Authorization of services in a conditional access system

• US 6,252,964 B1
• Filed: 01/20/2000
• Issued: 06/26/2001
• Est. Priority Date: 04/03/1995
• Status: Expired due to Term

• Current Assignee: Tech 5 SAS
• Original Assignee: Scientific-Atlanta Incorporated (Cisco Systems, Inc.)
• Inventors: Pinder, Howard G., Banker, Robert O., Wasilewski, Anthony J., Akins, Glendon L. III
• Primary Examiner(s): Peeso, Thomas R.
• Assistant Examiner(s): JACK, TODD M
• Application Number:
  US09/488,230
• Time in Patent Office: 523 Days
• Field of Search: 380/223, 380/20, 380/282, 380/2, 348/3
• US Class Current: 380/282
• CPC Class Codes: H04J 2203/008 Support of video
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04N 21/2265 Server identification by a unique number or address, e.g. serial number network arrangements, protocols or services for addressing or naming H04L61/00
• CPC Class Codes: H04N 21/23476 by partially encrypting, e.g. encrypting the ending portion of a movie
• CPC Class Codes: H04N 21/26606 for generating or managing entitlement messages, e.g. Entitlement Control Message [ECM] or Entitlement Management Message [EMM] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/426 Internal components of the client ; Characteristics thereof H04N5/44 takes precedence
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/4524 involving the geographical location of the client retrieval from the Internet by querying based on geographical locations G06F16/9537; systems specially adapted for using geographical information in broadcast systems H04H60/70; protocols in which the network application is adapted for the location of the user terminal in communication control or processing H04L67/52; services making use of the location of users or terminals in wireless networks H04W4/02; locating users or terminals in wireless networks H04W64/00
• CPC Class Codes: H04N 21/63345 by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 7/162 Authorising the user terminal, e.g. by paying; Registering the use of a subscription channel, e.g. billing
• CPC Class Codes: H04N 7/163 by receiver means only
• CPC Class Codes: H04N 7/1675 : Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58
• CPC Class Codes: H04N 7/17354 : in an intermediate station common to a plurality of user terminals

Abstract

A cable television system provides conditional access to services. The cable television system includes a headend from which service “instances”, or programs, are broadcast and a plurality of set top units for receiving the instances and selectively decrypting the instances for display to system subscribers. The service instances are encrypted using public and/or private keys provided by service providers or central authorization agents. Keys used by the set tops for selective decryption may also be public or private in nature, and such keys may be reassigned at different times to provide a cable television system in which piracy concerns are minimized.

Claims

1. Conditional access apparatus for giving a receiver conditional access to an instance of service received in the receiver, one or more entitlements to access the instance of service being given by one or more entitlement agents and the conditional access apparatus comprising:

entitlement agent establishment apparatus in the receiver for establishing at least one of the entitlement agents in the conditional access apparatus;

entitlement specification apparatus in the receiver for specifying the one or more entitlements for the at least one entitlement agent, and wherein the entitlement agent establishment apparatus and the entitlement specification apparatus operate in response to further messages received in the receiver; and

access granting apparatus in the receiver for granting access to the instance of service in response to a first message received in the receiver which indicates the entitlement agent and the entitlement only if the entitlement agent establishment apparatus has established the entitlement agent, and the entitlement specification apparatus has granted the entitlement, and wherein the entitlement agent establishment apparatus disestablishes the entitlement agent in response to a given message of the further messages.

2. The conditional access apparatus of claim 1, wherein:

the entitlement agent establishment apparatus includes a first key representing a conditional access authority; and

the entitlement agent establishment apparatus employs the first key to determine whether the given message is authentic and disestablishes the entitlement agent only if the given message is authentic.

3. Conditional access apparatus for giving a receiver conditional access to an instance of service received in the receiver, one or more entitlements to access the instance of service being given by one or more entitlement agents and the conditional access apparatus comprising:

entitlement agent establishment apparatus in the receiver for establishing at least one of the entitlement agents in the conditional access apparatus;

entitlement specification apparatus in the receiver for specifying the one or more entitlements for the at least one entitlement agent, wherein the entitlement agent establishment apparatus and the entitlement specification apparatus operate in response to further messages received in the receiver; and

access granting apparatus in the receiver for granting access to the instance of service in response to a first message received in the receiver which indicates the entitlement agent and the entitlement only if the entitlement agent establishment apparatus has established the entitlement agent, and the entitlement specification apparatus has granted the entitlement, and wherein the entitlement agent establishment apparatus establishes a new entitlement agent in response to a given message of the further messages.

4. The conditional access apparatus of claim 3, wherein:

the entitlement agent establishment apparatus includes a first key representing a conditional access authority; and

the entitlement agent establishment apparatus employs the first key to determine whether the given message is authentic and establishes the new entitlement agent only if the given message is authentic.

5. Conditional access apparatus for giving a receiver conditional access to an instance of service received in the receiver, one or more entitlements to access the instance of service being given by one or more entitlement agents and the conditional access apparatus comprising:

entitlement agent establishment apparatus in the receiver for establishing at least one of the entitlement agents in the conditional access apparatus, wherein the entitlement agent establishment apparatus includes other keys representing conditional access authorities;

entitlement specification apparatus in the receiver for specifying the one or more entitlements for the at least one entitlement agent, wherein the entitlement agent establishment apparatus and the entitlement specification apparatus operate in response to further messages received in the receiver; and

access granting apparatus in the receiver for granting access to the instance of service in response to a first message received in the receiver which indicates the entitlement agent and the entitlement only if the entitlement agent establishment apparatus has established the entitlement agent, and the entitlement specification apparatus has granted the entitlement, and wherein the entitlement agent establishment apparatus changes a first key in response to at least first and second message of the further messages, the entitlement agent establishment apparatus using the other keys to determine whether the at least first and second messages are authentic and changing the other keys only when the at least first and second messages are authentic.

6. The conditional access apparatus of claim 5, wherein the entitlement agent establishment apparatus both establishes and disestablishes the conditional access authorities in accordance with use of the other keys and authentication of the at least first and second messages.