reference associated with a decoder for the compressed
video data.
[033] In an example embodiment, the data stream comprises compressed video data, and
wherein the clock is a presentation timestamp associated with a decoder for the compressed
video data.
[034] In an example embodiment, the time identifiers identify time positions of the video data,
and wherein the time positions substantially match time values obtained from the system time
clock being one of a program clock reference or a presentation timestamp.
[035] In an example embodiment, the data stream comprises an MPEG-2 transport stream of
the data packets communicated via a network.
[036] Consistent with a disclosed embodiment, the method may further comprise determining a
probability of a data packet being missed from a data segment during the communication of the
data stream and selecting the segment time period such that a probability of the data packet being
missed from the data segment is less than a target probability value.
[037] Consistent with a disclosed embodiment, the method may further comprise determining
an overhead cost associated with the processing of the data segment and selecting the segment
time period such that the overhead cost is less than a target overhead value.
[038] Consistent with a disclosed embodiment, the method may further comprise for a time
segment period determining a probability of a data packet being missed from a data segment
having the segment time period, determining an overhead cost associated with the processing of
the data segment, and based on a cost function associated with the probability and the overhead
cost, determining a target time segment period that minimizes the cost function.
[039] Consistent with a disclosed embodiment, a method of splitting a data stream into a set of
data segments is provided. The method may be performed by at least one processor and includes

receiving the data stream, wherein the data stream comprises data packets of a fixed length, with
at least some of the data packets having bit number identifiers, selecting a segment length unit
and a total length, subdividing the total length into a set of length blocks, each one of the set of
length blocks having a length of the segment length unit, identifying a set of starting data packets
corresponding to the set of length blocks, wherein each one of the set of starting data packets
comprises a first data packet having a bit number identifier in a corresponding each one of the set
of length blocks, identifying a set of finishing data packets corresponding to the set of starting
data packets, wherein each identified one of the set of finishing data packets immediately
precedes each one, except a first one, of the set of starting data packets, identifying a last one of
the set of finishing data packets as being a last data packet of a last one of the set of length
blocks, and identifying the set of data segments based on the corresponding set of starting data
packets and the corresponding set of finishing data packets.
[040] In an example embodiment, a data segment from the set of data segments includes a
corresponding starting data packet from the set of starting data packets, a corresponding finishing
data packet from a set of finishing data packets, and all the data packets of the data stream
located between the corresponding starting data packet and the corresponding finishing data
packet.
[041] In an example embodiment, the segment length unit is determined by a number, such that
the segment length unit is substantially an exponentiation of two in a power of the number.
[042] In an example embodiment, the data stream comprises a transport stream of the data
packets communicated via a network to a user device.
[043] Consistent with a disclosed embodiment, the method may further comprise determining a
probability of a data packet being missed from a data segment during the communication of the
data stream and selecting the segment length unit such that a probability of the data packet being
missed from the data segment is less than a target probability value.
[044] Consistent with a disclosed embodiment, the method may further comprise determining
an overhead cost associated with the processing of a data segment and selecting the segment
length unit such that the overhead cost is less than a target overhead value.
[045] Consistent with a disclosed embodiment, the method may further comprise for a segment
length unit determining a probability of a data packet being missed from a data segment having
the segment length unit, deterniining an overhead cost associated with the processing of the data

segment, and based on a cost function associated with the probability and the overhead cost, determining a target segment length unit that minimizes the cost function. [046] Consistent with a disclosed embodiment, a method of selectively decrypting encrypted data is provided. The method is performed by at least one processor and includes identifying a first encrypted data bit and a last encrypted data bit associated with a portion of encrypted data, identifying a first encrypted block including the first encrypted data bit, and a first counter associated with the first encrypted block, identifying a last encrypted block including the last encrypted data bit, and a last counter associated with the last encrypted block, identifying a set of encrypted blocks, the set of encrypted blocks including the first encrypted block, the last encrypted block, and a set of all encrypted blocks located between the first and the last encrypted block, identifying a set of counters corresponding to the set of encrypted blocks, the set of counters including the first counter, the last counter, and a plurality of counters located between the first and the last counter, wherein a bitwise length of each one of the plurality of counters is the same as a bitwise length of each one of the set of encrypted blocks, selecting a plurality of encrypted data bits between and including the first encrypted data bit and the last encrypted data bit. The method further includes for each encrypted data bit from the plurality of encrypted data bits deterrnining a corresponding encrypted block and a block number that contains the encrypted data bit, deterrnining a corresponding counter for the determined block number, determining a bit position of the encrypted data bit within the determined encrypted block, selecting a counter bit at the bit position within the counter, encrypting the counter, and executing an XOR operation between the encrypted data bit and the corresponding encrypted counter bit.
[047] In an example embodiment, identifying the first encrypted block comprises determining a first bit number associated with the first encrypted data bit, and deterrnining a first block number, the deterrnining based on the first bit number and a block length, wherein the first block number corresponds to the first encrypted block.
[048] In an example embodiment, identifying the last encrypted block comprises detemiining a last bit number associated with the last encrypted data bit, and deterrnining a last block number, the deterrnining based on the last bit number and a block length, wherein the last block number corresponds to the last encrypted block. [049] In an example embodiment, the counter is encrypted using a cipher key.

[050] In an example embodiment, the cipher key is locally available to the at least one hardware processor.
[051] In an example embodiment, the encrypted data is encrypted using a block cipher counter mode.
[052] In an example embodiment, the encrypted data is encrypted using a random initialization vector.
[053] In an example embodiment, any one of the plurality of counters comprises a first part and a second part, the first part being the initialization vector, and the second part being a counter increment.
[054] Consistent with a disclosed embodiment a method of selectively encrypting a portion of data is provided. The method is performed by at least one hardware processor and comprises identifying a first data bit and a last data bit associated with a portion of data, identifying a first block including the first data bit, and a first counter associated with the first block, identifying a last block including the last data bit, and a last counter associated with the last block, identifying a set of blocks, the set of blocks including the first block, the last block, and a set of all blocks located between the first and the last block, identifying a set of counters corresponding to the set of blocks, the set of counters including the first counter, the last counter, and a plurality of counters located between the first and the last counter, wherein a bitwise length of each one of the plurality of counters is the same as a bitwise length of each one of the set of blocks, selectmg a plurality of data bits between and including the first data bit and the last data bit. The method further comprises for each data bit from the plurality of data bits determining a corresponding block and a block number that contains the data bit, determining a corresponding counter for the determined block number, determining a bit position of the data bit within the determined block, selecting a counter bit at the bit position within the counter, encrypting the counter, and executing an XOR operation between the data bit and the corresponding encrypted counter bit. [055] In an example embodiment, identifying the first block comprises determining a first bit number associated with the first data bit, and determining a first block number, the deterrnining based on the first bit number and a block length, wherein the first block number corresponds to the first block, and wherein lengths for all blocks of the data are the same.

[056] In an example embodiment, the first block number is a ceiling of a result of dividing the
first bit number by the block length, wherein a starting block number of the data is assigned to
one.
[057] In an example embodiment, identifying the last block comprises determining a last bit
number associated with the last data bit, and detenrrining a last block number, the determining
based on the last bit number and a block length, wherein the last block number corresponds to
the last block, and wherein lengths for all blocks of the data are the same.
[058] In an example embodiment, the last block number is a ceiling of a result of dividing the
last bit number by the block length, wherein a starting block number of the data is assigned to
one.
[059] In an example embodiment, the set of counters are encrypted using a cipher key, resulting
in a set of encrypted counters.
[060] In an example embodiment, a cipher key is locally available to the at least one hardware
processor.
[061] Consistent with a disclosed embodiment, a method of selectively encrypting a portion of
data is provided. The data is subdivided into a set of blocks, each block having a corresponding
block number. In an example embodiment, the method is performed by at least one hardware
processor and includes identifying a one-to-one mapping for mapping a block number to a
unique block identifier, wherein a bitwise length of the unique block identifier is the same as a
bitwise length of each one of (he set of blocks, identifying a first data bit and a last data bit
associated with the portion of the data, identifying a first block including the first data bit,
identifying a last block including the last data bit, identifying a set of blocks including the first
and the last blocks, and a set of all blocks located between the first and the last blocks. The
method may further include for each data bit from a plurality of data bits located between and
including the first data bit and the last data bit determining a corresponding block and a block
number that contains the data bit, determining a unique block identifier for the determined block
number, determining a bit position of the data bit within the determined block, selecting a unique
block identifier bit at the bit position within the unique block identifier, encrypting the unique
block identifier; and executing an XOR operation between the data bit and the corresponding
encrypted unique block identifier bit.

[062] In an example embodiment, the one-to-one mapping is created using a random number generator with a random seed being the cipher key.
[063] In an example embodiment, the one-to-one mapping is created using a function that takes as an input the block number and at least one unique parameter associated with one of a user or a device of the user and returns a unique block identifier.
[064] In an example embodiment, the unique parameter includes a unique device identification. [065] In an example embodiment, the unique block identifier is encrypted using a cipher key. [066] In an example embodiment, the unique block identifier comprises a first part and a second part, wherein the first part being an initialization vector and the second part being a result of the one-to-one mapping.
[067] Consistent with a disclosed embodiment, a method of authenticating data received from a user device by a service provider is provided. The method is performed by at least one processor of the service provider and includes receiving user credentials from the user device via a secure communication channel, upon verifying the user credentials, providing to the user device via the secure channel a permission token, wherein the permission token includes at least a shared secret, wherein a data within the permission token is not observable to the user device and a shared secret data outside the data of the permission token, the shared secret data observable to the user device. The method further includes receiving a request from the user device via a non¬secure communication channel, wherein the request comprises at least the permission token and a hash digest formed using at least a portion of the shared secret data.
[068] In an example embodiment, the permission token is encrypted based on a cryptographic key maintained by the service provider and not made available to the user device. [069] In an example embodiment, the shared secret data includes a sequence number. [070] In an example embodiment, the shared secret data includes one of an increment algorithm or a download challenge, or both the increment algorithm and the download challenge. [071] In an example embodiment, the permission token includes secret data, the secret data representing at least a period of validity of the permission token.
[072] In an example embodiment, the request includes information about video data, and wherein the permission token includes information regarding a channel identification comprising one of a broadcast channel identification or a broadcast program related to the video data.

[073] Consistent with a disclosed embodiment, the method may further comprise upon
successfully verifying the sequence number and the permission token, completing the request,
communicating to the user device that the sequence number requires to be incremented, wherein
the incrementation is carried out using the increment algorithm, and updating a local copy of the
sequence number by incrementing the sequence number via the increment algorithm.
[074] In an example embodiment, the increment algorithm comprises adding an integer to the
sequence number.
[075] In an example embodiment, the request comprises a request to offload a data segment.
[076] In an example embodiment, the request comprises a proof that the user device is in
possession of the data segment, and wherein the shared secret data and the proof are used to form
the hash digest.
[077] In an example embodiment, the request comprises a segment identification for the data
segment.
[078] In an example embodiment, the request comprises a broadcast channel identification.
[079] In an example embodiment, the request comprises a hash digest computed based on at
least one of a proof that the user device is or was in possession of the data segment, a segment
identification for the data segment, the sequence number, or a broadcast channel identification.
[080] In an example embodiment, the request comprises a hash digest computed based on all of
a proof that the user device is in possession of the data segment, a segment identification for the
data segment, the sequence number, and a channel identification.
[081] In an example embodiment, completing the request to upload the data segment comprises
providing to the user device a challenge for offloading the data segment, wherein the challenge
comprises a request for one or more bits of data of the data segment, receiving a communication
from the user device, wherein a proof for the received challenge is included in a hash digest, and
upon verifying the hash digest based on a local copy of a proof, authorizing the user device to
offload the data segment.
[082] In an example embodiment, at least some data communicated over the non-secure
communication channel between the user device and the service provider is encrypted using a
user device-based encryption key.
[083] In an example embodiment, the service provider has access to a user-device based
encryption key.

[084] In an example embodiment, the request comprises a request to download a data segment. [085] In an example embodiment, completing the request to download the data segment comprises providing to the user device a challenge for downloading the data segment, wherein the challenge comprises a request for one or more bits of data of the data segment, receiving a communication from the user device, wherein a proof for the received challenge is included in a hash digest, and upon verifying the hash digest based on a local copy of a proof, authorizing the user device to download the data segment.
[086] Consistent with disclosed embodiment, a system for exchanging data securely between a user device and a server is provided. The system includes server instructions, wherein at least one processor of the server performs the server instructions resulting in server operations comprising receiving a user credential from the user device via a secure communications channel, upon verifying the user credentials, providing to the user device via the secure channel, a permission token, wherein the permission token includes at least a sequence number, wherein a data within the permission token is not observable to the user device, and the sequence number outside the data of the permission token, the sequence number observable to the user device. The server operations may further comprise receiving a request from the user device via a non-secure communication channel, wherein the request comprises at least the permission token and a hash digest formed using in part the sequence number, verifying the request by verifying the sequence number and the permission token. Further, the system includes at least one processor of the user device configured to perform operations comprising providing the user credential to the server via the secure communications channel, receiving the permission token via the secure communications channel, forming the request to the server, and providing the permission token and the hash digest to the server via the non-secure communications channel. [087] In an example embodiment, at least one processor of the user device is configured to perform operations further comprising forming a hash digest computed based on at least a proof that the user device is in possession of the data segment, a segment identification for the data segment, the sequence number, or a broadcast channel identification.
[088] In an example embodiment, the request comprises a request to upload a data segment. [089] In an example embodiment, the server operations further comprise upon verifying the hash digest using the local copy of the proof, authorizing the user device to upload the data segment.

[090] In an example embodiment, comprising providing to the user device via the secure channel a challenge and an increment algorithm.
[091] In an example embodiment, the user device is further configured to perform operations comprising forming the proof based on the provided challenge and providing the permission token and the proof to the server via the non-secure communications channel. [092] Consistent with a disclosed embodiment, a method of authenticating data received from a user device by a service provider is provided. The method is performed by at least one processor of the service provider and includes receiving user credentials from the user device via a secure communication channel, upon verifying the user credentials, providing to the user device via the secure channel a handle to a permission token, wherein the permission token includes at least a shared secret, wherein a data within the permission token is not observable to the user device, and a shared secret data outside the data of the permission token, the shared secret data observable to the user device. The method may further include receiving a request from the user device via a non-secure communication channel, wherein the request comprises at least the handle to the permission token and a hash digest of the shared secret data. The method may further include verifying the request by comparing the hash digest received from the user device with a computed hash digest, wherein the computed hash digest is obtained using data obtained by retrieving the permission token using the handle to the permission token. [093] Consistent with a disclosed embodiment, a method for offloading a data segment comprises receiving a request from a user device to offload the data segment, the request including a probe request wherein the probe request includes a segment identification. The method includes sending a probe response to the user device, the probe response comprising an approval or decline of an action to be executed by the user device, the action being one of an upload, or a request to retry offloading the data segment at a later time. Further the method includes sending a challenge to the user device.
[094] In an example embodiment, the challenge comprises a request for one or more bits of data of the data segment.
[095] In an example embodiment, the probe request includes a segment identification formed using a recording time for the data segment, a reference time value for the data segment, and a length enumeration for the data segment.

[096] Consistent with a disclosed embodiment, the method may further comprise requesting the
user device to store the challenge, and a user device proof, wherein the challenge and the user
device proof is specific to the data segment.
[097] In an example embodiment, the upload is declined if data corresponding to the data
segment is known to be recoverable from a server.
[098] Consistent with a disclosed embodiment, the method may further comprise determining
whether the segment identification matches one of the segment identifications associated with
one of the local copies of data segments recoverable from a server.
[099] Consistent with a disclosed embodiment, the method may further comprise determining
that the action is an approval of the upload when the segment identification does not match any
of the segment identifications associated with one of the local copies of data segments
recoverable from a server.
[100] Consistent with a disclosed embodiment, the method may further comprise determining
that the action is a decline of the upload when the segment identification matches at least one of
segment identifications associated with one of the local copies of data segments recoverable
from a server.
[101] In an example embodiment, the challenge is unique for the user device.
[102] In an example embodiment, the challenge is generated for the user device based on an
identification of the user device.
[103] Consistent with a disclosed embodiment, the method may further comprise authenticating
the user device before receiving the request from the user device.
[104] Consistent with a disclosed embodiment, the method may further comprise receiving the
data segment and the segment identification information when the probe response to the user
device indicates that the upload is approved.
[105] Consistent with a disclosed embodiment, the method may further comprise receiving
uploaded data, the uploaded data comprising information used to obtain a user device content
key, wherein the content key is configured to partially decrypt the data segment.
[106] Consistent with a disclosed embodiment, the method may further comprise notifying the
user device that the uploaded data is received after receiving the uploaded data.
[107] In an example embodiment, the data segment is encrypted commutatively with at least
the content key and a common key.

WHAT IS CLAIMED IS:
1. A method for offloading a data segment the method comprising:
receiving a request from a user device to offload the data segment, the request including a probe request, and the probe request including a segment identification;
sending a probe response to the user device, the probe response comprising an approval or decline of an action to be executed by the user device, the action being one of an upload, or a request to retry offloading the data segment at a later time; and
sending a challenge to the user device.
2. The method of claim 1, wherein the challenge comprises a request for one or more bits of
data of the data segment.
3. The method of claim 1, wherein the probe request includes a segment identification formed using a recording time for the data segment, a reference time value for the data segment, and a length enumeration for the data segment.
4. The method of claim 1, further comprising requesting the user device to store (he challenge and a user device proof, wherein the challenge and the user device proof is specific to the data segment.
5. The method of claim 1, wherein the upload is declined if data corresponding to the data segment is known to be recoverable from a server.
6. The method of claim 1, further comprising determining whether the segment identification matches one of segment identifications associated with one of local copies of data segments recoverable from a server.

7. The method of claim 6, further comprising determining that the action is an approval of the upload when the segment identification does not match any of segment identifications associated with one of local copies of data segments recoverable from a server.
8. The method of claim 6, further comprising determining that the action is a decline of the upload when the segment identification matches at least one of segment identifications associated with one of local copies of data segments recoverable from a server.
9. The method of claim 1, wherein the challenge is unique for the user device.
10. The method of claim 1, wherein the challenge is generated for the user device based on an identification of the user device.
11. The method of claim 1, further comprising authenticating the user device before receiving the request from the user device.

12. The method of claim 1, further comprising receiving the data segment and the segment identification information when the probe response to the user device indicates that the upload is approved.
13. The method of claim 12, further comprising receiving uploaded data, the uploaded data comprising information used to obtain a user device content key, wherein the content key is configured to partially decrypt (he data segment.
14. The method of claim 13, further comprising notifying the user device that the uploaded data is received, after receiving the uploaded data.

15. The method of claim 13, wherein the data segment is encrypted commutatively with at least the content key and a common key.
16. The method of claim 13, wherein the uploaded data comprises a local server copy of the data segment, the local server copy of the data segment is stored at a storage device associated with the local server, the local server copy of the data segment being encrypted only by the common key.
17. A method for providing a data segment for downloading to a user device, the method comprising:
receiving a request from the user device to download the data segment, the request comprising a data segment identification and a user device proof;
obtaining a content key;
encrypting a local server copy of the data segment with the content key;
generating a server proof based on the encrypted local server copy of the data segment and a challenge;
comparing the user device proof with the server proof;
when the user device proof matches the server proof, providing the user device with the local server copy of the data segment; and
when the user device proof does not match the server proof, either requesting the user device to retry downloading the data segment at a later time, or notifying the user device that the data segment cannot be downloaded.
18. The method of claim 17, further comprising authenticating the user device before receiving the request from the user device.
19. The method of claim 17, wherein the server proof is generated using the received challenge.

20. The method of claim 17, wherein the challenge comprises a request for one or more bits of the data segment extracted starting at a particular bit position in the data segment.
21. The method of claim 17, wherein the challenge is configured to be unique for each user device.
22. The method of claim 17 wherein the challenge is received as a part of the request.
23. The method of claim 17, wherein determining whether the user device proof matches the server proof comprises comparing the one or more bits of data of the data segment with the one or more bits of the local server copy of the data segment.
24. The method of claim 17, wherein determining whether the user device proof matches the server proof comprises comparing a result of a hash digest of the one or more bits of data of the data segment obtained by the user device with a result of the hash digest of the one or more bits of the local server copy of the data segment obtained by a server.
25. A method for providing a data segment for downloading to a user device, the method comprising:
receiving a request from the user device to download the data segment, the request comprising a data segment identification and a user device proof;
obtaining a content key;
generating a server proof based on a local server copy of the data segment and a challenge;
encrypting the server proof using the content key;
comparing the user device proof with the encrypted server proof;
when the user device proof matches the encrypted server proof, providing the user device with the local server copy of the data segment; and

when the user device proof does not match the encrypted server proof, either requesting . the user device to retry downloading the data segment at a later time, or notifying the user device that the data segment cannot be downloaded.