Networked digital video recording system with copy protection and random access playback

• US 7,231,516 B1
• Filed: 04/10/2003
• Issued: 06/12/2007
• Est. Priority Date: 04/11/2002
• Status: Active Grant

• Current Assignee: Google Technology Holdings LLC (Alphabet Inc.)
• Original Assignee: General Instrument Corporation (CommScope Holding Company, Inc.)
• Inventors: Sparrell, Carlton J., Watlington, John A.
• Primary Examiner(s): Peeso; Thomas R.
• Application Number:
  US10/411,063
• Time in Patent Office: 1,524 Days
• Field of Search: 713/156, 713/161, 713/165, 713/166
• US Class Current: 713/156
• CPC Class Codes: H04L 2209/605 Copy protection
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04N 2005/91364 the video signal being scrambled
• CPC Class Codes: H04N 21/4122 additional display device, e.g. video projector digital output for controlling a plurality of local displays G06F3/1423
• CPC Class Codes: H04N 21/4147 PVR [Personal Video Recorder] H04N5/76 takes precedence ; arrangements for broadcast with accumulation-type receivers H04H20/40
• CPC Class Codes: H04N 21/43615 Interfacing a Home Network, e.g. for connecting the client to a plurality of peripherals home Audio Video Interoperability [HAVI] data switching networks H04L12/2805
• CPC Class Codes: H04N 21/4367 Establishing a secure communication between the client and a peripheral device or smart card
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/4408 involving video stream encryption, e.g. re-encrypting a decrypted video stream for redistribution in a home network
• CPC Class Codes: H04N 21/472 End-user interface for requesting content, additional data or services; End-user interface for interacting with content, e.g. for content reservation or setting reminders, for requesting event notification, for manipulating displayed content end-user interfaces for retrieving video data from a database G06F16/739; network services for supporting unicast streaming H04L65/612
• CPC Class Codes: H04N 21/8355 involving usage data, e.g. number of copies or viewings allowed
• CPC Class Codes: H04N 21/8455 involving pointers to the content, e.g. pointers to the I-frames of the video stream
• CPC Class Codes: H04N 5/783 Adaptations for reproducing at a rate different from the recording rate
• CPC Class Codes: H04N 5/913 for scrambling ; for copy protection
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

In a multimedia recording and playback network for receiving from a content server a service package of multimedia content, the network including a media server in communication with the content server, a method of securely transmitting a master encryption key from the content server to the media server, including the steps downloading a service package certificate from the content server to the media server, authenticating, in the media server, the received service package certificate, the content server providing to the media server a key server certificate, a public key of the content server, and a client certificate request, the media server authenticating the key server certificate, providing to the content server, upon authentication of the key server certificate by the media server, a client certificate including a challenge signature, and a public key of the media server, the content server authenticating the client certificate including the challenge signature received from the media server, the media server requesting the master encryption key from the content server, and the content server responding by transmitting the master encryption key to media server.

Claims

1. In a multimedia recording and playback network for receiving from a content server a service package of multimedia content, the network including a media server in communication with the content server, a method of securely transmitting a master encryption key from the content server to the media server, including the steps:

downloading a service package certificate from the content server to the media server;

the media server authenticating the received service package certificate;

the content server providing to the media server a key server certificate, a public key of the content server, and a client certificate request;

the media server authenticating the key server certificate;

providing to the content server, upon authentication of the key server certificate by the media server, a client certificate including a challenge signature, and a public key of the media server;

the content server authenticating the client certificate including the challenge signature received from the media server;

the media server requesting the master encryption key from the content server; and

the content server responding by transmitting the master encryption key to media server.

2. The method of claim 1 further comprising the step of:

encrypting at least the challenge signature prior to transmitting to the content server.

3. The method of claim 2 further comprising the step of:

using the public key of the content server for encrypting at least the challenge signature prior to transmitting to the content server.

4. The method of claim 1 further comprising the step of:

encrypting the master encryption key prior to transmitting to the media server.

5. The method of claim 1 further comprising the step of:

using the public key of the media server for encrypting the master encryption key prior to transmitting to the media server.

6. The method of claim 4 further comprising the step of:

using a session key provided by the content server for encrypting the master encryption key prior to transmitting to the media server.

7. The method of claim 1 further comprising the step of:

transmitting, after authentication of the client certificate, a session key to the media server.

8. The method of claim 7 further comprising the step of:

encrypting the session key using the public key of the media server prior to transmitting to the media server.

9. The method of claim 1 further comprising the step of:

checking, after authenticating the client certificate including the challenge signature received from the media server, the client certificate against a certification revocation list.

10. The method of claim 1 wherein the service package certificate includes a challenge data structure that defines data fields, and further comprising the step of:

generating the challenge signature using the challenge data structure and data available at the media server for populating the data fields.

11. The method of claim 10 further comprising the step of:

hashing the populated data fields using a hashing algorithm specified by the challenge data structure to generate the challenge signature.

12. The method of claim 1 further comprising the steps of:

encrypting at least the challenge signature prior to transmitting to the content server; and

encrypting the master encryption key prior to transmitting to the media server.

13. The method of claim 12 further comprising the steps of:

transmitting, after authentication of the client certificate, a session key to the media server; and

using the session key for encrypting the master encryption key prior to transmitting to the content server.

14. The method of claim 13 further comprising the steps of:

encrypting the session key using the public key of the media server prior to transmitting to the media server.

15. The method of claim 12 further comprising the steps of:

using the public key of the content server for encrypting at least the challenge signature prior to transmitting to the content server; and

using the public key of the media server for encrypting the master encryption key prior to transmitting to the media server.

16. In a multimedia recording and playback network for receiving from a content server a service package of multimedia content, the network including a media server in communication with the content server, a system for securely transmitting a master encryption key from the content server to the media server, the system comprising:

means for downloading a service package certificate from the content server to the media server;

means, in the media server, for authenticating the downloaded service package certificate;

means, in the content server, for providing to the media server a key server certificate, a public key of the content server, and client certificate request;

means, in the media server, for authenticating the key server certificate;

means, in the media server, for providing to the content server a client certificate including a challenge signature and a public key of the media server after authentication of the key server certificate;

means, in the content server, for authenticating the client certificate including the challenge signature received from the media server;

means, in the media server, for requesting the master encryption key from the content server; and

means, in the content server, for responding to the master encryption key request by transmitting the master key to media server.

17. The system of claim 16 further comprising:

means, in the media server, for encrypting at least the challenge signature prior to transmitting to the content server.

18. The system of claim 17 wherein the encrypting means in the media server includes the public key of the content server.

19. The system of claim 16 further comprising:

means, in the content provider, for encrypting at least the master encryption key before transmitting to the media server.

20. The system of claim 19 wherein the encrypting means in the content server includes the public key of the media server.

21. The system of claim 16 further comprising:

means, in the content server, for generating a session key and transmitting the session key to the media server; and

means, in the content server, for encrypting the master encryption key using the session key prior to transmitting to the media server.

22. The system of claim 16 wherein the service package certificate downloaded by the media server includes a data challenge structure that defines data fields;

and wherein the media server further comprises;

means for generating the challenge signature using the data challenge structure and data available at the media server for populating the data fields.

23. The system of claim 22 wherein the data challenge signature generating means further comprises:

means for hashing the populated data fields using a hashing algorithm specified by the data challenge structure to generate the data challenge signature.

24. The system of claim 16 further comprising:

means, in the content server, for checking the client certificate against a certificate revocation list after authentication of the client certificate.

25. The system of claim 16 wherein the service package certificate downloaded by the media server includes a data challenge structure that defines data fields;

and wherein the system further comprises;

means, in the media server, for generating the data challenge signature using the data challenge structure and data available at the media server for populating the data fields;

means, in the media server, for encrypting at least the challenge signature using the public key of the content server prior to providing to the content server; and

means, in the content server, for encrypting at least the master encryption key prior to transmitting to the media server.

26. The system of claim 25 wherein the data encrypting means in the content server includes the public key of the media server which is used to encrypt at least the master encryption key prior to transmitting to the media server.

27. The system of claim 25 wherein the system further comprises:

means, in the content server, for generating and transmitting a session key to the media server; and

wherein the data encrypting means in the content server includes the session key which is used to encrypt at least the master encryption key prior to transmitting to the media server.

28. In a multimedia recording and playback network for receiving from a content server a service package of multimedia content, the network including a media server in communication with the content server for securely transmitting a master encryption key from the content server to the media server, the media server comprising:

means for downloading a service package certificate from the content provider to the media;

means for authenticating the downloaded service package certificate;

means for receiving a key server certificate, a public key of the content provider, and a client certificate request;

means for authenticating the key server request;

means for providing to the content server a client certificate including a challenge signature and a public key of the media server after authentication of the key server certificate;

means for requesting the master encryption key from the content server; and

means for receiving and decrypting the master encryption key transmitted by the content server in an encrypted format.

29. The media server of claim 28 further comprising:

means for encrypting at least the challenge signature prior to transmitting to the content provider.

30. The media server of claim 29 wherein the encrypting means includes the public key of the content server.

31. The media server of claim 28 wherein the service package certificate downloaded by the media server includes a data challenge structure that defines data fields;

and wherein the media server further comprises;

means for generating the challenge signature using the data challenge structure and data available at the media server for populating the data fields.

32. The media server of claim 31 wherein the data challenge signature generating means further comprises:

means for hashing the populated data fields using a hashing algorithm specified by the data challenge structure to generate the data challenge signature.

33. The media server of claim 28 wherein the means for decrypting the master encryption key as encrypted by the content provider includes a private key of the media server.

34. The media server of claim 28 wherein the means for decrypting the master encryption key as encrypted by the content provides includes a session key provided by the content provider.

35. In a multimedia recording and playback network for receiving from a content server a service package of multimedia content, the network including a media server in communication with the content server for securely transmitting a master encryption key from the content server to the media server, the content server comprising:

a service package certificate;

means for providing to the media server a key server certificate, a public key of the content provider, and a client certificate request

means for receiving a client certificate including a challenge signature and a public key of the media server from the media server;

means for authenticating the client certificate including the challenge signature received from the media server; and

means for encrypting the master encryption key and transmitting the encrypted master encryption key to the media server.

36. The content server of claim 35 wherein the encrypting means includes the public key of the media server.

37. The content server of claim 35 further comprising:

means for generating a session key and transmitting the session key to the media server; and

wherein

the encrypting means includes the session key.

38. The content server of claim 35 further comprising:

means for checking the client certificate against a certificate revocation list after authentication of the client certificate.