Set Top Box Architecture Supporting Mixed Secure and Unsecure Media Pathways

• US 20140115330A1
• Filed: 12/17/2012
• Published: 04/24/2014
• Est. Priority Date: 10/18/2012
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Chen, Xuemin (Sherman)
• Granted Patent: US 9,049,208 B2
• Time in Patent Office: Days
• US Class Current: 713/166
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04N 21/443 OS processes, e.g. booting an STB, implementing a Java virtual machine in an STB or power management in an STB
• CPC Class Codes: H04N 21/4627 Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/8166 involving executable data, e.g. software arrangements for executing specific programs G06F9/44; broadcasting computer programmes in broadcast systems H04H20/91; involving the movement of software or configuration parameters H04L67/34

Abstract

A media processing device, such as a set top box, having a plurality of selectable hardware and software components for supporting multiple media pathways providing differing levels of security. In general, each security level corresponds to a particular certification service boundary definition(s) or key/authentication and security management scheme for managing resources such as hardware acceleration blocks and software interfaces. Different sets of components may be adaptively employed to ensure composited compliance with one or more security constraints and to address component unavailability. Security constraints may be applied, for example, on a source or media specific basis, and different versions of a media item may be provided over multiple pathways providing corresponding levels of security. In one embodiment, a service operator or content provider may provide requisite certification or security requirements, or otherwise assist in selection of pathway components.

Claims

1. A method for supporting secure and unsecure media pathways options in a media processing device having a plurality of selectable pathway components, the method comprising:

ascertaining a first desired level of security relating to a media item or content provider;

establishing a first media pathway utilizing a first set of selectable pathway components, the first media pathway conforming to the first desired level of security;

ascertaining a second desired level of security relating to a media item or content provider; and

establishing a second media pathway utilizing a second set of selectable pathway components, the second media pathway conforming to the second desired level of security.

2. The method of claim 1, further comprising:

performing media processing operations over at least one of the first or second pathways.

3. The method of claim 1, further comprising:

performing media processing operations on a media item over the first media pathway;

terminating the media processing operations over the first media pathway; and

resuming the media processing operations over the second media pathway.

4. The method of claim 3, the step of resuming the media processing operations performed on a second version of the media item.

5. The method of claim 4, wherein the second version of the media item comprises a version of the media item having at least one different quality characteristic.

6. The method of claim 5, the first security level relating to a media item provided by an external source and the second security level relating to a version of the media item generated by the media processing device.

7. The method of claim 1, further comprising:

performing media processing operations on a first media item over the first media pathway;

terminating the media processing operations over the first media pathway;

dynamically establishing a third media pathway utilizing a third set of selectable pathway components, the third media pathway conforming to the first desired level of security; and

resuming the terminated media processing operations over the third media pathway.

8. The method of claim 1, the step of ascertaining a first desired level of security performed, at least in part, by a service operator or content provider, further comprising:

prior to selecting the first set of the selectable pathway components, providing an indication of available pathway components to the service operator or content provider.

9. The method of claim 1, the first or second desired level of security corresponding to requirements of a conditional access or digital rights management system utilized by a service operator.

10. The method of claim 1, the first or second desired level of security corresponding to a certification requirement for processing and delivery operations involving a particular media item or class of media items.

11. The method of claim 1, wherein the first or second media pathway comprises an upstream portion including a content provider, a middle portion including the media processing device, and a downstream portion including a content recipient, wherein at least one of the pathway portions provides a first level of security and at least one of the pathway portions provides a second, less secure level of security.

12. The method of claim 1, wherein the plurality of selectable pathway components comprises a plurality of hardware acceleration functions.

13. A method for establishing pathways of varying security levels in a media processing device such as a set top box having a plurality of selectable pathway components relating to operational nodes of the pathways, the method comprising:

establishing a first media pathway utilizing a first set of selectable pathway components, the first media pathway conforming to a first level of security;

establishing a second media pathway utilizing a second set of selectable pathway components, the second media pathway conforming to a second level of security;

performing media processing operations over the first media pathway;

terminating the media processing operations over the first media pathway;

dynamically establishing a third media pathway utilizing a third set of selectable pathway components, the third media pathway conforming to a level of security derived from the first level of security; and

resuming the terminated media processing operations over the third media pathway.

14. The method of claim 13, the plurality of selectable pathway components including hardware acceleration functions selected from the group consisting of:

video encoding, video decoding, rendering of graphics, digital rights management, encryption, and decryption.

15. The method of claim 13, the first level of security corresponding to requirements of a conditional access or digital rights management system utilized by a service operator.

16. A media processing device, comprising:

processing circuitry;

an operating system executed by the processing circuitry, the operating system configured to establish at least one privileged operating system environment and at least one restricted operating system environment; and

a plurality of selectable pathway components comprising components controlled or executed by the at least one privileged operating system environment and components controlled or executed by the at least one restricted operating system environment; and

a security and key management support system operable to;

establish a first media pathway utilizing a first set of selectable pathway components, the first media pathway conforming to a first level of security; and

establish a second media pathway utilizing a second set of selectable pathway components, the second media pathway conforming to a second level of security.

17. The media processing device of claim 16, wherein the components controlled or executed by the at least one privileged operating system comprise a plurality of hardware acceleration functions.

18. The media processing device of claim 16, wherein the components controlled or executed by the at least one restricted operating system environment comprises an untrusted software framework.

19. The media processing device of claim 16, the security and key management support system further operable to exchange pathway configuration information with a service operator or content provider.

20. The media processing device of claim 16, the first media pathway compliant with a certification or conditional access system utilized by a service operator affiliated with the media processing device.