Method and apparatus for providing a hierarchical security profile object

• US 20030163726A1
• Filed: 02/27/2003
• Published: 08/28/2003
• Est. Priority Date: 02/27/2002
• Status: Abandoned Application

• Current Assignee: OpenTV, Inc. (Kudelski SA)
• Original Assignee: OpenTV, Inc. (Kudelski SA)
• Inventors: Kidd, Taylor W.
• Application Number:
  US10/375,860
• Publication Number:
  US 20030163726A1
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: H04N 21/2541 Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/835 Generation of protective data, e.g. certificates protecting software against unauthorised usage in a vending or licensing environment G06F21/10
• CPC Class Codes: H04N 21/83555 using a structured language for describing usage rules of the content, e.g. REL

Abstract

A hierarchical security policy that can be imposed by a policy maker upon a class of entities in an interactive television environment. A general policy is defined for a class of entities. A specific policy may also be defined for any subclass of entities, such as the grouping of advertisements or programs. A specific policy may be defined for any given entity, such as a specific television program as an exception to a class.

Claims

1. A method for specifying a security policy, said method comprising:

transmitting a hierarchical security program object (HSPO) comprising at least a first class of security attributes;

determining that a first entity corresponds to said class;

determining from the HSPO a set of security attributes for the entity;

assigning the set of security attributes to the entity; and

enforcing the set of security attributes on the entity.

2. The method as recited in claim 1 wherein the HSPO is transmitted from a head-end to a client device.

3. The method as recited in claim 1 wherein said HSPO is downloaded to a client device via a computer network.

4. The method as recited in claim 1 wherein the HSPO is received in a client device, and wherein the method further comprises programming a default HSPO into the client device.

5. The method as recited in claim 1 wherein the HSPO defines a second class of security attributes, said second class being a parent class of the first class, and wherein the set of security attributes comprises a union of the first class of security attributes and the second class of security attributes.

6. The method as recited in claim 5, wherein the first class comprises an advertisement class and the second class comprises a network class.

7. The method as recited in claim 5, wherein the classes are defined by a security policy maker associated with a source of the HSPO.

8. The method as recited in claim 5, wherein the HSPO classes are defined by a security policy maker located in a client device which receives the transmitted HSPO.

9. A computer readable medium comprising program instructions, wherein the program instructions are executable to:

transmit a hierarchical security program object (HSPO) comprising at least a first class of security attributes;

determine that a first entity corresponds to said class;

determine from the HSPO a set of security attributes for the entity;

assign the set of security attributes to the entity; and

enforce the set of security attributes on the entity.

10. The computer readable medium as recited in claim 9, wherein the HSPO is transmitted from a head-end to a client device.

11. The computer readable medium as recited in claim 9, wherein said HSPO is downloaded to a client device via a computer network.

12. The computer readable medium as recited in claim 9, wherein the HSPO is received in a client device, and wherein the program instructions are further executable to program a default HSPO into the client device.

13. The computer readable medium as recited in claim 9, wherein the HSPO defines a second class of security attributes, said second class being a parent class of the first class, and wherein the set of security attributes comprises a union of the first class of security attributes and the second class of security attributes.

14. The computer readable medium as recited in claim 13, wherein the first class comprises an advertisement class and the second class comprises a network class.

15. The computer readable medium as recited in claim 13, wherein the classes are defined by a security policy maker associated with a source of the HSPO.

16. The computer readable medium as recited in claim 13, wherein the HSPO classes are defined by a security policy maker located in a client device which receives the transmitted HSPO.

17. A system comprising:

a server configured to transmit a hierarchical security program object (HSPO) comprising at least a first class of security attributes; and

a client device coupled to receive the HSPO, wherein the client device is configured to;

determine that a first entity corresponds to said class;

determine from the HSPO a set of security attributes for the entity;

assign the set of security attributes to the entity; and

enforce the set of security attributes on the entity.

18. The system as recited in claim 17, wherein said client device includes a storage configured to store a default HSPO.

19. The system as recited in claim 17, wherein the HSPO defines a second class of security attributes, said second class being a parent class of the first class, and wherein the set of security attributes comprises a union of the first class of security attributes and the second class of security attributes.

20. The system as recited in claim 17, wherein the security attributes are defined by a policy maker within either the server or the client device.

21. A device comprising:

a receiver configured to receive a hierarchical security program object (HSPO) comprising at least a first class of security attributes; and

storage configured to store the HSPO;

wherein the device is configured to;

determine that a first entity corresponds to said class;

determine from the HSPO a set of security attributes for the entity;

assign the set of security attributes to the entity; and

enforce the set of security attributes on the entity.

22. The device as recited in claim 21, wherein the HSPO is transmitted from a head-end.

23. The device as recited in claim 21, wherein the HSPO is received via a computer network.

24. The device as recited in claim 21, wherein the HSPO defines a second class of security attributes, said second class being a parent class of the first class, and wherein the set of security attributes comprises a union of the first class of security attributes and the second class of security attributes.

25. The device as recited in claim 24, wherein the first class comprises an advertisement class and the second class comprises a network class.