System and method for secure conditional access download and reconfiguration

• US 7,383,438 B2
• Filed: 12/18/2004
• Issued: 06/03/2008
• Est. Priority Date: 12/18/2004
• Status: Active Grant

• Current Assignee: Comcast Cable Communications LLC (Comcast Corporation)
• Original Assignee: Comcast Cable Holdings LLC (Comcast Corporation)
• Inventors: Wilson, Mark William, Fahrny, James William
• Primary Examiner(s): HENEGHAN, MATTHEW E
• Application Number:
  US11/017,559
• Publication Number:
  US 20060137015A1
• Time in Patent Office: 1,263 Days
• Field of Search: 713/169, 725/31
• US Class Current: 713/169
• CPC Class Codes: H04N 21/235 Processing of additional data, e.g. scrambling of additional data or processing content descriptors
• CPC Class Codes: H04N 21/25816 involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/26291 for providing content or additional data updates, e.g. updating software modules, stored at the client deployment, distribution, installation, update of software G06F8/65; error detection or correction during software upgrading G06F11/1433; arrangements for updating broadcast information or broadcast-related information H04H60/25
• CPC Class Codes: H04N 21/26606 for generating or managing entitlement messages, e.g. Entitlement Control Message [ECM] or Entitlement Management Message [EMM] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/435 Processing of additional data, e.g. decrypting of additional data, reconstructing software from modules extracted from the transport stream
• CPC Class Codes: H04N 21/4432 Powering on the client, e.g. bootstrap loading using setup parameters being stored locally or received from the server resetting in general G06F1/14; program loading or initiating in general G06F9/445; bootstrapping in general G06F9/4401; secure boots of computer platforms G06F21/57
• CPC Class Codes: H04N 21/6583 Acknowledgement
• CPC Class Codes: H04N 21/8193 dedicated tools, e.g. video decoder software or IPMP tool
• CPC Class Codes: H04N 7/17318 Direct or substantially direct transmission and handling of requests
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

A method of securely downloading at least one of conditional access software (CAS), Digital Rights Management software (DRMS), Trusted Domain Software (TDS), and Gaming Security Software (GSS) includes presenting a specialized entitlement management message (EMM) to initiate the download to a receiver security device using a supervisory logon key (SLK) split to logon with a second split contained inside the receiver security device, presenting a receiver digitally signed random challenge from the receiver security device to a sender security server to establish authentication of the receiver security device to the sender security server, and signing and returning the receiver random challenge from the sender security server to the receiver security device with a sender random challenge to establish authentication of the sender security server to the receiver security device.

Claims

1. A method of securely downloading at least one of conditional access software (CAS), Digital Rights Management software (DRMS), Trusted Domain Software (TDS), and Gaming Security Software (GSS), the method comprising:

presenting a specialized entitlement management message (EMM) to initiate the download to a receiver security device using a supervisory logon key (SLK) split to logon with a second split contained inside the receiver security device;

presenting a receiver digitally signed random challenge from the receiver security device to a sender security server to establish authentication of the receiver security device to the sender security server; and

signing and returning the receiver random challenge from the sender security server to the receiver security device with a sender random challenge to establish authentication of the sender security server to the receiver security device.

2. The method of claim 1 further comprising signing and returning the sender random challenge from the receiver security device to the sender security server to complete authentication of the receiver security device to the sender security server.

3. The method of claim 2 further comprising sending a session download key from the sender security server in a signed and encrypted CAS receive download message.

4. The method of claim 3 further comprising sending signed information from the sender security server to the receiver security device that provides at least one of PID information, carousel information, and URL information that indicates where the respective encrypted CAS download is located and available on the sender security server.

5. The method of claim 4 further comprising decrypting a CAS image, and verifying the CAS image using a respective session key in the receiver security device.

6. The method of claim 5 further comprising sending a signed acknowledgment message to the sender security server when the CAS download is complete.

7. The method of claim 6 further comprising updating the SLK split in one mode of operation, and updating the SLK split and sending the updated SLK split to the sender security server when a rolling key feature is enabled in another mode of operation.

8. The method of claim 7 further comprising verifying the signed acknowledgment message in one mode of operation, and verifying the signed acknowledgment message and storing the updated SLK split for use in a next CAS download using the sender security server in another mode of operation.

9. The method of claim 8 further comprising logging the receiver security device out of a supervisor mode and returning to a user mode.

10. The method of claim 9 wherein the CAS download does not occur unless the signed acknowledgment message is verified, the head-end SLK successfully logs into a supervisor mode of operation, and the decryption of the CAS image is successful.

11. The method of claim 10 wherein a following download of CAS software operation is not performed unless a new SLK is presented to unlock access to the following download operation only when the receiver security device is in the supervisory mode of operation.

12. The method of claim 11 wherein the CAS image is encrypted and decrypted using a CAS image session key in the receiver security device.

13. A system for securely downloading at least one of conditional access software (CAS), Digital Rights Management software (DRMS), Trusted Domain Software (TDS), and Gaming Security Software (GSS), the system comprising:

a headend having a sender security server; and

a receiver coupled to the headend, and having a receiver security device, wherein

the sender security server presents a specialized entitlement management message (EMM) to initiate the download to the receiver security device using a supervisory logon key (SLK) split to logon with a second split contained inside the receiver security device;

the receiver security device presents a receiver digitally signed random challenge to the sender security server to establish authentication of the receiver security device to the sender security server; and

the sender security server signs and returns the receiver random challenge to the receiver security device with a sender random challenge to establish authentication of the sender security server to the receiver security device.

14. The system of claim 13 wherein the receiver security device signs and returns the sender random challenge to the sender security server to complete authentication of the receiver security device to the sender security server.

15. The system of claim 14 wherein the sender security server sends a session download key in a signed and encrypted CAS receive download message.

16. The system of claim 15 wherein the sender security server sends signed information to the receiver security device that provides at least one of PID information, carousel information, and URL information that indicates where the respective CAS download is located and available on the sender security server.

17. The system of claim 16 wherein the receiver security device decrypts a CAS image, and verifies the CAS image using a respective session key.

18. The system of claim 17 wherein the receiver security device sends a signed acknowledgment message to the sender security server when the CAS download is complete.

19. The system of claim 18 wherein the receiver security device updates the SLK split in one mode of operation, and updates the SLK split and sends the updated SLK split to the sender security server when a rolling key feature is enabled in another mode of operation.

20. The system of claim 19 wherein the sender security server verifies the signed acknowledgment message in one mode of operation, and verifies the signed acknowledgment message and stores the updated SLK split for use in a next CAS download in another mode of operation.

21. The system of claim 20 wherein the receiver security device logs out of a supervisor mode and returns to a user mode, and thereby, disables access to downloading at least one of conditional access software (CAS), Digital Rights Management software (DRMS), Trusted Domain Software (TDS), and Gaming Security Software (GSS).

22. The system of claim 13 wherein the receiver security device is coupled to the headend using a network.

23. A receiver security device for securely downloading at least one of conditional access software (CAS), Digital Rights Management software (DRMS), Trusted Domain Software (TDS), and Gaming Security Software (GSS), the device comprising:

a microprocessor;

a transport chip coupled to the microprocessor; and

a memory coupled to the microprocessor, wherein the memory includes programming to perform the steps of;

receiving a specialized entitlement management message (EMM) to initiate the download at the receiver security device using a supervisory logon key (SLK) split to logon with a second split contained inside the receiver security device from a sender security server via the transport chip;

presenting a receiver digitally signed random challenge from the receiver security device to the sender security server to establish authentication of the receiver security device to the sender security server; and

receiving the signed receiver random challenge and a sender random challenge from the sender security server to establish authentication of the sender security server to the receiver security device.