System for updating an authorization memory

• US 5,680,457 A
• Filed: 04/25/1995
• Issued: 10/21/1997
• Est. Priority Date: 01/18/1995
• Status: Expired due to Term

• Current Assignee: LG Electronics, Inc. (LG Corporation)
• Original Assignee: Zenith Electronics Corporation (LG Corporation)
• Inventors: Hartley, Harry A. III, Bestler, Caitlin B., Rabii, Khosro Marcus
• Primary Examiner(s): Tarcza, Thomas H.
• Assistant Examiner(s): Laufer, Pinchus M.
• Application Number:
  US08/427,789
• Time in Patent Office: 910 Days
• Field of Search: 380/19, 380/20, 380/49, 380/50, 380/21, 348/5.5, 348/10, 348/12, 348/13, 348/423, 348/461, 348/467, 455/5.1
• US Class Current: 380/239
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/2351 involving encryption of additional data arrangements using cryptography for the use of broadcast information or broadcast-related information H04H60/23
• CPC Class Codes: H04N 21/23614 Multiplexing of additional data and video streams arrangements for simultaneous broadcast of plural pieces of information H04H20/28
• CPC Class Codes: H04N 21/26606 for generating or managing entitlement messages, e.g. Entitlement Control Message [ECM] or Entitlement Management Message [EMM] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/26613 for generating or managing keys in general key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04
• CPC Class Codes: H04N 21/4181 for conditional access
• CPC Class Codes: H04N 21/426 Internal components of the client ; Characteristics thereof H04N5/44 takes precedence
• CPC Class Codes: H04N 21/42692 for reading from or writing on a volatile storage medium, e.g. Random Access Memory [RAM]
• CPC Class Codes: H04N 21/4348 Demultiplexing of additional data and video streams
• CPC Class Codes: H04N 21/4353 involving decryption of additional data arrangements using cryptography for the use of broadcast information or broadcast-related information H04H60/23
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/4623 Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/47211 for requesting pay-per-view content payment schemes payment architectures or payment protocols G06Q20/00, G07F
• CPC Class Codes: H04N 21/658 Transmission by the client directed to the server
• CPC Class Codes: H04N 7/163 by receiver means only
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

A subscriber terminal includes a digital conditional access module receiving a transport bitstream comprising a plurality of multiplexed conditional access and product packets. Selected ones of the conditional access packets are addressed to respective terminals and include an encrypted new decryption key code, an encrypted authorization bit map and an authorization list range delete code. The conditional access packets are decrypted by the conditional access modules of respective addressed terminals, the decrypted new decryption key code being stored for subsequent use by the conditional access module, the decrypted authorization bit map being used to refresh the authorization bit map memory of the module and the decrypted delete code being used to delete a specified range of authorization codes from the authorization list memory of the module.

Claims

1. A method of refreshing an authorization bit map memory of a subscriber terminal having a stored active decryption key code;

comprising the steps of;

multiplexing a plurality of product and conditional access data packets to form a transport bitstream, selected ones of said conditional access packets being addressed to said subscriber terminal and each of said selected conditional access packets comprising an encrypted new decryption key code and an encrypted authorization bit map;

transmitting the transport bitstream to said terminal;

decrypting the transmitted new decryption key code and authorization bit map at said terminal in response to said stored active decryption key code;

storing said decrypted new decryption key code for subsequent use in place of said stored active decryption key code; and

applying said decrypted authorization bit map for refreshing said authorization bit map memory.

2. The method of claim 1 wherein said terminal includes an authorization list memory comprising a plurality of multi-byte memory locations for storing respective multi-byte authorization codes, each authorization code representing a respective authorization level and wherein said selected conditional access packets further comprise an encrypted delete code identifying a range of said multi-byte memory locations, including decrypting said encrypted delete code and deleting the multi-byte authorization codes stored in the range of memory locations identified by said decrypted delete code.

3. The method of claim 2 wherein said range comprises a plurality of contiguous ones of said multi-byte memory locations.

4. The method of claim 1 wherein said authorization bit map memory comprises a plurality of contiguous single bit memory locations each representing a respective authorization level and wherein said decrypted authorization bit map comprises a number of bits corresponding to the size of said authorization bit map memory.

5. The method of claim 4 including replacing the contents of each of said single bit memory locations with a corresponding bit of said decrypted authorization bit map.

6. The method of claim 5 wherein said terminal includes an authorization list memory comprising a plurality of multi-byte memory locations for storing respective multi-byte authorization codes each representing a respective authorization level and wherein a further one of said conditional access packets is addressed to said subscriber terminal and comprises a selected encrypted authorization code, including decrypting said selected encrypted authorization code and applying the decrypted authorization code for updating the contents of one of said single bit memory locations if the value thereof falls within a predetermined range of values and otherwise applying the decrypted authorization code for storage in one of said multi-byte memory locations.

7. The method of claim 1 wherein said conditional access packets have a unique packet identification code and including intercepting said conditional access packets in response to said unique packet identification code prior to said decrypting step.

8. The method of claim 1 wherein said selected conditional access packets comprise an identification code uniquely identifying said subscriber terminal encrypted in a form different from said encrypted new decryption key code and encrypted authorization bit map and including, prior to the step of decrypting said new decryption key code and authorization bit map, decrypting said encrypted identification code and determining whether the decrypted identification code matches the terminal identification code.

9. The method of claim 8 wherein said selected conditional access packets include encrypted new first and second decryption key codes and including decrypting said encrypted new first and second decryption key codes at said terminal in response to said stored active decryption key code and storing said decrypted new first decryption key code for subsequent use in decrypting said identification codes and storing said decrypted new second decryption key code for subsequent use in place of said stored active decryption key code.

10. The method of claim 9 wherein said product packets are encrypted and including using said stored first decryption key codes to decrypt said encrypted product packets.

11. A method of refreshing an authorization bit map memory of a subscriber terminal having a stored active decryption key code, comprising:

receiving a transport bitstream comprising a plurality of multiplexed product and conditional access data packets, selected ones of said conditional access packets being addressed to said subscriber terminal and each of said selected conditional access packets comprising an encrypted new decryption key code and an encrypted authorization bit map;

decrypting the received new decryption key code and authorization bit map in response to said stored active decryption key code;

storing said decrypted new decryption key code for subsequent use in place of said stored active decryption key code; and

applying said decrypted authorization bit map for refreshing said authorization bit map memory.

12. The method of claim 11 wherein said selected conditional access packets further comprise an encrypted delete code and wherein said terminal comprises an authorization list memory including a plurality of multi-byte memory locations for storing respective multi-byte authorization codes each representing a respective authorization level, including decrypting said encrypted delete code and deleting the multi-byte authorization codes stored in a range of memory locations identified by said decrypted delete code.

13. The method of claim 12 wherein said range comprises a plurality of contiguous ones of said multi-byte memory locations.

14. The method of claim 11 wherein said authorization bit memory comprises a plurality of contiguous single bit memory locations each representing a respective authorization level and wherein said decrypted authorization bit map comprises a number of bits corresponding to the size of said authorization bit map memory.

15. The method of claim 14 including replacing the contents of each of said single bit memory locations with a corresponding bit of said decrypted authorization bit map.

16. The method of claim 11 wherein a further one of said received conditional access packets is addressed to said subscriber terminal and comprises a selected encrypted authorization code, said terminal further comprising an authorization list memory including a plurality of multi-byte memory locations for storing respective multi-byte authorization codes, including decrypting said selected encrypted authorization code and applying the decrypted authorization code for updating the contents of one of said single bit memory locations of said authorization bit map memory if the value thereof falls within a predetermined range of values and otherwise applying the decrypted authorization code for storage in one of said multi-byte memory locations of said authorization list memory.

17. The method of claim 11 wherein said conditional access packets have a unique packet identification code and including intercepting said conditional access packets in response to said unique packet identification code prior to said decrypting step.

18. The method of claim 11 wherein said selected conditional access packets comprise an identification code uniquely identifying said subscriber terminal encrypted in a form different from said encrypted new decryption key code and encrypted authorization bit map and including, prior to the step of decrypting said new decryption key code and authorization bit map, decrypting said encrypted identification code and determining whether the decrypted identification code matches the terminal identification code.

19. The method of claim 18 wherein said selected conditional access packets include encrypted new first and second decryption key codes and including decrypting said encrypted new first and second decryption key codes at said terminal in response to said stored active decryption key code and storing said decrypted new first decryption key code for subsequent use in decrypting said identification codes and storing said decrypted new second decryption key code for subsequent use in place of said stored active decryption key code.

20. The method of claim 19 wherein said product packets are encrypted and including decrypting said product packets using said stored first decryption key code.

21. A method of controlling the contents of an authorization memory of a subscriber terminal having a stored active decryption key code, comprising the steps of:

multiplexing a plurality of product and conditional access data packets to form a transport bitstream, selected ones of said conditional access packets being addressed to said subscriber terminal and each of said selected conditional access packets comprising an encrypted new decryption key code and an encrypted authorization memory update code;

transmitting the transport bitstream to said terminal;

decrypting the transmitted new decryption key code and authorization update code at said terminal in response to said stored active decryption key code;

storing said decrypted new decryption key code for subsequent use in place of said stored active decryption key code; and

applying said decrypted authorization update code for updating the contents of said authorization memory.

22. The method of claim 21 wherein said authorization memory comprises an authorization bit map memory and wherein said authorization memory update code comprises an authorization bit map, said applying step comprising applying the decrypted authorization bit map for refreshing said authorization bit map memory.

23. The method of claim 21 wherein said authorization memory comprises an authorization list including a plurality of multi-byte memory locations for storing respective multi-byte authorization codes each representing a respective authorization level and wherein said authorization memory update code comprises a delete code, said applying step comprising applying the decrypted delete code for deleting the multi-byte authorization codes stored in a range of said memory locations identified by said decrypted delete code.