Conditonal access system

• US 20050022015A1
• Filed: 11/14/2002
• Published: 01/27/2005
• Est. Priority Date: 11/27/2001
• Status: Abandoned Application

• Current Assignee: Koninklijke Philips Electronics N.V. (Koninklijke Philips N.V.)
• Original Assignee: Koninklijke Philips Electronics N.V. (Koninklijke Philips N.V.)
• Inventors: Van Den Heuvel, Sebastiaan A F A, Kamperman, Franciscus Lucas Antonius Johannes, Lenoir, Petrus Johannes
• Application Number:
  US10/496,480
• Publication Number:
  US 20050022015A1
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/1073 Conversion
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: H04L 12/2805 Home Audio Video Interoperability [HAVI] networks
• CPC Class Codes: H04L 12/2834 Switching of information between an external network and a home network access arrangements H04L12/2856
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/133 Protocols for remote procedure calls [RPC]
• CPC Class Codes: H04L 69/08 Protocols for interworking; Protocol conversion

Abstract

A conditional access system comprising a plurality of devices interconnected in a network, the devices being grouped in a first group and a second group, the devices of the first group operating in accordance with a first security framework and the devices of the second group operating in accordance with a second security framework, each device operating using a particular middleware layer, said middleware layer being arranged to authenticate another middleware layer of another device, said middleware layer being authenticated by the security framework in accordance with which the device operates.

Claims

1. A conditional access system comprising a plurality of devices interconnected in a network, the devices being grouped in a first group and a second group, the devices of the first group operating in accordance with a first security framework and the devices of the second group operating in accordance with a second security framework, each device operating using a particular middleware layer, said middleware layer being arranged to authenticate another middleware layer of another device, said middleware layer being authenticated by the security framework in accordance with which the device operates.

2. The system of claim 1, in which a device from the first group can execute a function of the second security framework by making a remote procedure call (RPC) to the middleware layer of a device from the second group

3. The system of claim 2, in which the RPC is transmitted to the device from the second group over a secure authenticated channel (SAC).

4. The system of claim 1, in which the devices are granted permission to access content in accordance with a particular class of purposes, there being defined a set of such classes, each class comprising a number of conditional access operations or purposes.

5. The system of claim 4, in which a first class from the set comprises the operations RENDER, MOVE and COPY.

6. The system of claim 5, in which a second class from the set comprises the operations STORE, RENDER, EDIT, DELETE and PROCESS.

7. The system of claim 6, in which the PROCESS operation is authorized independent of any restrictions on rights associated with the content.

8. A method of allowing a device to conditionally access a piece of content, in which the device is granted permission to access content in accordance with a particular class of purposes, there being defined a set of such classes, each class comprising a number of conditional access operations or purposes.

9. The method of claim 8, in which a first class from the set comprises the operations STORE, RENDER, EDIT, DELETE and PROCESS.

10. The method of claim 9, in which the PROCESS operation is authorized independent of any restrictions on rights associated with the content.