Object and Resource Security System

• US 20130104199A1
• Filed: 12/13/2012
• Published: 04/25/2013
• Est. Priority Date: 10/08/1999
• Status: Active Grant

• Current Assignee: Google Technology Holdings LLC (Alphabet Inc.)
• Original Assignee: General Instrument Corporation (CommScope Holding Company, Inc.)
• Inventors: Sprunk, Eric J.
• Granted Patent: US 8,904,424 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04N 2005/91364 the video signal being scrambled
• CPC Class Codes: H04N 21/23476 by partially encrypting, e.g. encrypting the ending portion of a movie
• CPC Class Codes: H04N 21/2541 Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/4117 for generating hard copies of the content, e.g. printer, electronic paper interfaces to printers G06F3/12; printing data G06K15/02
• CPC Class Codes: H04N 21/435 Processing of additional data, e.g. decrypting of additional data, reconstructing software from modules extracted from the transport stream
• CPC Class Codes: H04N 21/4424 Monitoring of the internal components or processes of the client device, e.g. CPU or memory load, processing speed, timer, counter or percentage of the hard disk space used error monitoring in general G06F11/30; arrangements for monitoring conditions of receiving stations in broadcast systems H04H60/32; diagnosis, testing or measuring for television receivers H04N17/04
• CPC Class Codes: H04N 21/4623 Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/8166 involving executable data, e.g. software arrangements for executing specific programs G06F9/44; broadcasting computer programmes in broadcast systems H04H20/91; involving the movement of software or configuration parameters H04L67/34
• CPC Class Codes: H04N 21/835 Generation of protective data, e.g. certificates protecting software against unauthorised usage in a vending or licensing environment G06F21/10
• CPC Class Codes: H04N 21/8355 involving usage data, e.g. number of copies or viewings allowed
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

According to the invention, a method for securing a plaintext object within a content receiver is disclosed. In one step, a secure portion of a secure object and a plaintext remainder of the secure object are received. Which portion of the secure object is the secure portion is determined. The secure portion is decrypted to provide a plaintext portion. The plaintext object that comprises the plaintext portion and the plaintext remainder is formed. The plaintext object is stored including authentication and authorization.

Claims

1-23. -23. (canceled)

24. A method for authenticating and authorizing a specific portion of broadcast content within a broadcast network configured for security-protected content distribution, the method comprising:

receiving the specific portion of broadcast content with a receiver that is one of a plurality of receivers adapted to receive content via the broadcast network, wherein the specific portion of broadcast content is broadcast to and received by each receiver within the plurality of receivers, further wherein the specific portion includes a first portion including an object intended for the receiver and a second portion comprising an authorization message data portion, the authorization message data portion including a metadata related to the object;

authenticating the specific portion of broadcast content wherein the authenticating comprises;

calculating a digital signature code both from object data comprising the object and from authentication data comprising a first portion of the authorization message data portion, wherein the first portion of the authorization message data portion includes the metadata;

comparing the digital signature code to a predetermined digital signature code received in the specific portion of the broadcast content, wherein the predetermined digital signature code is not included in the first portion of the authorization message data portion, and wherein a second portion of the authorization message data portion comprises the predetermined digital signature code; and

determining, based on the comparing of the digital signature code to the predetermined digital signature code, whether the specific portion of the broadcast content is from a trusted source;

based on the authenticating, authorizing the specific portion of broadcast content for use by the receiver; and

running a process that checks authorization for the receiver to use the received specific portion of broadcast content.

25. The method for authenticating and authorizing a specific portion of broadcast content of claim 24, further comprising:

detecting an event that triggers authorization of the receiver to use the received specific portion of broadcast content.

26. The method for authenticating and authorizing a specific portion of broadcast content of claim 25, wherein the event is at least one of:

an unpredictable period;

or

a predetermined period measured relative to loading the received specific portion of broadcast content.

27. The method for authenticating and authorizing a specific portion of broadcast content of claim 24, wherein authenticating the specific portion of broadcast content comprises decryption of at least a segment of the specific portion of broadcast content.

28. The method for authenticating and authorizing a specific portion of broadcast content of claim 24, wherein the specific portion of broadcast content comprises at least one of software, drivers, firmware, video, audio, and data.

29. The method for authenticating and authorizing a specific portion of broadcast content of claim 24, further comprising:

receiving first authorization information; and

receiving second authorization information that replaces the first authorization information so as to extend authorization rights.

30. The method for authenticating and authorizing a specific portion of broadcast content of claim 24, wherein the broadcast network configured for security-protected content distribution comprises a conditional access content distribution network.

31. The method for authenticating and authorizing a specific portion of broadcast content of claim 24, wherein the broadcast network configured for security-protected content distribution comprises a broadcast network selected from the group consisting of a conditional access content distribution network, a digital satellite network, a packet-switched network, a digital cellular data network, a digital telephone network, and the Internet.

32. The method for authenticating and authorizing a specific portion of broadcast content of claim 24, wherein the second portion comprises an authorization message, the authorization message comprising at least the authorization message data portion.

33. The method for authenticating and authorizing a specific portion of broadcast content of claim 24, wherein the broadcast content comprises content having authorization rights associated with a purchase by a user of the receiver.

34. The method for authenticating and authorizing a specific portion of broadcast content of claim 24, wherein the broadcast content is digital rights protected broadcast content.

35. At least one non-transitory computer-readable storage medium comprising stored instructions for authenticating and authorizing a specific portion of broadcast content within a broadcast network configured for security-protected content distribution, wherein the instructions, when executed by one or more processors, cause the one or more processors to perform the method of claim 24.

36. A method for authenticating and authorizing a specific portion of digital rights protected broadcast content within a broadcast network, the method comprising:

receiving the specific portion of digital rights protected broadcast content with a receiver that is one of a plurality of receivers adapted to receive content via the broadcast network, wherein the specific portion of digital rights protected broadcast content is broadcast to and received by each receiver within the plurality of receivers, further wherein the specific portion includes a first portion including an object intended for the receiver and a second portion comprising an authorization message data portion, the authorization message data portion including a metadata related to the object;

authenticating the specific portion of digital rights protected broadcast content wherein the authenticating comprises;

calculating a digital signature code both from object data comprising the object and from authentication data comprising a first portion of the authorization message data portion, wherein the first portion of the authorization message data portion includes the metadata;

comparing the digital signature code to a predetermined digital signature code received in the specific portion of the digital rights protected broadcast content, wherein the predetermined digital signature code is not included in the first portion of the authorization message data portion, and wherein a second portion of the authorization message data portion comprises the predetermined digital signature code; and

determining, based on the comparing of the digital signature code to the predetermined digital signature code, whether the specific portion of the digital rights protected broadcast content is from a trusted source;

based on the authenticating, authorizing the specific portion of digital rights protected broadcast content for use by the receiver; and

running a process that checks authorization for the receiver to use the received specific portion of digital rights protected broadcast content.

37. The method for authenticating and authorizing a specific portion of digital rights protected broadcast content of claim 36, further comprising:

detecting an event that triggers authorization of the receiver to use the received specific portion of digital rights protected broadcast content.

38. The method for authenticating and authorizing a specific portion of digital rights protected broadcast content of claim 37, wherein the event is at least one of:

an unpredictable period;

or

a predetermined period measured relative to loading the received specific portion of digital rights protected broadcast content.

39. The method for authenticating and authorizing a specific portion of digital rights protected broadcast content of claim 36, wherein authenticating the specific portion of digital rights protected broadcast content comprises decryption of at least a segment of the specific portion of digital rights protected broadcast content.

40. The method for authenticating and authorizing a specific portion of digital rights protected broadcast content of claim 36, wherein the specific portion of digital rights protected broadcast content comprises at least one of software, drivers, firmware, video, audio, and data.

41. The method for authenticating and authorizing a specific portion of digital rights protected broadcast content of claim 36, further comprising:

receiving first authorization information; and

receiving second authorization information that replaces the first authorization information so as to extend authorization rights.

42. The method for authenticating and authorizing a specific portion of digital rights protected broadcast content of claim 36, wherein the broadcast network configured for security-protected content distribution comprises a conditional access content distribution network.

43. The method for authenticating and authorizing a specific portion of digital rights protected broadcast content of claim 36, wherein the broadcast network configured for security-protected content distribution comprises a broadcast network selected from the group consisting of a conditional access content distribution network, a digital satellite network, a packet-switched network, a digital cellular data network, a digital telephone network, and the Internet.

44. The method for authenticating and authorizing a specific portion of digital rights protected broadcast content of claim 36, wherein the second portion comprises an authorization message, the authorization message comprising at least the authorization message data portion.

45. At least one non-transitory computer-readable storage medium comprising stored instructions for authenticating and authorizing a specific portion of digital rights protected broadcast content within a broadcast network configured for security-protected content distribution, wherein the instructions, when executed by one or more processors, cause the one or more processors to perform the method of claim 36.