PC secure video path

• US 10,055,553 B2
• Filed: 03/29/2016
• Issued: 08/21/2018
• Est. Priority Date: 03/04/2010
• Status: Active Grant

• Current Assignee: Comcast Cable Communications LLC (Comcast Corporation)
• Original Assignee: Comcast Cable Communications LLC (Comcast Corporation)
• Inventors: Fahrny, James W.
• Primary Examiner(s): Mehedi, Morshed
• Application Number:
  US15/084,203
• Publication Number:
  US 20160350517A1
• Time in Patent Office: 875 Days
• CPC Class Codes: G06F 21/109 by using specially-adapted hardware at the client
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/0827 involving distinctive intermediate devices or communication paths network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04N 21/64715 Protecting content from unauthorized alteration within the network verifying the information received for network security in communication control or processing H04L63/12; integrity in wireless network security H04W12/10

Abstract

A system and method are disclosed for creating a secure video content path, or a protected media content bus, within an unsecure personal computer. A portable security module, or electronic key safe, may be inserted into a personal computer that has different internal components for processing secure and unsecured content. The security module may establish a secure encrypted link with a secure video processor of the personal computer, and may use the personal computer'"'"'s network interface to request authority to receive secured content. The security module may provide content keys to the secure video processor to access secured content received over an external network.

Claims

1. A method comprising:

establishing, by a computing device connected with a security module, a secure tunnel between the computing device and the security module;

receiving, by the computing device, a user selection of a content item;

after determining that the content item is secured, sending, by the computing device;

a request for the content item,

an identifier of the computing device, and

an identifier of the security module;

receiving, by the computing device, from the security module, and via the secure tunnel, one or more control words;

receiving, by the computing device, an encrypted stream comprising the content item;

decrypting, by the computing device and using the one or more control words, the encrypted stream comprising the content item;

prior to the decrypting the encrypted stream, routing, by the computing device, the encrypted stream to a secure video processor of the computing device;

after the decrypting the encrypted stream, routing, by the computing device, an unencrypted version of the encrypted stream from the secure video processor to an unsecure video processor of the computing device; and

causing, by the unsecure video processor, display of the content item.

2. The method of claim 1, wherein the establishing the secure tunnel is after establishing the connection between the computing device and the security module.

3. The method of claim 1, further comprising:

sending, by the computing device and to a trusted authority computing device, a key request message comprising;

the identifier of the security module, and

an identifier of an authentication proxy computing device.

4. The method of claim 3, further comprising:

after the sending the key request message, receiving, by the computing device and from the trusted authority computing device, a key response message comprising one or more private keys of the authentication proxy computing device.

5. The method of claim 1, further comprising:

decrypting, by the computing device and using a first control word of the one or more control words, an audio portion of the encrypted stream; and

decrypting, by the computing device and using a second control word of the one or more control words, a video portion of the encrypted stream, wherein the first control word is different from the second control word.

6. The method of claim 1, further comprising:

after establishing the connection between the computing device and the security module, disabling, by the computing device, a different security module connected to the computing device.

12. The method of claim 1, further comprising:

after the sending, receiving, by the security module and from a content source, the one or more control words.

13. The method of claim 1, wherein the secure tunnel is based on a private key of the security module or a private key of the secure video processor.

14. The method of claim 3, wherein the key request message is encrypted using a private key of the security module.

15. The method of claim 4, further comprising:

encrypting, by the computing device and using the one or more private keys of the authentication proxy computing device, a client sign-on request; and

sending, by the computing device and to the authentication proxy computing device, the encrypted client sign-on request.

16. The method of claim 15, further comprising:

after the sending the encrypted client sign-on request, receiving, from the authentication proxy computing device, a sign-on confirmation message.

7. A method comprising:

establishing, by a computing device connected with a security module, a secure tunnel between the computing device and the security module;

sending, by the computing device;

a request for a content item,

an identifier of the computing device, and

an identifier of the security module;

receiving, by the computing device, from the security module, and via the secure tunnel, a first control word and a second control word different from the first control word;

receiving, by the computing device, an encrypted stream comprising the content item;

decrypting, by the computing device and using the first control word, an audio portion of the encrypted stream;

decrypting, by the computing device and using the second control word, a video portion of the encrypted stream;

prior to decrypting the audio portion and the video portion of the encrypted stream, routing, by the computing device, the encrypted stream to a secure video processor of the computing device;

after decrypting the audio portion and the video portion of the encrypted stream, routing, by the computing device, an unencrypted version of the encrypted stream from the secure video processor to an unsecure video processor of the computing device; and

causing, by the unsecure video processor, display of the content item.

8. The method of claim 7, wherein the establishing the secure tunnel is after establishing the connection between the computing device and the security module.

9. The method of claim 7, further comprising:

sending, by the computing device and to a trusted authority computing device, a key request message comprising;

the identifier of the security module, and

an identification of an authentication proxy computing device.

10. The method of claim 9, further comprising:

after the sending the key request message, receiving, by the computing device and from the trusted authority computing device, a key response message comprising one or more private keys of the authentication proxy computing device.

11. The method of claim 7, further comprising:

after establishing the connection between the computing device and the security module, disabling, by the computing device, a different security module connected to the computing device.

17. The method of claim 7, further comprising:

after the sending, receiving, by the security module and from a content source, the first control word and the second control word.

18. The method of claim 9, wherein the key request message is encrypted using a private key of the security module.

19. The method of claim 10, further comprising:

encrypting, by the computing device and using the one or more private keys of the authentication proxy computing device, a client sign-on request; and

sending, by the computing device and to the authentication proxy computing device, the encrypted client sign-on request.

20. The method of claim 19, further comprising:

after the sending the encrypted client sign-on request, receiving, from the authentication proxy computing device, a sign-on confirmation message.