Methods and apparatus for providing a partial dual-encrypted stream in a conditional access overlay system

• US 7,224,798 B2
• Filed: 07/30/2003
• Issued: 05/29/2007
• Est. Priority Date: 04/03/1995
• Status: Expired due to Fees

• Current Assignee: Tech 5 SAS
• Original Assignee: Scientific-Atlanta Incorporated (Cisco Systems, Inc.)
• Inventors: Pinder, Howard G., Evans, Jonathan Bradford, Woodward, William D. Jr., Wasilewski, Anthony J.
• Primary Examiner(s): Sheikh; Ayaz
• Assistant Examiner(s): Chai; Longbit
• Application Number:
  US10/629,839
• Publication Number:
  US 20040139337A1
• Time in Patent Office: 1,399 Days
• Field of Search: None
• US Class Current: 380/239
• CPC Class Codes: H04J 2203/008 Support of video
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0478 applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04N 21/2265 Server identification by a unique number or address, e.g. serial number network arrangements, protocols or services for addressing or naming H04L61/00
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/23476 by partially encrypting, e.g. encrypting the ending portion of a movie
• CPC Class Codes: H04N 21/23608 Remultiplexing multiplex streams, e.g. involving modifying time stamps or remapping the packet identifiers
• CPC Class Codes: H04N 21/23897 by partially encrypting, e.g. encrypting only the ending portion of a movie
• CPC Class Codes: H04N 21/26606 for generating or managing entitlement messages, e.g. Entitlement Control Message [ECM] or Entitlement Management Message [EMM] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/426 Internal components of the client ; Characteristics thereof H04N5/44 takes precedence
• CPC Class Codes: H04N 21/43607 Interfacing a plurality of external cards, e.g. through a DVB Common Interface [DVB-CI]
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/4524 involving the geographical location of the client retrieval from the Internet by querying based on geographical locations G06F16/9537; systems specially adapted for using geographical information in broadcast systems H04H60/70; protocols in which the network application is adapted for the location of the user terminal in communication control or processing H04L67/52; services making use of the location of users or terminals in wireless networks H04W4/02; locating users or terminals in wireless networks H04W64/00
• CPC Class Codes: H04N 21/63345 by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 7/162 Authorising the user terminal, e.g. by paying; Registering the use of a subscription channel, e.g. billing
• CPC Class Codes: H04N 7/163 by receiver means only
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58
• CPC Class Codes: H04N 7/17354 in an intermediate station common to a plurality of user terminals

Abstract

The present invention is directed towards providing a partial dual-encrypted stream in a conditional access overlay system. The headend equipment includes an aligner, identifier, and remapper (AIR) device (615) that receives a clear stream and one or two encrypted streams, where the two encrypted streams have been encrypted by two different encryption schemes. The AIR device (615) identifies critical packets associated with the clear stream and subsequently allows two encrypted streams to pass and drops the critical packets of the clear stream. A multiplexer (640) then combines a percentage of the non-critical packets of the clear stream and the critical packets of the two encrypted streams to provide the partial dual-encrypted stream.

Claims

1. A method for providing an encrypted transport stream, the method comprising the steps of:

receiving a clear stream, the clear stream including a plurality of programs, each program comprising a plurality of packets each having a packet identifier (PID), wherein at least one of the plurality of packets is designated a critical packet;

scrambling the clear stream according to a first encryption method to provide a first encryption stream;

scrambling the clear stream according to a second encryption method to provide a second encryption stream;

aligning in time the clear stream, the first encryption stream, and the second encryption stream;

after scrambling the clear stream according to the first encryption method to provide the first encryption stream and after scrambling the clear stream according to the second encryption method to provide the second encryption stream, passing packets of the clear stream through a multiplexer, wherein when the at least one critical packet is identified in the packets of the clear stream, the critical packet of the clear stream drops and the scrambled critical packets included in the first and second encryption streams pass; and

multiplexing the packets of the clear stream and the critical packets of the first and second encryption streams to provide a partial dual encrypted stream.

2. The method of claim 1, the steps further comprising remapping at least one PID value associated with the second encryption stream, whereby the scrambled packets of the first and second encryption streams each have a differing PID value.

3. The method of claim 1, wherein the aligning step comprises buffering each of the clear stream, the first encryption stream, and the second encryption stream.

4. The method of claim 3, the aligning step comprising the further steps of:

searching the clear stream for a reference packet; and

comparing the reference packet with packets in the first encryption stream and the second encryption stream, wherein the packets associated with the clear stream passes and the packets associated with the first and second encryption streams drop until the packets associated with the first and second encryption stream match the reference packet.

5. The method of claim 1, comprising the further step of demultiplexing each of the clear stream and the first and second encryption streams to provide a plurality of programs.

6. The method of claim 5, wherein a common program demultiplexed from each stream is provided to a common aligner, identifier, and remapper device.

7. A partial dual-encryption device for encrypting a clear stream, comprising:

a port for providing a first encrypted stream corresponding to the clear stream from a first scrambler;

a port for providing a second encrypted stream corresponding to the clear stream from a second scrambler;

an aligner, identifier, and remapper (AIR) device coupled to each scrambler for providing a partial dual-encrypted stream,

wherein the clear stream having at least one critical packet is provided to each scrambler and the AIR device, wherein, after the streams are encrypted, the AIR device aligns packets of the clear stream, the first encrypted stream, and the second encrypted stream, and wherein, upon identification of the at least one critical packet of the clear stream, provides the partial dual-encrypted stream including non-critical packets of the clear stream, a critical packet of the first encrypted stream, and a remapped critical packet of the second encrypted stream.

8. The partial dual-encryption device of claim 7, the AIR device comprising:

an aligner for aligning the packets associated with the clear stream, the first encrypted stream, and the second encrypted stream;

an identifier for identifying the at least one critical packet; and

a remapper for remapping a packet identifier (PID) value associated with the second encrypted stream,

the aligner comprising;

buffers for buffering the clear stream, the first encrypted stream, and the second encrypted stream; and

a packet comparator for comparing a head packet associated with each stream in a buffer to determine when the buffered streams are aligned and subsequently releasing the streams for further processing.

9. The partial dual-encryption device of claim 8, the AIR device further comprising:

switches responsive to the identifier for allowing one of the packets associated with the clear stream and the packets associated with the first and second encrypted streams to pass through to a multiplexer.

10. The partial dual-encryption device of claim 7, further comprising:

a first demultiplexer coupled to the first scrambler to provide a plurality of first encrypted program streams;

a second demultiplexer coupled to the second scrambler to provide a plurality of second encrypted program streams; and

a third demultiplexer for providing a plurality of clear program streams, wherein the demultiplexed program streams are provided to the AIR and processed as a common program.

11. The partial dual-encryption device of claim 10, wherein the AIR device includes a plurality of program AIR devices depending upon the number of common programs.

12. The partial dual-encryption device of claim 11, further comprising a common multiplexer for multiplexing the partial dual-encrypted stream from each of the plurality of program AIR devices.

13. The partial dual-encryption device of claim 12, wherein the common multiplexer provides feedback to each of the program AIR devices that indicates availability of bandwidth for when the number of critical packets of the first encrypted stream and the remapped critical packets of the second encrypted stream can be increased.

14. A method for transmitting an encrypted transport stream, the method comprising the steps of:

receiving a clear stream, the clear stream including a plurality of programs, each program comprising a plurality of packets each having a packet identifier (PID), wherein at least one of the plurality of packets is designated a critical packet;

scrambling with a first scrambler the clear stream according to a first encryption method to provide a first encrypted stream;

aligning in time the clear stream and the first encrypted stream;

after providing the first encryption stream, identifying the at least one critical packet associated with the clear stream, wherein prior to identification, packets associated with the clear stream pass to a multiplexer and encrypted packets associated with the first encrypted stream drop, and wherein subsequent to identification, packets associated with the clear stream pass to a second scrambler and encrypted packets associated with the first encrypted stream pass to the multiplexer, wherein the second scrambler provides a second encrypted stream to the multiplexer; and

multiplexing non-critical packets associated with the clear stream and the encrypted critical packets associated with the first and second encrypted streams to provide a partial dual-encrypted stream.

15. The method of claim 14, the steps further comprising remapping the second encrypted stream to a new PID value.

16. A partial dual-encryption device, comprising:

a port for providing a first encrypted stream from a first scrambler;

an aligner, identifier, and remapper (AIR) device coupled to the scrambler for providing a partial dual-encrypted stream,

wherein a clear stream having at least one critical packet is provided to the scrambler and the AIR device, wherein the AIR device aligns packets of the clear stream and the first encrypted stream, and identifies the at least one critical packet associated with the clear stream, wherein, upon identification of the at least one critical packet, provides the first stream having been previously encrypted, provides the at least one critical packet to a second scrambler, the second scrambler to provide a second encrypted stream, and wherein the AIR device provides the partial dual-encrypted stream including non-critical packets associated with the clear stream and dually-encrypted critical packets associated with the first and second encrypted streams.

17. The partial dual-encryption device of claim 16, the AIR device comprising:

an aligner for aligning the packets associated with the clear stream and the first encrypted stream;

an identifier for identifying the a critical packet associated with the clear stream; and

a first switch responsive to the identifier for providing one of the non-critical packets associated with the clear stream to a multiplexer and the critical packet associated with the clear stream to a second scrambler;

a second switch responsive to the identifier, wherein upon identification of the critical packet, the second switch for providing a first encrypted critical packet of the first encrypted stream to the multiplexer;

the second scrambler coupled to the first switch for receiving the critical packet associated with the clear stream and providing a second encrypted critical packet; and

a remapper for remapping the second encrypted packet to provide a remapped encrypted critical packet.

18. The partial dual-encryption device of claim 17, the AIR device comprising:

a first demultiplexer coupled to the first scrambler to provide a plurality of first encrypted program streams; and

a second demultiplexer for providing a plurality of clear program streams,

wherein the demultiplexed program streams are provided to the AIR device and processed according to a common program stream.

19. The partial dual-encryption device of claim 18, wherein the AIR device includes a plurality of program AIR devices depending upon the number of common program streams.

20. The partial dual-encryption device of claim 19, further comprising a common multiplexer for multiplexing the partial dual-encrypted stream from each of the plurality of program AIR devices, wherein the common multiplexer provides feedback to each of the program AIR devices that indicates availability of bandwidth for when the number of critical packets of the first encrypted stream and the remapped encrypted critical packets of the second encrypted stream can be increased.