Representing entitlments to service in a conditional access system

• US 20010053226A1
• Filed: 08/16/2001
• Published: 12/20/2001
• Est. Priority Date: 04/03/1995
• Status: Active Grant

• Current Assignee: Tech 5 SAS
• Original Assignee: Anthony J. Wasilewski, Glendon L. Akins III, Howard G. Pinder, Michael S. Palgon, Robert O. Banker
• Inventors: Pinder, Howard G., Banker, Robert O., Wasilewski, Anthony J., Akins, Glendon L. III, Palgon, Michael S.
• Granted Patent: US 6,937,729 B2
• Time in Patent Office: Days
• US Class Current: 380/282
• CPC Class Codes: H04J 2203/008 Support of video
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04N 21/2265 Server identification by a unique number or address, e.g. serial number network arrangements, protocols or services for addressing or naming H04L61/00
• CPC Class Codes: H04N 21/23476 by partially encrypting, e.g. encrypting the ending portion of a movie
• CPC Class Codes: H04N 21/26606 for generating or managing entitlement messages, e.g. Entitlement Control Message [ECM] or Entitlement Management Message [EMM] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/426 Internal components of the client ; Characteristics thereof H04N5/44 takes precedence
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/4524 involving the geographical location of the client retrieval from the Internet by querying based on geographical locations G06F16/9537; systems specially adapted for using geographical information in broadcast systems H04H60/70; protocols in which the network application is adapted for the location of the user terminal in communication control or processing H04L67/52; services making use of the location of users or terminals in wireless networks H04W4/02; locating users or terminals in wireless networks H04W64/00
• CPC Class Codes: H04N 21/63345 by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 7/162 Authorising the user terminal, e.g. by paying; Registering the use of a subscription channel, e.g. billing
• CPC Class Codes: H04N 7/163 : by receiver means only
• CPC Class Codes: H04N 7/1675 : Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58
• CPC Class Codes: H04N 7/17354 : in an intermediate station common to a plurality of user terminals

Abstract

A cable television system provides conditional access to services. The cable television system includes a headend from which service “instances”, or programs, are broadcast and a plurality of set top units for receiving the instances and selectively decrypting the instances for display to system subscribers. The service instances are encrypted using public and/or private keys provided by service providers or central authorization agents. Keys used by the set tops for selective decryption may also be pOublic or private in nature, and such keys may be reassigned at different times to provide a cable television system in which piracy concerns are minimized.

Claims

1. Apparatus for representing entitlements for instances of services having entitlement IDs associated therewith in a receiver that receives the instances of services and the entitlement IDs, the apparatus comprising:

a memory having a starting entitlement ID and a map having entitlement values for entitlements that have been given to the receiver, wherein the starting entitlement ID is used with the map and with an entitlement ID associated with a given instance of service to determine whether the receiver is entitled to the given instance of a service, and wherein the receiver grants access to the given instance of service only if the receiver is entitled to the given instance of service.

2. The apparatus of

claim 1

, wherein the map represents a sequence of entitlement IDs.

3. The apparatus of

claim 2

, wherein the starting entitlement ID is the first entitlement ID in the sequence of entitlement IDs.

4. The apparatus of

claim 3

, wherein the sequence of entitlement IDs is a list.

5. The apparatus of

claim 3

, wherein the sequence of entitlement IDs is contiguous in the memory.

6. The apparatus of

claim 5

, wherein the map is a bit map representing the presence or absence of entitlements for the receiver for instances of service.

7. The apparatus of

claim 3

, wherein:

the map is represented by an array of elements having entitlement values that represent the presence or absence of entitlement; and

the difference in the sequence of entitlement IDs between the starting entitlement ID and the entitlement ID associated with the given instance of service is used to determine the index value for a given element in the array, wherein the given element has the entitlement value of the given instance of service.

8. The apparatus of

claim 7

, wherein:

the array has single-bit elements and the state of an element'"'"'s bit indicates whether the receiver has the entitlement value represented by the array element.

9. The apparatus of

claim 1

, wherein:

the memory is accessible only to an access control component of the receiver.

10. The apparatus of

claim 9

, wherein:

the starting entitlement ID and the map are set in response to a message received in the receiver.

11. The apparatus of

claim 1

, wherein:

the starting entitlement ID and the map are set in response to a message received in the receiver.

12. The apparatus of

claim 11

;

wherein;

the message contains a message starting entitlement ID and message map from which the starting entitlement ID and the map are set.

13. The apparatus of

claim 12

, wherein:

the receiver is given entitlements by at least one entitlement agent;

each entitlement agent has a map for representing entitlements that have been given to the receiver;

the message further specifies a given entitlement agent; and

the message starting entitlement ID and the message map are used to set a starting entitlement ID and a map in the list for the given entitlement agent.

14. The apparatus of

claim 1

, further comprising:

a time value that indicates a time at which the entitlement values are not valid.

15. A method of providing a receiver with entitlements for instances of a service, the method comprising the steps of:

making a representation of entitlements that includes a starting entitlement ID and a map that specifies a set of entitlement values; and

sending a message to the receiver that contains the representation, wherein the receiver responds to the message by storing the representation and using the starting entitlement ID with the map and with an entitlement ID associated with a given instance of service to determine whether the receiver has an entitlement value for the given instance of a service.

16. The apparatus of

claim 15

, wherein the map represents a sequence of entitlement IDs.

17. The apparatus of

claim 16

, wherein the starting entitlement ID is the first entitlement ID in the sequence of entitlement IDs.

18. The apparatus of

claim 17

, wherein the sequence of entitlement ID is a list.

19. The apparatus of

claim 17

, wherein the sequence of entitlement IDs is contiguous in the memory.

20. The apparatus of

claim 19

, wherein the map is a bit map representing the presence or absence of entitlements for the receiver for instances of service.

21. The method of

claim 17

, wherein:

the map is represented by an array whose elements have entitlement values that represent the presence or absence of entitlement values; and

the difference between the starting entitlement ID and the entitlement ID of the given instance of service is used to determine the index value for an element in the array, wherein the element having the index value represents the entitlement value of the given instance of service.

22. The method of

claim 21

, wherein:

the array has single-bit elements and the state of an element'"'"'s bit indicates whether the receiver has the entitlement value represented by the array element.

23. The method of

claim 15

, wherein:

the receiver is given entitlements by at least one entitlement agent; and

the method further includes the steps of;

putting a specification of a given entitlement agent in the message, the receiver using the specification to locate a list whose elements include an apparatus for representing entitlements and using the apparatus in the message to set an apparatus in the list for the given entitlement agent.

24. The method of

claim 15

, further comprising the steps of:

putting a time value that indicates a time at which the representation is not valid in the message; and

the receiver storing the time value and using the time value to determine whether the representation is valid.

25. The method of

claim 15

, further comprising the step, in the receiver, of:

determining that the receiver has an entitlement value for the given instance of service;

processing, in a secure element, a long-term key to obtain a short-term key; and

using the short-term key to decrypt the given instance of service.

26. The method of

claim 15

, wherein the sending step comprises the step of:

sending to the receiver a long-term key within the message.

27. The method of

claim 15

, wherein the message including the entitlement ID is authenticated by the receiver using information provided by an entitlement agent.

28. The method of

claim 15

, wherein authentication is performed using RSA digital signatures.

29. A receiver for receiving instances of service and entitlement IDs associated therewith and entitlement values for the entitlement IDs, the receiver comprising:

a port for receiving instances of service and at least a first message having an entitlement ID associated with a given instance of service;

a memory coupled to the port having a starting entitlement ID and a map including entitlement values that have been given to the receiver, wherein the starting entitlement ID is used in conjunction with the map and with an entitlement ID associated with the given instance of service to determine the entitlement of the receiver for the given instance of service, and wherein the receiver grants access to the given instance of service only if the receiver is entitled to the given instance of service.

30. The receiver of

claim 29

, wherein the map represents a sequence of entitlement IDs.

31. The receiver of

claim 30

, wherein the sequence of entitlement IDs is a discrete list of entitlement IDs.

32. The receiver of

claim 30

, wherein the starting entitlement ID is the first entitlement ID in the sequence of entitlement IDs.

33. The receiver of

claim 30

, wherein the map is represented by an array of elements having entitlement values stored therein, and the index number of the element in the array having the entitlement value for a given instance of service is determined from the sequence of entitlements IDs by the difference between the starting entitlement ID and the entitlement ID for the given instance of service.

34. The receiver of

claim 29

, wherein the array is a bit map.

35. The receiver of

claim 29

, wherein the memory is accessible only to an access control component.

36. The receiver of

claim 29

, wherein the starting entitlement ID and the map are set in response to a message received in the receiver.

37. A method of determining entitlements for instances of service in a receiver, the method comprising the steps, in the receiver, of:

receiving at least a first message having a starting entitlement ID and a map having entitlement values that represent entitlements of the receiver for instances of service;

storing in a memory at least the starting entitlement ID and the map of the first message;

receiving at least a second message having an entitlement ID associated with a given instance of service; and

determining whether the receiver is entitled to the instance of service by using the starting entitlement ID and the entitlement ID associated with the given instance of service to determine an element of the map which has the entitlement value of the given instance of service.

38. The method of

claim 37

, wherein the map is stored as an array, the starting entitlement ID is the first entitlement ID in a sequence of entitlement IDs including the entitlement ID associated with the given instance of service, and the difference in the sequence between the starting entitlement ID and the entitlement ID associated with the given instance of service is used to determine an element in the array having the entitlement value for the given instance of service.

39. The method of

claim 38

, wherein the map is a bit map.

40. The method of

claim 37

, further including:

receiving at least a second message that specifies a given entitlement agent; and

allocating a portion of the memory to the given entitlement agent.

41. The method of

claim 40

, further comprising:

receiving at least a third message having a starting entitlement ID and a map;

storing the starting entitlement ID and the map of the at least third message in the portion of the memory allocated to the given entitlement agent.

42. The method of

claim 37

, wherein the first message further includes a time indicator representing expiration date of the entitlements and the storing step further includes storing the expiration date;

and wherein the determining step further includes;

determining whether the entitlement value for the given instance of service has expired.

43. The method of

claim 37

, further comprising the steps of:

receiving a third message having a long-term key;

processing in a secure element the long-term key to obtain a short-term key; and

decrypting the given instance of service with the short-term key.

44. The method of

claim 38

, further comprising the step of:

authenticating the first message using information provided by an entitlement agent.

45. The method of

claim 44

, wherein the step of authentication is performed by using RSA digital signatures.