Source authentication of download information in a conditional access system

• US 20010001014A1
• Filed: 12/26/2000
• Published: 05/10/2001
• Est. Priority Date: 04/03/1995
• Status: Active Grant

• Current Assignee: Tech 5 SAS
• Original Assignee: Anthony J. Wasilewski, Glendon L. Akins III, Howard G. Pinder, Michael S. Palgon, Robert O. Banker
• Inventors: Pinder, Howard G., Banker, Robert O., Wasilewski, Anthony J., Akins, Glendon L. III, Palgon, Michael S.
• Granted Patent: US 6,526,508 B2
• Time in Patent Office: Days
• US Class Current: 380/241
• CPC Class Codes: H04J 2203/008 Support of video
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04N 21/2265 Server identification by a unique number or address, e.g. serial number network arrangements, protocols or services for addressing or naming H04L61/00
• CPC Class Codes: H04N 21/23476 by partially encrypting, e.g. encrypting the ending portion of a movie
• CPC Class Codes: H04N 21/26606 for generating or managing entitlement messages, e.g. Entitlement Control Message [ECM] or Entitlement Management Message [EMM] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/426 Internal components of the client ; Characteristics thereof H04N5/44 takes precedence
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/4524 involving the geographical location of the client retrieval from the Internet by querying based on geographical locations G06F16/9537; systems specially adapted for using geographical information in broadcast systems H04H60/70; protocols in which the network application is adapted for the location of the user terminal in communication control or processing H04L67/52; services making use of the location of users or terminals in wireless networks H04W4/02; locating users or terminals in wireless networks H04W64/00
• CPC Class Codes: H04N 21/63345 by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 7/162 Authorising the user terminal, e.g. by paying; Registering the use of a subscription channel, e.g. billing
• CPC Class Codes: H04N 7/163 by receiver means only
• CPC Class Codes: H04N 7/1675 : Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58
• CPC Class Codes: H04N 7/17354 : in an intermediate station common to a plurality of user terminals

Abstract

A cable television system provides conditional access to services. The cable television system includes a headend from which service “instances”, or programs, are broadcast and a plurality of set top units for receiving the instances and selectively decrypting the instances for display to system subscribers. The service instances are encrypted using public and/or private keys provided by service providers or central authorization agents. Keys used by the set tops for selective decryption may also be public or private in nature, and such keys may be reassigned at different times to provide a cable television system in which piracy concerns are minimized.

Claims

1. A method for authenticating a source of information in a cable television system comprising head end equipment and set top terminals, the method comprising the steps of:

providing source information as an input to a secure hash function; and

additionally processing the source information with a public-private key pair to authenticate the source.

2. The method of

claim 1

, further comprising the step of:

storing, at a receiver included in the cable television system, a public key of the public-private key pair; and

storing, at a transmitter included in the cable television system, a private key of the public-private key pair.

3. The method set forth in

claim 2

, wherein authentication further comprises the steps of:

using at least a portion of an output from said secure hash function as a source authentication token; and

transmitting said source authentication token and said source information.

4. The method of

claim 3

, further comprising the step of:

encrypting said source authentication token prior to its transmission.

5. The method set forth in

claim 4

, wherein said authentication further comprises, at a receiver included in the cable television system, the steps of:

receiving said source authentication token and said source information;

decrypting said source authentication token using a public key of the public-private key pair, wherein said public key is stored by said receiver,

providing said source information as an input into said secure hash function;

using at least a portion of an output from said secure hash function at said receiver as a receiver authentication token; and

comparing said source authentication token with said receiver authentication token, the information being authentic when the two are the same.

6. The method set forth in

claim 5

, wherein said public key comprises a certified public key provided by a certification authority.

7. A method, in a cable television system comprising head end equipment for providing download information, a set top terminal for receiving the download information, and a communication medium coupled therebetween, of verifying the head end equipment as a source of the download information, the method comprising the steps of:

at said head end equipment,

providing said download information as an input to a secure hash function to generate a source authentication token;

encrypting a control word using a private key provided by a conditional access authority, wherein said private key is included in a public-private key pair; and

transmitting said source authentication token, said download information, and said control word over the communication medium;

at said set top terminal,

receiving said source authentication token, said control word, and said download information;

decrypting said control word using a public key included in said public-private key pair;

providing said download information as an input into said secure hash function;

using at least a portion of an output from said secure hash function at said set top terminal as a receiver authentication token; and

comparing said source authentication token with said receiver authentication token, the download information being authentic when the two are the same.

8. A head end for providing verifiable download information, the head end comprising:

a data port for receiving a private key provided by a certification authority, wherein said private key is included in a public-private key pair;

a memory for storing the private key;

a processor for performing a secure hash function having as inputs said download information and a control word;

a device for creating a source authentication token from at least a portion of an output of said secure hash function;

an encryptor for encrypting said control word; and

a transmission device for transmitting said source authentication token, said control word, and said download information.

9. A set top terminal for verifying an information source, said set top terminal comprising:

a port for receiving a message comprising download information, a source authentication token, and a control word from said information source;

a memory for storing a public key that is included in a public-private key pair;

a decryptor coupled to said port for decrypting said control word using said public key;

a processor coupled to said decryptor for performing a secure hash function having as inputs said control word and said download information, and for creating a receiver authentication token from at least a portion of an output from said secure hash function; and

a comparator for comparing said source authentication token with said receiver authentication token, wherein the processor accepts the download information as authentic when the two are the same.

10. A cable television system for verifying the source of download information, the communication system comprising:

a certification authority for generating a providing public and private keys within the cable television system;

an entitlement agent for providing verifiable download information, the entitlement agent comprising;

a data port for receiving a private key provided by the certification authority, wherein said private key is included in a public-private key pair generated by the certification authority;

a memory for storing the private key;

a processor for performing a secure hash function having as inputs said download information and a control word;

a device for creating a source authentication token from at least a portion of an output of said secure hash function;

an encryptor for encrypting said control word; and

a transmission device for transmitting said source authentication token, said control word, and said download information;

a set top terminal for verifying an information source, said set top terminal comprising;

a port for receiving a message comprising said download information, said source authentication token, and said control word from said entitlement agent;

a memory for storing a public key that is included in said public-private key pair;

a decryptor coupled to said port for decrypting said control word using said public key;

a processor coupled to said decryptor for performing a secure hash function having as inputs said control word and said download information, and for creating a receiver authentication token from at least a portion of an output from said secure hash function; and

a comparator for comparing said source authentication token with said receiver authentication token, wherein the processor accepts the download information as authentic when the two are the same; and

a communication medium for coupling said certification authority, said set top terminal; and

said entitlement agent.

11. The cable television system of

claim 10

, wherein said entitlement agent can authenticate different types of download information.

12. The cable television system of

claim 10

, wherein said certification authority can authenticate different types of download information.