Method and apparatus for controlling paired operation of a conditional access module and an integrated receiver and decoder

• US 20050005120A1
• Filed: 09/20/2002
• Published: 01/06/2005
• Est. Priority Date: 09/21/2001
• Status: Active Grant

• Current Assignee: DIRECTV, LLC (AT&T, Inc.)
• Original Assignee: The DIRECTV Group, Inc. (AT&T, Inc.)
• Inventors: Levy, Jordan, Kahn, Raynold
• Granted Patent: US 7,797,552 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: H04N 21/26613 for generating or managing keys in general key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04
• CPC Class Codes: H04N 21/4181 for conditional access
• CPC Class Codes: H04N 21/4367 Establishing a secure communication between the client and a peripheral device or smart card
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/4623 Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/47211 for requesting pay-per-view content payment schemes payment architectures or payment protocols G06Q20/00, G07F
• CPC Class Codes: H04N 21/6143 involving transmission via a satellite
• CPC Class Codes: H04N 21/6187 involving transmission via a telephone network, e.g. POTS
• CPC Class Codes: H04N 7/163 by receiver means only
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

A method and apparatus that selectively pairs a receiver (132) configured to receive a media program encrypted according to a media encryption key and a conditional access module. In one embodiment, the apparatus comprises a security module (508) for receiving and modifying the media encryption key, and a transport module (412), comprising a decryptor (524) for decrypting the media program. The media encryption key has a portion indicating a first state in which the media program is to be viewable by a set of receivers or a second state in which the media program is to be viewable only by a subset of the set of receivers.

Claims

1. A method of selectively pairing a receiver configured to receive a media program encrypted according to a media encryption key and a conditional access module, comprising the steps of:

receiving a media program encrypted by either a media encryption key or a modified media encryption key;

receiving the media encryption key, the media encryption key having a portion indicating a first state in which the media program is to be viewable by a set of receivers or a second state in which the media program is to be viewable only by a subset of the set of receivers, decrypting the media program according to the media encryption key if the portion indicates the first state; and

modifying the media encryption key to produce the modified media encryption key and decrypting the media program according to the modified media encryption key if the portion indicates the second state.

2. The method of claim 1, wherein each of the receivers in the set of receivers is paired with an associated conditional access module according to any of a plurality of pairing keys and each of the receivers in the subset of the set of receivers is paired according to any pairing key of a subset of the plurality of pairing keys.

3. The method of claim 2, wherein:

the received media encryption key is encrypted by a pairing key;

the method further comprises the step of decrypting the media encryption key according to the pairing key to produce a decrypted pairing key;

the step of decrypting the media program according to the media encryption key if the portion indicates the first state comprises the step of decrypting the media program according to the decrypted media encryption key if the portion indicates the first state; and

the step of modifying the media encryption key to produce the modified media encryption key and decrypting the media program according to the modified media encryption key if the portion indicates the second state comprises the step of modifying the decrypted media encryption key to produce the modified media encryption key and decrypting the media program according to the modified media encryption key if the portion indicates the second state.

4. The method of claim 3, wherein the pairing portion is a flag.

5. The method of claim 3, wherein the pairing key comprises a pairing epoch and a pairing mask, and the step of modifying the decrypted media encryption key comprises the step of:

replacing at least a portion of the media encryption key with the pairing epoch, wherein the portion of the media encryption key to be replaced by the pairing epoch is defined by the pairing mask.

6. The method of claim 3, further comprising the steps of:

receiving the pairing key encrypted according to an I/O indecipherable algorithm;

decrypting the pairing key according to the I/O indecipherable algorithm;

storing the pairing key in the conditional access module; and

securely transmitting the pairing key in the receiver.

7. The method of claim 5, further comprising the steps of:

receiving a second pairing key, the second pairing key having an incremented pairing epoch; and

replacing at least a portion of the media encryption key with the second pairing epoch.

8. The method of claim 7, wherein the second pairing key further comprises a second pairing mask, and the portion of the media encryption key to be replaced with the incremented pairing epoch is defined according to the second pairing mask.

9. The method of claim 4, wherein:

the media encryption key is received in a security module;

the media program is decrypted in a transport module having a memory cache; and

the decrypted media encryption key is provided from the security module to the transport module only by direct memory access the memory cache.

10. The method of claim 1, wherein each of the receivers in the subset of the set of receivers is paired with an associated conditional access module.

11. The method of claim 10, wherein the step of modifying the media encryption key to produce the modified media encryption key and decrypting the media program according to the modified media encryption key if the portion indicates the second state comprises the step of modifying the portion of the media encryption key to equal the first state to produce the modified media encryption key and decrypting the media program according to the modified media encryption key if the portion indicates the second state.

12. The method of claim 11, wherein the portion of the media decryption key is a flag.

13. The method of claim 12, wherein:

the media encryption key is received in a security module;

the media program is decrypted in a transport module having a memory cache; and

the media encryption key is provided from the security module to the transport module only by direct memory access the memory cache.

14. A method of selectively pairing a receiver configured to receive a media program encrypted according to a media encryption key and a conditional access module, comprising the steps of:

transmitting a media encryption key, the media encryption key having a pairing portion indicating a first state in which the media program is to be viewable by a set of receivers or a second state in which the media program is to be viewable only by a subset of the set of receivers; and

transmitting a media program encrypted according to the media encryption key.

15. The method of claim 14, wherein each of the receivers in the set of receivers is paired with an associated conditional access module according to any of a plurality of pairing keys, and each of the subset of the set of receivers is paired according to any pairing key of a subset of the plurality of pairing keys.

16. The method of claim 15, further comprising the step of:

transmitting a pairing key encrypted according to an I/O indecipherable algorithm implemented in the conditional access module.

17. The method of claim 16, wherein the pairing portion is a pairing flag.

18. The method of claim 16, wherein:

the pairing key is transmitted the conditional access module and to the receiver via the conditional access module; and

the media encryption key is transmitted to the receiver via the conditional access module.

19. The method of claim 16, wherein:

the first state commands the receiver to decrypt the media program according to the media encryption key; and

the second state commands the receiver to modify the decrypted media encryption key and decrypt the media program according to a modified media encryption key.

20. The method of claim 19, wherein:

the pairing key comprises a pairing epoch and a pairing mask; and

the second state commands the receiver to modify the decrypted media encryption key by replacing at least a portion of the media encryption key with the pairing epoch, wherein the portion of the media encryption key to be replaced by the pairing epoch is defined by the pairing mask.

21. The method of claim 20, further comprising the steps of:

transmitting a second pairing key having an incremented pairing epoch.

22. The method of claim 20, wherein the second pairing key further comprises a second pairing mask, and the portion of the media encryption key to be replaced with the incremented pairing epoch is defined according to the second pairing mask.

23. The method of claim 14, wherein each of the receivers in the subset of the set of receivers is paired with an associated conditional access module.

24. The method of claim 23, wherein:

the first state commands the receiver to decrypt the media program according to the media encryption key; and

the second state commands the receiver to modify the decrypted media encryption key and decrypt the media program according to a modified media encryption key.

25. The method of claim 24, wherein:

the media encryption key is modified by setting the pairing portion of the media encryption key to the first state; and

the media program is decrypted according to the modified media encryption key if the pairing portion indicates the second state.

26. The method of claim 25, wherein the pairing portion of the media decryption key is a flag.

27. The method of claim 26, wherein:

the media encryption key is received in a security module;

the media program is decrypted in a transport module having a memory cache; and

the media encryption key is provided from the security module to the transport module only by direct memory access to the memory cache.

28. An apparatus for selectively pairing a receiver configured to receive a media program encrypted according to a media encryption key and a conditional access module, comprising:

means for receiving a media program encrypted by either a media encryption key or a modified media encryption key;

means for receiving the media encryption key, the media encryption key having a portion indicating a first state in which the media program is to be viewable by a set of receivers or a second state in which the media program is to be viewable only by a subset of the set of receivers;

means for decrypting the media program according to the media encryption key if the portion indicates the first state; and

means for modifying the media encryption key to produce the modified media encryption key and decrypting the media program according to the modified media encryption key if the portion indicates the second state.

29. The apparatus of-claim 28, wherein each of the receivers in the set of receivers is paired with an associated conditional access module according to any of a plurality of pairing keys and each of the receivers in the subset of the set of receivers is paired according to any pairing key of a subset of the plurality of pairing keys.

30. The apparatus of claim 29, wherein:

the received media encryption key is encrypted by a pairing key;

the apparatus comprises means for decrypting the media encryption key according to the pairing key to produce a decrypted pairing key;

the means for decrypting the media program according to the media encryption key if the portion indicates the first state comprises means for decrypting the media program according to the decrypted media encryption key if the portion indicates the first state; and

the means for modifying the media encryption key to produce the modified media encryption key and decrypting the media program according to the modified media encryption key if the portion indicates the second state comprises means for modifying the decrypted media encryption key to produce the modified media encryption key and decrypting the media program according to the modified media encryption key if the portion indicates the second state.

31. The apparatus of claim 30, wherein the pairing portion is a flag.

32. The apparatus of claim 30, wherein the pairing key comprises a pairing epoch and a pairing mask, and the means for modifying the decrypted media encryption key comprises:

means for replacing at least a portion of the media encryption key with the pairing epoch, wherein the portion of the media encryption key to be replaced by the pairing epoch is defined by the pairing mask.

33. The apparatus of claim 30, further comprising:

means for receiving the pairing key encrypted according to an I/O indecipherable algorithm;

means for decrypting the pairing key according to the I/O indecipherable algorithm;

means for storing the pairing key in the conditional access module; and

means for securely transmitting the pairing key in the receiver.

34. The apparatus of claim 32, further comprising:

means for receiving a second pairing key, the second pairing key having an incremented pairing epoch; and

means for replacing at least a portion of the media encryption key with the second pairing epoch.

35. The apparatus of claim 34, wherein the second pairing key further comprises a second pairing mask, and the portion of the media encryption key to be replaced with the incremented pairing epoch is defined according to the second pairing mask.

36. The apparatus of claim 32, wherein:

the media encryption key is received in a security module;

the media program is decrypted in a transport module having a memory cache; and

the decrypted media encryption key is provided from the security module to the transport module only by direct memory access the memory cache.

37. The apparatus of claim 28, wherein each of the receivers in the subset of the set of receivers is paired with an associated conditional access module.

38. The apparatus of claim 37, wherein the means for modifying the media encryption key to produce the modified media encryption key and decrypting the media program according to the modified media encryption key if the portion indicates the second state comprises means for modifying the portion of the media encryption key to equal the first state to produce the modified media encryption key and decrypting the media program according to the modified media encryption key if the portion indicates the second state.

39. The apparatus of claim 38, wherein the portion if the media decryption key is a flag.

40. The apparatus of claim 39, wherein:

the media encryption key is received in a security module;

the media program is decrypted in a transport module having a memory cache; and

the decrypted media encryption key is provided from the security module to the transport module only by direct memory access the memory cache.

41. An apparatus for selectively pairing a receiver configured to receive a media program encrypted according to a media encryption key and a conditional access module, comprising:

means for transmitting a media encryption key, the media encryption key having a pairing portion indicating a first state in which the media program is to be viewable by all receivers or a second state in which the media program is to be viewable only by receivers paired with the conditional access module; and

means for transmitting a media program encrypted according to the media encryption key.

42. The apparatus of claim 41, further comprising:

means for transmitting a pairing key encrypted according to an I/O indecipherable algorithm implemented in the conditional access module.

43. The apparatus of claim 42, wherein the pairing portion is a pairing flag.

44. The apparatus of claim 42, wherein:

the pairing key is transmitted the conditional access module and to the receiver via the conditional access module; and

the media encryption key is transmitted to the receiver via the conditional access module.

45. The apparatus of claim 42, wherein:

the first state commands the receiver to decrypt the media program according to the media encryption key; and

the second state commands the receiver to modify the decrypted media encryption key and decrypt the media program according to a modified media encryption key.

46. The apparatus of claim 45, wherein:

the pairing key comprises a pairing epoch and a pairing mask; and

the second state commands the receiver to modify the decrypted media encryption key by replacing at least a portion of the media encryption key with the pairing epoch, wherein the portion of the media encryption key to be replaced by the pairing epoch is defined by the pairing mask.

47. The apparatus of claim 46, further comprising:

means for transmitting a second pairing key having an incremented pairing epoch.

48. The method of claim 46, wherein the second pairing key further comprises a second pairing mask, and the portion of the media encryption key to be replaced with the incremented pairing epoch is defined according to the second pairing mask.

49. An apparatus for selectively pairing a receiver configured to receive a media program encrypted according to a media encryption key and a conditional access module, comprising:

a security module, for receiving a media encryption key from the conditional access module, wherein the media encryption key has a pairing portion indicating a first state in which the media program is to be viewable by a set of receivers or a second state in which the media program is to be viewable only by a subset of the set of receivers, the security module having;

a module for modifying the media encryption key to produce a modified media encryption key if the pairing portion indicates the second state; and

a transport module, comprising a decryptor for decrypting the media program according to the media encryption key if the pairing portion indicates the first state and for decrypting the media program according to a modified media encryption key if the pairing portion indicates the second state.

50. The apparatus of claim 49, wherein each of the receivers in the set of receivers is paired with an associated conditional access module according to any of a plurality of pairing keys and each of the receivers in the subset of the set of receivers is paired according to any pairing key of a subset of the plurality of pairing keys.

51. The apparatus of claim 50, wherein:

the received media encryption key is encrypted according to a pairing key; and

the security module further comprises a decryptor for decrypting the encrypted media encryption key according to the pairing key.

52. The apparatus of claim 51, wherein the pairing portion is a flag.

53. The apparatus of claim 51, wherein the pairing key comprises a pairing epoch and a pairing mask, and the module for modifying the decrypted media encryption key comprises:

means for replacing at least a portion of the media encryption key with the pairing epoch, wherein the portion of the media encryption key to be replaced by the pairing epoch is defined by the pairing mask.

54. The apparatus of claim 51, further comprising:

a receiver for receiving the pairing key encrypted according to an I/O indecipherable algorithm and for providing the encrypted pairing key to the conditional access module; and

a conditional access module for decrypting the pairing key according to the I/O indecipherable algorithm, for storing the pairing key therein and for transmitting the pairing key to the receiver.

55. The apparatus of claim 53, wherein:

the receiver further receives a second pairing key, the second pairing key having an incremented pairing epoch; and

the security module further replaces at least a portion of the media encryption key with the second pairing epoch.

56. The apparatus of claim 55, wherein the second pairing key further comprises a second pairing mask, and the portion of the media encryption key to be replaced with the incremented pairing epoch is defined according to the second pairing mask.

57. The apparatus of claim 51, wherein:

the transport module includes a memory cache; and

the decrypted media encryption key is provided from the security module to the transport module only by direct memory access the memory cache.

58. The apparatus of claim 49, wherein each of the receivers in the subset of the set of receivers is paired with an associated conditional access module.

59. The apparatus of claim 49, wherein:

the module for modifying the media encryption key comprises means for modifying the pairing portion of the media encryption key to equal the to equal the first state to produce the modified media encryption key; and

the translator module decrypts the media program according to the modified media encryption key if the pairing portion indicates the second state.

60. The apparatus of claim 59, wherein the pairing portion of the media decryption key is a flag.

61. The apparatus of claim 60, wherein:

the transport module includes a memory cache;

the decrypted media encryption key is provided to from the security module to the transport module only by direct memory access to the memory cache.

62. The apparatus of claim 59, wherein each of the receivers in the subset of receivers is paired with an associated conditional access module.

63. The apparatus of claim 62, wherein the media encryption key is modified by so that the pairing portion is equal to the first state, and the decryptor decrypts the media program according to the modified media encryption key if the pairing portion indicates a second state.

64. The apparatus of claim 63, wherein the pairing portion of the media decryption key is a flag.

65. The apparatus of claim 64, wherein:

the transport module includes a memory cache;

the media encryption key is provided from the security module to the transport module only by direct memory access to the memory cache.

66. An apparatus for selectively pairing a receiver configured to receive a media program encrypted according to a media encryption key and a conditional access module, comprising:

a transmitter for transmitting a media encryption key, wherein

the pairing key is encrypted according to an I/O indecipherable algorithm implemented in the conditional access module; and

the media encryption key includes a pairing portion indicating a first state in which the media program is to be viewable by a set of receivers or a second state in which the media program is to be viewable only by a subset of the set of receivers.

67. The apparatus of claim 66, wherein each of the receivers in the set of receivers is paired with an associated conditional access module according to any of a plurality of pairing keys, and each of the receivers in the subset of the set of receivers is paired according to any pairing key of a subset of the plurality of pairing keys.

68. The apparatus of claim 66, wherein the transmitter further transmits a pairing key encrypted according to the I/O indecipherable algorithm.

69. The apparatus of claim 68, wherein the pairing portion is a flag.

70. The apparatus of claim 68, wherein:

the pairing key is transmitted the conditional access module and to the receiver via the conditional access module; and

the media encryption key is transmitted to the receiver via the conditional access module.

71. The apparatus of claim 68, wherein:

the first state commands the receiver to decrypt the media program according to the media encryption key; and

the second state commands the receiver to modify the decrypted media encryption key and decrypt the media program according to the modified media encryption key.

72. The apparatus of claim 71, wherein:

the pairing key comprises a pairing epoch and a pairing mask; and

the second state commands the receiver to modify the decrypted media encryption key by replacing at least a portion of the media encryption key with the pairing epoch, wherein the portion of the media encryption key to be replaced by the pairing epoch is defined by the pairing mask.

73. The apparatus of claim 72, wherein the transmitter further transmits a second pairing key encrypted according to the I/O indecipherable algorithm implemented in the conditional access module, the second pairing key comprising an incremented pairing epoch.

74. The apparatus of claim 73, wherein the second pairing key further comprises a second pairing mask, and the portion of the media encryption key to be replaced with the incremented pairing epoch is defined according to the second pairing mask.

75. The apparatus of claim 66, wherein each of the receivers in the subset of the set of receivers is paired with an associated conditional access module.

76. The apparatus of claim 75, wherein:

the first state commands the receiver to decrypt the media program according to the media encryption key; and

the second state commands the receiver to modify the media encryption key and decrypt the media program according to the modified media encryption key.

77. The apparatus of claim 76, wherein:

the media encryption key is modified by setting the pairing portion of the media encryption key to the first state; and

the media program is decrypted according to the modified media encryption key if the pairing portion indicates the second state.

78. The apparatus of claim 77, wherein the pairing portion of the media.

79. The apparatus of claim 78, wherein:

the media encryption key is received in a security module;

the media program is decrypted in a transport module having a memory cache; and

the media encryption key is provided from the security module to the transport module only by direct memory access to the memory cache.