Reconfigurable Access Network Encryption Architecture

• US 20140108782A1
• Filed: 12/07/2010
• Published: 04/17/2014
• Est. Priority Date: 12/07/2010
• Status: Active Grant

• Current Assignee: Comcast Cable Communications LLC (Comcast Corporation)
• Original Assignee: Comcast Cable Communications LLC (Comcast Corporation)
• Inventors: Salinger, Jorge Daniel, Taylor, Kevin, Fahrny, James William
• Granted Patent: US 9,104,882 B2
• Time in Patent Office: Days
• US Class Current: 713/155
• CPC Class Codes: G06F 21/1062 Editing
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: H04L 63/0457 wherein the sending and receiving network entities apply dynamic encryption, e.g. stream encryption cryptographic mechanisms or cryptographic arrangements for stream encryption H04L9/065
• CPC Class Codes: H04N 21/226 Characteristics of the server or Internal components of the server
• CPC Class Codes: H04N 21/26606 for generating or managing entitlement messages, e.g. Entitlement Control Message [ECM] or Entitlement Management Message [EMM] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/631 Multimode Transmission, e.g. transmitting basic layers and enhancement layers of the content over different transmission paths or transmitting with different error corrections, different keys or with different transmission protocols

Abstract

An access platform or other network elements can include multiple line cards configured to encrypt data. The platform and/or each of the line cards may receive encryption management data that conforms to a predefined encryption management data interface. The encryption management data received by a particular line card may be generated by a conditional access system device and converted to conform to the encryption management data interface by an encryption manager. Line cards may alternatively be configured for connection to separate encryption hardware components. Line cards may include a block of field programmable gate arrays or other type of programmable hardware that can be configured to execute an encryption module.

Claims

1. A method comprising:

receiving, at an access network, a first set of encryption management data for an encryption management data interface, the encryption management data interface defining a format for communication of encryption management data;

encrypting a first set of content data in accordance with the first set of encryption management data using a first encryption module;

receiving, at the access network, a second set of encryption management data for the encryption management data interface; and

encrypting a second set of content data, in accordance with the second set of encryption management data using a second encryption module, wherein the second encryption module is different from the first encryption module.

2. The method of claim 1, further comprising:

transmitting the first set of encryption management data in a first format from a first conditional access device; and

converting the first set of encryption management data from the first format to conform to the encryption management data interface.

3. The method of claim 2, further comprising:

transmitting the second set of encryption management data in a second format from a second conditional access device; and

converting the second set of encryption management data from the second format to conform to the encryption management data interface.

4. The method of claim 1, wherein

each of the first and second encryption modules encrypts content data using encryption control data received outside of the encryption management data interface, and

the encryption control data includes at least one of keys and entitlement messages.

5. The method of claim 1, wherein the access network platform includes a plurality of line cards over which content data is forwarded to end devices in the access network, and wherein each of the first and second encryption modules executes on a first line card.

6. The method of claim 5, further comprising:

removing the first encryption module from the first line card; and

installing the second encryption module on the first line card.

7. The method of claim 5, wherein the access network is a hybrid fiber coaxial access network and wherein at least one of the plurality of line cards also modulates a downstream transmission signal with the content data.

8. The method of claim 1, wherein the access network platform includes a plurality of line cards over which content data is forwarded to end devices in the access network, wherein the first encryption module executes on a first line card, and wherein the second encryption module executes on a second line card.

9. The method of claim 1, further comprising, prior to said encrypting the first set of content data:

receiving the first set of content data in encrypted form; and

decrypting the first set of content data.

10. An apparatus comprising:

at least one processor;

at least one memory; and

a first line card, the apparatus configured to perform operations that include

receiving a first set of encryption management data for an encryption management data interface, the encryption management data interface defining a format for communication of encryption management data,

encrypting a first set of content data, in accordance with the first set of encryption management data, using a first encryption module,

receiving a second set of encryption management data for the encryption management data interface, and

encrypting a second set of content data, in accordance with the second set of encryption management data, using a second encryption module, wherein the second encryption module is different from the first encryption module.

11. The apparatus of claim 10, wherein the apparatus is part of a system that comprises:

a first conditional access device configured to transmit the first set of encryption management data in a first format; and

a first encryption manager configured to convert the first set of encryption management data from the first format to conform to the encryption management data interface.

12. The apparatus of claim 11, wherein the system comprises:

a second conditional access device configured to transmit the second set of encryption management data in a second format; and

a second encryption manager configured to convert the second set of encryption management data from the second format to conform to the encryption management data interface.

13. The apparatus of claim 10, wherein

each of the first and second encryption modules encrypts content data using encryption control data received outside of the encryption management data interface, and

the encryption control data includes at least one of keys and entitlement messages.

14. The apparatus of claim 10, wherein each of the first and second encryption modules executes on the first line card.

15. The apparatus of claim 14, wherein the first line card is configured for removal of the first encryption module and installation of the second encryption module.

16. The apparatus of claim 10, wherein the apparatus includes a second line card, and wherein the second encryption module executes on the second line card.

17. A method comprising:

transferring first content data, within an access network platform of an access network, to a first encryption module across a data interface, the data interface defining a format for transfer of unencrypted data and for receipt of said transferred first content data after encryption;

receiving, across the data interface, the first content data encrypted by the first encryption module;

forwarding the encrypted first content data from the access network platform to end devices in the access network;

transferring second content data within the access network platform across the data interface to a second encryption module, the second encryption module being different from the first encryption module; and

receiving encrypted second content data across the data interface, wherein the encrypted second content data is encrypted by the second encryption module.

18. The method of claim 17, wherein transferring first content data comprises transferring first content data to a first encryption hardware component from a line card, transferring second content data comprises transferring second content data to a second encryption hardware component from the line card, and receiving encrypted second content data comprises receiving encrypted second content data from the second encryption hardware component, and further comprising:

replacing the first encryption hardware component with the second encryption hardware component.

19. The method of claim 17, wherein transferring first content data comprises transferring first content data to a first encryption hardware component from a first line card, receiving encrypted first content data comprises receiving encrypted first content data from the first encryption hardware component at the first line card, transferring second content data comprises transferring second content data to a second encryption hardware component from a second line card, and receiving encrypted second content data comprises receiving encrypted second content data from the second encryption hardware component at the second line card.

20. The method of claim 17, wherein each of the first and second encryption modules encrypts content data and forwards entitlement messages.

21. The method of claim 17, wherein transferring first content data comprises transferring first content data to a programmable hardware block of a first line card, and receiving encrypted first content data comprises receiving encrypted first content data from the programmable hardware block.