Systems and methods for performing transport I/O

• US 10,382,816 B2
• Filed: 09/20/2017
• Issued: 08/13/2019
• Est. Priority Date: 03/13/2013
• Status: Active Grant

• Current Assignee: NagraStar LLC (Kudelski SA)
• Original Assignee: NagraStar LLC (Kudelski SA)
• Inventors: Beals, William Michael, Fischer, Nicolas, Ellis, Benjamin Brian, Duval, Gregory
• Primary Examiner(s): Chen, Cai Y
• Application Number:
  US15/710,340
• Publication Number:
  US 20180027288A1
• Time in Patent Office: 692 Days
• Field of Search: None
• CPC Class Codes: H04L 2209/16 Obfuscation or hiding, e.g. involving white box
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04N 21/23406 involving management of server-side video buffer
• CPC Class Codes: H04N 21/2401 Monitoring of the client buffer
• CPC Class Codes: H04N 21/4181 for conditional access
• CPC Class Codes: H04N 21/4367 Establishing a secure communication between the client and a peripheral device or smart card
• CPC Class Codes: H04N 21/44004 involving video buffer management, e.g. video decoder buffer or video display buffer
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/4408 involving video stream encryption, e.g. re-encrypting a decrypted video stream for redistribution in a home network
• CPC Class Codes: H04N 21/4623 Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/64715 Protecting content from unauthorized alteration within the network verifying the information received for network security in communication control or processing H04L63/12; integrity in wireless network security H04W12/10
• CPC Class Codes: H04N 21/835 Generation of protective data, e.g. certificates protecting software against unauthorised usage in a vending or licensing environment G06F21/10

Abstract

Systems and methods for implementing a Transport I/O system are described. Network encrypted content may be received by a device. The device may provide the network encrypted content to a secure processor, such as, for example, a smart card. The secure processor obtains a network control work that may be used to decrypt the network encrypted content. The secure processor may decrypt the network encrypted content to produce clear content. In embodiments, the secure processor may then use a local control word to generate locally encrypted content specific to the device. The device may then receive the locally encrypted content from the secure processor and proceed to decrypt the locally encrypted content using a shared local encryption key. The transport I/O system ensures the protection of the network control word by maintaining the network control word on the secure processor.

Claims

1. A removable security device comprising:

at least one processor; and

memory encoding computer executable instructions that, when executed by the at least one processor, performs a method comprising;

receiving, by the removable security device not operating in ISO-7816 mode, network encrypted content;

decrypting the network encrypted content using at least one network control word to generate clear content, wherein the at least one network control word is not transmitted from the removable security device;

encrypting, by the removable security device, the clear content using at least one local control word to generate locally encrypted content, wherein the locally encrypted content is specific to a video processing device physically coupled to the removable security device; and

providing the locally encrypted content to the video processing device.

2. The removable security device of claim 1, wherein the network encrypted content comprises one or more elementary streams comprising audio data and video data.

3. The removable security device of claim 2, wherein each of the one or more elementary streams comprises compressed data for at least one of a network and a channel.

4. The removable security device of claim 1, wherein the network encrypted content was encrypted using the at least one network control word prior to the removable security device receiving the network encrypted content.

5. The removable security device of claim 1, wherein the at least on network control word originated at a head-end device and is stored locally by the removable security device.

6. The removable security device of claim 1, wherein generating the locally encrypted content comprises increasing the size of the clear content to make it more difficult to share the clear content with unauthorized entities over a network.

7. The removable security device of claim 6, wherein increasing the size of the clear content comprises adding non-content data to the clear content to increase the bandwidth required to process the locally encrypted content.

8. The removable security device of claim 1, wherein generating the locally encrypted content comprises applying local link encryption to the clear content.

9. The removable security device of claim 8, wherein the local link encryption comprises exchanging a security key between the removable security device and the video processing device, wherein the security key is specific to the removable security device and not specific to a network transmission.

10. The removable security device of claim 6, wherein the video processing device is not trusted by the removable security device.

11. The removable security device of claim 6, wherein the at least one local control word is generated by the removable security device and shared only with the video processing device.

12. The removable security device of claim 6, wherein the at least one network control word is not transmitted from the removable security device to prevent unauthorized entities from accessing the network encrypted content.

13. A method comprising:

receiving, by a removable security device not operating in ISO-7816 mode, network encrypted content;

decrypting the network encrypted content using at least one network control word to generate clear content, wherein the at least one network control word is not made accessible by the removable security device;

encrypting, by the removable security device, the clear content using at least one local control word to generate locally encrypted content, wherein the locally encrypted content is specific to a video processing device physically coupled to the removable security device; and

providing the locally encrypted content to the video processing device.

14. The method of claim 13, wherein the removable security device is ISO-7816 compliant.

15. The method of claim 13, wherein the removable security device is a smart card and the video processing device is a set-top-box.

16. The method of claim 13, wherein the removable security device is inserted into the video processing device.

17. The method of claim 13, wherein receiving, by the removable security device, the network encrypted content, comprises filtering the network encrypted content by one or more packet identifiers.

18. The method of claim 13, wherein the network encrypted content comprises two or more data streams, wherein the two or more data streams are multiplexed to create a combined stream prior to the locally encrypted content being provided to the video processing device.

19. The method of claim 13, wherein generating the locally encrypted content comprises using local link encryption.

20. A system comprising:

a video processing device; and

a removable security device electrically coupled to the video processing device and comprising at least one processor, wherein the at least one processor performs a method comprising;

receiving, by the removable security device when not operating in ISO-7816 mode, network encrypted content;

decrypting the network encrypted content using at least one network control word to generate clear content, wherein the at least one network control word is not transmitted from the removable security device;

encrypting, by the removable security device, the clear content using at least one local control word to generate locally encrypted content, wherein the locally encrypted content is specific to a video processing device physically coupled to the removable security device; and

providing the locally encrypted content-to the video processing device.