Conditional access via secure logging with simplified key management

• US 6,738,905 B1
• Filed: 04/14/1999
• Issued: 05/18/2004
• Est. Priority Date: 04/15/1998
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Digital Video Express LP
• Inventors: Goldschlag, David M., Kravitz, David W.
• Primary Examiner(s): Peeso, Thomas R.
• Assistant Examiner(s): Zand, Kambiz
• Application Number:
  US09/291,052
• Time in Patent Office: 1,861 Days
• Field of Search: 713/193-194, 713/182, 380/201-202, 380/270, 380/278, 705/51, 705/52, 705/57
• US Class Current: 713/194
• CPC Class Codes: H04K 1/00 Secret communication
• CPC Class Codes: H04N 21/237 Communication with additional data server
• CPC Class Codes: H04N 21/2541 Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/44204 Monitoring of content usage, e.g. the number of times a movie has been viewed, copied or the amount which has been watched monitoring of user activities for profile generation for accessing a video database G06F16/739; protecting generic digital content where the protection is independent of the precise nature of the content G06F21/10; arrangements for monitoring the use made of the broadcast services in broadcast systems H04H60/31
• CPC Class Codes: H04N 21/63345 by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 21/8352 involving content or source identification data, e.g. Unique Material Identifier [UMID]
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

A method and apparatus for distributing content data from a content provider to a subscriber. The method includes encrypting content data by the content provider and providing the content data from the content provider to a broadcaster. The content provider also provides a content descriptor, including keys to decrypt the encrypted content, to a conditional access provider. The broadcaster distributes the encrypted content information to a subscriber. A business service provider negotiates with the subscriber to deliver individual content programs or packages of content programs to the subscriber for a fee. The conditional access provider distributes a content descriptor including keys necessary to decrypt the programs the subscriber selected from the business service provider. A CAM retained by the subscriber maintains a log of programs accessed, and uploads the log to the business service provider, which is used to determine the appropriate fee which the subscriber should be charged. Alternatively, the subscriber may purchase a package plan which does not require logging, and thus allows unidirectional communication.

Claims

1. A method of distributing content data from a content provider device to a subscriber, the content provider device including an encryption device, the subscriber having a set top box including a decryption device, the method comprising the steps of:

encrypting content using the encryption device;

distributing the encrypted content from the content provider to the subscriber;

distributing keys, for decrypting the encrypted content, from the content provider to a service provider;

distributing the keys from the service provider to the subscriber; and

accessing the content by decrypting the content using the decryption device, capable of decrypting content from several different content provider devices,

wherein the keys are distributed to the subscriber temporally independent of the distribution of the content to the subscriber.

2. The method according to claim 1, further comprising the steps of:

logging access to the content by the subscriber in a log contained on a non-volatile memory; and

sending the log to the service provider.

3. The method according to claim 2, wherein the step of distributing the keys further includes distributing rules with the keys, and wherein the steps of accessing the content and logging access of the content are performed according to the rules.

4. The method according to claim 2, further comprising the steps of:

generating a subscriber bill at the service provider based on the log; and

computing royalties to be paid to the content provider.

5. The method according to claim 4, wherein the step of generating a subscriber bill comprises allocating charges based on access to an individual program.

6. The method according to claim 4, wherein the step of generating a subscriber bill comprises allocating charges based on access to a package of programs.

7. The method according to claim 1, further comprising the step of:

logging access to the content by the subscriber in a log contained on a non-volatile memory 2, wherein said step of accessing content is achieved without contacting the service provider.

8. The method according to claim 2, wherein the service provider includes a conditional access provider for distributing the keys, and a business service provider for receiving said log.

9. The method according to claim 2, further comprising the steps of:

receiving an acknowledgement signal from the service provider;

determining if the acknowledgement signal is valid; and

clearing the log if the acknowledgement is determined to be valid.

10. The method according to claim 2, further comprising the steps of:

receiving an acknowledgement signal from the service provider;

determining if the acknowledgement signal is valid; and

if valid, downloading keys from the service provider.

11. The method according to claim 1, wherein the step of distributing the keys comprises broadcasting said keys to the subscriber.

12. The method according to claim 1, wherein said step of distributing the encrypted content is performed by multiple content providers, and the step of distributing keys is performed by multiple service providers, and wherein said subscriber interacts with at least one of said multiple content providers and at least one of said multiple service providers.

13. The method according to claim 1, wherein the step of distributing the encrypted content further comprises the steps of:

distributing encrypted content from a single content provider to a plurality of broadcasters; and

broadcasting the encrypted content to the subscriber.

14. The method according to claim 1, wherein the set top box further includes a display device and a menu navigation device, further comprising the steps of:

displaying a menu on said display device;

receiving input from said menu navigation device; and

controlling access to content based on the received input.

15. The method according to claim 1, further comprising the step of:

processing the decrypted content to inhibit distribution of the decrypted content to more than one display device.

16. The method according to claim 1, further comprising the step of transmitting the content data through a secure point to point broadcast.

17. The method according to claim 1, further comprising the step of transmitting the content data through a multicast broadcast.

18. A method of distributing content data from a content provider to a subscriber, the subscriber having a set top box including a decryption device, the method comprising the steps of:

encrypting the content data using a content key and an index, in a series of indices, corresponding to a content packet, in a series of content packets;

forming a data stream by interleaving the series of indices with a series of content packets;

transmitting the data stream to the set top box; and

decrypting the content packets using a content key and the index corresponding to the content packet in a series of indices using the decryption device, the decryption device capable of decrypting content from several different content provider devices,

wherein the keys are distributed to the subscriber temporally independent of the distribution of the content packets to the subscriber.

19. The method according to claim 18, wherein the steps of encrypting and decrypting are performed by hashing the indices with the content key.

20. An apparatus for receiving and decrypting encrypted content data which is distributed from a content provider to a subscriber via a broadcaster, the apparatus comprising:

a receiver for receiving the encrypted content;

a decryptor for decrypting the encrypted content using a content descriptor distributed by a service provider, the decryptor device capable of decrypting content from several different content provider devices; and

a controller for controlling the decryptor and for communicating with the service provider, thereby providing the subscriber access to the content data, wherein the content descriptor is distributed to the apparatus temporally independent of the distribution of the encrypted content.

21. The apparatus according to claim 20, further comprising a logging device for logging access to the content data, wherein the controller controls the logging of access to the content data by the logging device according to rules contained in the content descriptor.

22. The apparatus according to claim 20, further comprising a content descriptor table containing content descriptors from the service provider, wherein the controller determines whether a content descriptor in the content descriptor table corresponds to the received encrypted content.

23. The apparatus according to claim 20, further comprising a conversion device for converting the decrypted content data into a displayable form for display on a display device.

24. The apparatus according to claim 20, further comprising communication control logic, the communication control logic being responsive to the controller to communicate with the service provider.

25. The apparatus according to claim 20, further comprising:

a menu generator for generating a menu, having a plurality of operations, to be displayed on a display device; and

a menu navigator for providing a user selection of said operations to said controller.

26. The apparatus according to claim 20, further comprising a processor for processing the decrypted content data to inhibit distribution of the decrypted content to more than one display device.