PC Secure Video Path

• US 20140314232A1
• Filed: 03/10/2014
• Published: 10/23/2014
• Est. Priority Date: 03/04/2010
• Status: Active Grant

• Current Assignee: Comcast Cable Communications LLC (Comcast Corporation)
• Original Assignee: Comcast Cable Communications LLC (Comcast Corporation)
• Inventors: Fahrny, James W.
• Granted Patent: US 9,332,320 B2
• Time in Patent Office: Days
• US Class Current: 380/200
• CPC Class Codes: G06F 21/109 by using specially-adapted hardware at the client
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/0827 involving distinctive intermediate devices or communication paths network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04N 21/64715 Protecting content from unauthorized alteration within the network verifying the information received for network security in communication control or processing H04L63/12; integrity in wireless network security H04W12/10

Abstract

A system and method are disclosed for creating a secure video content path, or a protected media content bus, within an unsecure personal computer. A portable security module, or electronic key safe, may be inserted into a personal computer that has different internal components for processing secure and unsecured content. The security module may establish a secure encrypted link with a secure video processor of the personal computer, and may use the personal computer'"'"'s network interface to request authority to receive secured content. The security module may provide content keys to the secure video processor to access secured content received over an external network.

Claims

1. A media method, comprising:

detecting, by a computing device, insertion of a security module and establishing a secure tunnel between the security module and a secure video processor of the computing device;

generating, by the computing device and on behalf of the security module, a key request message comprising an identification of the security module and an identification of a secure video processor of the computing device;

receiving an authentication in response to the key request message and supplying the response to the security module via the secure tunnel; and

using the security module and secure video processor to process secured content for presentation to a user.

2. The method of claim 1, wherein the key request message further comprises an identification of an authentication proxy.

3. The method of claim 1, wherein the authentication is a key response message comprising one or more keys associated with an authentication proxy.

4. The method of claim 3, further comprising:

sending, by the computing device and to the authentication proxy, a client sign-on request identifying the security module.

5. The method of claim 4, wherein the client sign-on request comprises information identifying capabilities of the security module.

6. The method of claim 5, wherein the client sign-on request comprises information identifying one or more software clients of the security module.

7. The method of claim 4, wherein the client sign-on request comprises a hashed version of a signing key or encryption key of the security module.

8. The method of claim 1, further comprising:

receiving a user request for access to secure content; and

in response to the user request,

transmitting a content request message by the computing device;

receiving a response to the content request message and forwarding the response to the security module;

receiving, from the security module in response to the response to the content request message, a content key; and

using the content key to decrypt the secure content.

9. The method of claim 8, further comprising:

routing, by the computing device, encrypted video content to the secure video processor; and

routing unencrypted video content to an unsecure video processor of the computing device, wherein the unsecure video processor is not provided with the content key.

10. The method of claim 1, further comprising:

storing one or more keys in a memory of the security module in response to the authentication; and

deleting the one or more keys from the memory in response to removal of the security module from the computing device.

11. A method comprising:

in response to insertion of a security module into a computing device, the security module establishing a secure tunnel between the security module and a secure video processor of the computing device;

requesting, by the security module, that the computing device transmit a key request message comprising an identification of the security module and an identification of a secure video processor of the computing device;

receiving, by the security module, a response to the key request message;

extracting a control word key from the response; and

transmitting the control word key from the security module to the secure video processor via the secure tunnel.

12. The method of claim 11, further comprising supplying, by the security module, an authentication proxy identification to the secure video processor, and requesting that the authentication proxy identification be transmitted in the key request message.

13. The method of claim 11, further comprising extracting an authentication proxy key from the response.

14. The method of claim 13, further comprising:

sending, by the security module and to the authentication proxy, a client sign-on request identifying the security module.

15. The method of claim 14, wherein the client sign-on request comprises information identifying capabilities of the security module.

16. The method of claim 15, wherein the client sign-on request comprises information identifying one or more software clients of the security module.

17. The method of claim 14, wherein the client sign-on request comprises a hashed version of a signing key or encryption key of the security module.

18. The method of claim 11, further comprising:

receiving a user request for access to secure content; and

in response to the user request, transmitting a content request message by the computing device.

19. The method of claim 18, further comprising:

routing, by the computing device, encrypted video content to the secure video processor; and

routing unencrypted video content to an unsecure video processor of the computing device, wherein the unsecure video processor is not provided with the control word key.

20. A media method, comprising:

generating, by a computing device, an identification of a secure video processor of the computing device and a key request message comprising an identification of a separable security module;

supplying authentication data responsive to the key request message to the separable security module via a secure tunnel; and

using the security module and secure video processor to process secured content for presentation to a user.