Impulse pay per use method and system for data and multimedia services

• US 6,810,525 B1
• Filed: 08/03/2000
• Issued: 10/26/2004
• Est. Priority Date: 08/17/1999
• Status: Active Grant

• Current Assignee: Google Technology Holdings LLC (Alphabet Inc.)
• Original Assignee: General Instrument Corporation (CommScope Holding Company, Inc.)
• Inventors: Bontempi, Ray, Makofka, Doug, Sprunk, Eric J., Safadi, Reem
• Primary Examiner(s): Miller, John
• Assistant Examiner(s): Sloan, Nathan A
• Application Number:
  US09/631,328
• Time in Patent Office: 1,545 Days
• Field of Search: H04/N.7173, 725/104, 725/86, 725/87, 725/93, 725/100, 725/1, 725/2, 725/5, 725/6, 725/8, 725/25, 725/31, 725/4, 725/103, 380/200, 380/211, 380/231, 380/232, 380/233, 380/234, 380/239, 380/241, 705/54, 705/57, 705/59, 705/67
• US Class Current: 725/1
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/145 Payments according to the detected use or quantity
• CPC Class Codes: G06Q 20/30 characterised by the use of specific devices or networks
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G07F 17/16 for devices exhibiting advertisements, announcements, pictures or the like
• CPC Class Codes: H04N 2007/1739 the upstream communication being transmitted via a separate link, e.g. telephone line
• CPC Class Codes: H04N 21/2543 Billing , e.g. for subscription services payment schemes, architectures or protocols G06Q20/00; e-commerce G06Q30/00; arrangements for billing for the use of broadcast information or broadcast-related information H04H60/21
• CPC Class Codes: H04N 21/25875 involving end-user authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; arrangements for secret or secure communication including means for verifying the identity or authority of a user of the system H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/47211 for requesting pay-per-view content payment schemes payment architectures or payment protocols G06Q20/00, G07F
• CPC Class Codes: H04N 21/478 Supplemental services, e.g. displaying phone caller identification, shopping application
• CPC Class Codes: H04N 21/6125 involving transmission via Internet transmission by internet of broadcast information H04H60/82
• CPC Class Codes: H04N 21/63345 by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 7/165 Centralised control of user terminal subsequent to an upstream request signal H04N7/17345; Registering at central by two-way working H04N7/17309
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

A method and system are provided for impulse purchasing of services over a communication network, such as a cable or satellite television network. Such services can include games or information accompanying television programming, home-shopping, e-mail services, streaming media and the like. Security is provided through entitlements generated by the access controller 14 and entitlement tokens generated by a secure processor. The secure processor is located at a subscriber terminal 16 through which a subscriber orders and obtains the services. A token is generated when the subscriber either selects the service, if pre-authorized, or when the service is purchased on impulse. The token is secure and signed, and may be used by a policy/proxy server 18 subtending to the Network Operator'"'"'s ISP and associated services to further facilitate offering these services to the subscribers.

Claims

1. A method of providing secure impulse pay-per-use (IPPU) services to a subscriber over a communication network, comprising the steps of:

sending a subscriber IPPU selection from the subscriber to an access controller;

generating at the access controller an encrypted message having a service identifier and associated authorization settings related to the subscriber IPPU selection;

communicating said encrypted message from the access controller to a subscriber terminal together with the cost of the IPPU service selected by the subscriber;

verifying that said cost is within a credit entitlement of said subscriber, and if such verification is successful, generating a secure entitlement token for use by a client application residing in the subscriber terminal;

securely sending the entitlement token from the client application to a server for determining the status of the subscriber'"'"'s entitlement; and

processing the IPPU selection at said server for enabling the selection to be used by the subscriber upon processing of the selection and associated entitlement.

2. A method in accordance with claim 1, wherein the server is one of an independent Internet Service Provider (ISP) proxy/policy server, an ISP proxy/policy server affiliated with a Network Operator'"'"'s proxy/policy/policy server, or a Network Operator'"'"'s proxy/policy/policy server.

3. A method in accordance with claim 1, wherein the step of sending a subscriber IPPU selection to an access controller further comprises the steps of:

sending the subscriber IPPU selection to a billing system;

conveying the IPPU selection from the billing system to the access controller; and

billing the subscriber for the IPPU service provided.

4. A method in accordance with claim 3, wherein the subscriber IPPU selection is sent to the billing system using a web browser associated with the subscriber terminal and a web server associated with the billing system.

5. A method in accordance with claim 3, wherein:

as part of said communication to said access controller, the billing system actuates the access controller to add the service referred to by the subscriber IPPU selection; and

the step of adding said service is a separate process from that which tells the access controller which subscribers are entitled to access the service.

6. A method in accordance with claim 1, wherein the secure entitlement token is a signed and encrypted entitlement token, which signed and encrypted entitlement token is securely sent from the client application to the server for authentication and decryption.

7. A method in accordance with claim 6, wherein the entitlement token is encrypted using at least one of:

(i) private key/public key encryption methods; and

(ii) symmetric key encryption methods.

8. A method in accordance with claim 1, wherein the service identifier is associated with one or more service related codes and data objects which are sent periodically from the access controller to the subscriber terminal.

9. A method in accordance with claim 1, wherein the access controller is a local access controller.

10. A method in accordance with claim 1, wherein the access controller is a national access controller.

11. A method in accordance with claim 1, wherein the services comprise at least one of accessing certain sites, streaming media from the sites, downloading multimedia applications from the sites, accessing content resident on the sites, shopping, email, and video mail.

12. A method in accordance with claim 1, wherein the subscriber terminal is one of a cable television set-top box, a digital television or host with point of deployment capability, or a personal computer.

13. A method in accordance with claim 1, wherein the subscriber IPPU selection is pre-authorized at the subscriber terminal for a predetermined credit amount.

14. A method in accordance with claim 13, wherein a cost associated with the subscriber IPPU selection is subtracted from the credit amount.

15. A method in accordance with claim 1, further comprising the step of securely reporting the subscriber IPPU selection from the subscriber terminal back to the access controller.

16. A method in accordance with claim 1, wherein the entitlement token is generated at one of the access controller or the subscriber terminal.

17. A system for providing secure impulse pay-per-use (IPPU) services to a subscriber over a communication network, comprising:

a subscriber terminal having a client application;

an access controller for receiving a subscriber IPPU selection; and

a server, wherein;

the subscriber conveys the subscriber IPPU selection to the access controller;

the access controller generates an encrypted message having a service identifier and associated authorization settings related to the subscriber IPPU selection;

the access controller communicates the encrypted message to the subscriber terminal together with the cost of the IPPU service selected by the subscriber;

the subscriber terminal verifies that said cost is within a credit entitlement of said subscriber, and if such verification is successful, the subscriber terminal generates a secure entitlement token for use by the client application residing in the subscriber terminal;

the client application securely sends the entitlement token to the server for determining the status of the subscriber'"'"'s entitlement; and

the server processes the IPPU selection to enable the selection to be used by the subscriber upon processing of the selection and associated entitlement.

18. A system in accordance with claim 17, wherein the server is one of an independent Internet Service Provider (ISP) proxy/policy server, an ISP proxy/policy server affiliated with a Network Operator'"'"'s proxy/policy/policy server, or a Network Operator'"'"'s proxy/policy/policy server.

19. A system in accordance with claim 17, further comprising a billing system, wherein:

the subscriber sends the subscriber IPPU selection to a billing system;

the billing system conveys the subscriber IPPU selection to the access controller; and

the subscriber is billed for the IPPU service provided.

20. A system in accordance with claim 19, further comprising:

a web browser associated with the subscriber terminal for forwarding the subscriber IPPU selection to the billing system; and

a web server associated with the billing system for receiving the subscriber IPPU selection from the web browser.

21. A system in accordance with claim 19, wherein:

as part of conveying the subscriber IPPU selection to the access controller, the billing system actuates the access controller to add the service referred to by the subscriber IPPU selection; and

the step of adding said service is a separate process from that which tells the access controller which subscribers are entitled to access the service.

22. A system in accordance with claim 17, wherein the secure entitlement token is a signed and encrypted entitlement token, which signed and encrypted entitlement token is securely sent from the client application to the server for authentication and decryption.

23. A system in accordance with claim 22, wherein the entitlement token is encrypted using at least one of:

(i) private key/public key encryption methods; and

(ii) symmetric key encryption methods.

24. A system in accordance with claim 17, wherein the service identifier is associated with one or more service related codes and data objects which are sent periodically from the access controller to the subscriber terminal.

25. A system in accordance with claim 17, wherein the access controller is a local access controller.

26. A system in accordance with claim 17, wherein the access controller is a national access controller.

27. A system in accordance with claim 17, wherein the services comprise at least one of accessing certain sites, streaming media from the sites, downloading multimedia applications from the sites, accessing content resident on the sites, shopping, email, and video mail.

28. A system in accordance with claim 17, wherein the subscriber terminal is one of a cable television set-top box, a digital television or host with point of deployment capability, or a personal computer.

29. A system in accordance with claim 17, wherein the subscriber IPPU selection is pre-authorized at the subscriber terminal for a predetermined credit amount.

30. A system in accordance with claim 29, wherein a cost associated with the subscriber IPPU selection is subtracted from the credit amount.

31. A system in accordance with claim 17, wherein the subscriber terminal securely reports the subscriber IPPU selection back to the access controller.

32. A system in accordance with claim 17, wherein the entitlement token is generated at one of the access controller or the subscriber terminal.