Digital media conditional access system for handling digital media content

• US 7,590,243 B2
• Filed: 05/02/2005
• Issued: 09/15/2009
• Est. Priority Date: 05/04/2004
• Status: Active Grant

• Current Assignee: DIRECTV, LLC (AT&T, Inc.)
• Original Assignee: The DIRECTV Group, Inc. (AT&T, Inc.)
• Inventors: James, Thomas H., Kahn, Raynold M., Klauss, Peter M., Ha, David D.
• Primary Examiner(s): Barron, Jr.; Gilberto
• Assistant Examiner(s): Okeke; Izunna
• Application Number:
  US11/119,712
• Publication Number:
  US 20050249350A1
• Time in Patent Office: 1,597 Days
• Field of Search: 380/239, 380/240, 380/278, 380/282
• US Class Current: 380/239
• CPC Class Codes: H04N 21/2541 Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/26606 for generating or managing entitlement messages, e.g. Entitlement Control Message [ECM] or Entitlement Management Message [EMM] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/26613 for generating or managing keys in general key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04
• CPC Class Codes: H04N 21/4181 for conditional access
• CPC Class Codes: H04N 21/43615 Interfacing a Home Network, e.g. for connecting the client to a plurality of peripherals home Audio Video Interoperability [HAVI] data switching networks H04L12/2805
• CPC Class Codes: H04N 21/4367 Establishing a secure communication between the client and a peripheral device or smart card
• CPC Class Codes: H04N 21/4623 Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/63345 by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 7/163 by receiver means only
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

A method, apparatus, and article of manufacture provide the ability to process digital media content. A secret key (Ka) is obtained and encrypted into an authorization key message (AKM) message. One or more entitlement keys (Ke) are then obtained and encrypted using the secret key (Ka) as an encryption key into an entitlement management message (EMM). One or more media content encryption keys (Kc) are obtained and encrypted using one or more of the entitlement keys (Ke) as encryption keys into an entitlement control message (ECM). Digital media data content (Dc) is then obtained and encrypted using the one or more media content encryption keys (Kc). The AKM, EMM, ECM, and encrypted digital media data content are then delivered to a set-top box that is configured to provide digital media services with the content.

Claims

1. A method for processing digital media content comprising:

obtaining, in a broadcast headend, a secret authorization key (Ka);

obtaining, in the broadcast headend, a secret encryption key (SCK) that is associated with a set-top box;

encrypting, in the broadcast headend, the authorization key (Ka) using the secret encryption key (SCK) into an authorization key message (AKM) message, wherein the same secret encryption key (SCK) is used to decrypt the encrypted authorization key (Ka) by the set-top box;

obtaining, in the broadcast headend, one or more entitlement keys (Ke);

encrypting, in the broadcast headend, the one or more entitlement keys (Ke) using the authorization key (Ka) as an encryption key into an entitlement management message (EMM);

obtaining, in the broadcast headend, one or more media content encryption keys (Kc);

encrypting, in the broadcast headend, each of the media content encryption keys (Kc) using one or more of the entitlement keys (Ke) as encryption keys into an entitlement control message (ECM);

obtaining, in the broadcast headend, digital media data content (Dc);

encrypting, in the broadcast headend, the digital media data content using the one or more media content encryption keys (Kc);

delivering, from the broadcast headend, the AKM, EMM, ECM, and encrypted digital media data content to the set-top box configured to provide digital media services with the content.

2. The method of claim 1, wherein the secret encryption key (SCK) comprises a secret chip key (SCK) that is programmed into a secure chip of the set-top box.

3. The method of claim 1, wherein the Ka is periodically modified.

4. The method of claim 1, wherein the AKM message further comprises AKM related metadata (Ma) that comprises a time period for which the authorization key Ka applies.

5. The method of claim 1, wherein the EMM further comprises encrypted entitlement related metadata (Me) that defines one or more usage rules of the one or more entitlement keys.

6. The method of claim 1, further comprising changing the entitlement keys on a regular basis.

7. The method of claim 1, wherein a type of one or more of the entitlement keys is selected from a group consisting of:

a broadcast key (Kb) for content broadcast to all users;

a service key (Ks) for services subscribed to by a customer;

a unique key (Ku) for delivery of content to a specific customer;

a transaction key (Kt) for transaction authentication; and

a reportback key (Kr) for encryption and authentication of reportback data.

8. The method of claim 1, wherein the ECM further comprises associated encrypted media content metadata (Mc) that defines one or more usage rules for the media content.

9. The method of claim 1, wherein the set-top box is a personal video recorder (PVR).

10. The method of claim 1, wherein the digital media content comprises a music jukebox.

11. The method of claim 1, wherein the digital media content comprises a delayed purchasable pay-per-view that is stored in the STB.

12. The method of claim 1, wherein the digital media content comprises a video on-demand program.

13. The method of claim 1, wherein the digital media content comprises a gaming service.

14. The method of claim 1, wherein the digital media content comprises one or mote modular digital media objects.

36. The method of claim 1, further comprising:

obtaining, in the broadcast headend, a second secret encryption key associated with a second set-top box;

encrypting, in the broadcast headend, the authorization key (Ka) using the second secret encryption key into a second authorization key message (AKM) message;

delivering, from the broadcast headend, the second AKM, the EMM, ECM, and encrypted digital media data content to the second set-top box configured to provide digital media services with the content.

15. A system for processing digital media content in a set-top box, comprising:

(a) a set-top box (STB) configured to receive, from a broadcast headend;

(i) a secret authorization key (Ka) encrypted, by the broadcast headend, using a secret encryption key (SCK) associated with the STB;

(ii) an entitlement management message (EMM) comprising one or more entitlement keys (Ke) encrypted using the Ka;

(iii) an entitlement control message (ECM) comprising one or more media content encryption keys (Kc) encrypted using the one or more Ke;

(iv) digital media content (Dc) encrypted using the one or more Kc;

(b) a decryption algorithm on the STB configured to;

(i) decrypt the Ka using the same SCK;

(ii) decrypt the Ke using the Ka;

(iii) decrypt the Kc using the Ke; and

(iv) decrypt the Dc using the Kc;

wherein the STB is configured to provide digital media services with the decrypted Dc.

16. The STB of claim 15, wherein the authorization key Ka is periodically modified.

17. The STB of claim 15, further comprising a secure chip communicatively coupled to the STB, wherein:

the secure encryption key (SCK) comprises a secret chip key that is programmed into the secure chip; and

the authorization key Ka is decrypted in the secure chip using the SCK.

18. The STB of claim 17, wherein:

the decrypted authorization key Ka is stored in the secure chip; and

the entitlement key Ke is decrypted in the secure chip using the authorization key Ka.

19. The STB of claim 18, wherein:

the decrypted entitlement key Ke is stored in the secure chip; and

the content key Kc is decrypted in the secure chip using the entitlement key Ke.

20. The STB of claim 19, wherein:

the decrypted content key Kc is stored in the secure chip; and

the digital media content is decrypted in the secure chip using the content key Kc.

21. The STB of claim 15, wherein the AKM message further comprises authorization related metadata (Ma) that comprises a time period for which the authorization key Ka applies.

22. The STB of claim 15, wherein the EMM further comprises encrypted entitlement related metadata (Me) that defines one or more usage rules of the one or more entitlement keys.

23. The STB of claim 15, wherein the one or more entitlement keys are changed on a regular basis.

24. The STB of claim 15, wherein a type of one or more of the entitlement keys is selected from a group consisting of:

a broadcast key (Kb) for content broadcast to all users;

a service key (Ks) for services subscribed to by a customer;

a unique key (Ku) for delivery of content to a specific customer;

a transaction key (Kt) for transaction authentication; and

a reportback key (Kr) for encryption and authentication of reportback data.

25. The STB of claim 15, wherein the ECM further comprises associated encrypted media content metadata (Mc) that defines one or more usage rules for the media content.

26. The STB of claim 15, further comprising a hard disk communicatively coupled to the STB wherein the hard disk is configured to store the digital media content.

27. The STB of claim 15, wherein the digital media content comprises a music jukebox.

28. The STB of claim 15, wherein the digital media content comprises a delayed purchasable pay-per-view that is stored in the hard disk drive.

29. The STB of claim 15, wherein the digital media content comprises a video on-demand program.

30. The STB of claim 15, wherein the digital media content comprises a gaming service.

31. The STB of claim 15, wherein the digital media content comprises one or more modular digital media objects.

32. The STB of claim 15, further comprising a smart card communicatively coupled to the STB, wherein:

the smart card receives messages from the STB;

the smart card further processes these messages;

the STB receives these further processed messages from the smart card;

the STB uses these messages from the smart card for processing digital media content.

33. The STB of claim 32, wherein a further processed message from the smart card comprises an encrypted authorization key Ka.

34. The STB of claim 32, wherein a further processed message from the smart card comprises an EMM.

35. The STB of claim 32, wherein a further processed message from the smart card comprises an ECM.