Intrusion detection for object security

• US 7,590,996 B2
• Filed: 04/05/2004
• Issued: 09/15/2009
• Est. Priority Date: 11/12/1999
• Status: Expired due to Fees

• Current Assignee: Google Technology Holdings LLC (Alphabet Inc.)
• Original Assignee: General Instrument Corporation (CommScope Holding Company, Inc.)
• Inventors: Medvinsky, Alexander
• Primary Examiner(s): Miller; John W
• Assistant Examiner(s): MONTOYA, OSCHTA I
• Application Number:
  US10/818,658
• Publication Number:
  US 20040194124A1
• Time in Patent Office: 1,989 Days
• Field of Search: None
• US Class Current: 725/107
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04N 17/004 for digital television systems
• CPC Class Codes: H04N 21/2404 Monitoring of server processing errors or hardware failure error or fault detection G06F11/07; monitoring in general G06F11/30
• CPC Class Codes: H04N 21/25833 involving client hardware characteristics, e.g. manufacturer, processing or storage capabilities allocation of resources considering hardware capabilities in multiprogramming arrangements G06F9/5044; allocation of resources considering software capabilities in multiprogramming arrangements G06F9/5055
• CPC Class Codes: H04N 21/426 Internal components of the client ; Characteristics thereof H04N5/44 takes precedence
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/44236 Monitoring of piracy processes or activities protecting computer platforms against harmful, malicious or unexpected behaviour or activities using intrusion detection and counter measures G06F21/566; computer virus detection and handling G06F21/56
• CPC Class Codes: H04N 21/4424 Monitoring of the internal components or processes of the client device, e.g. CPU or memory load, processing speed, timer, counter or percentage of the hard disk space used error monitoring in general G06F11/30; arrangements for monitoring conditions of receiving stations in broadcast systems H04H60/32; diagnosis, testing or measuring for television receivers H04N17/04
• CPC Class Codes: H04N 21/4425 Monitoring of client processing errors or hardware failure
• CPC Class Codes: H04N 21/4623 Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/4627 Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 7/165 Centralised control of user terminal subsequent to an upstream request signal H04N7/17345; Registering at central by two-way working H04N7/17309
• CPC Class Codes: H04N 7/167 Systems rendering the television signal unintelligible and subsequently intelligible

Abstract

According to the invention, a method for detecting modification to a video content receiver within a content distribution system is described. In one step, a message is generated by a content provider. The message is sent to the content receiver by way of a network. The message includes an intentionally-inserted error that a normally-operating content receiver would detect. The message is check for either authenticity or authorization. The message is received by the content receiver from the network. At a point physically remote to the content receiver, it is detected that the content receiver failed to detect the intentionally-inserted error in the message.

Claims

1. A method for detecting modification to a video content receiver within a conditional access system having a headend coupled with a plurality of video content receivers using a private content distribution network, the method comprising steps of:

generating a message by a content provider of the conditional access system, wherein the message intentionally includes an unauthorized activity;

sending the message to the video content receiver by way of a private content distribution network, wherein;

the private content distribution network allows broadcast from the headend to the video content receivers, and

video content receivers cannot play unauthorized received content;

receiving the message by the video content receiver from the private content distribution network, wherein the unauthorized activity of the message causes an activity not authorized for the video content receiver; and

automatically recording an exception condition if the video content receiver fails to notify the content provider of the unauthorized activity, whereby a properly functioning video content receiver would notify the content provider of this type of unauthorized activity.

2. The method for detecting modification to a video content receiver within a conditional access system having a plurality of video content receivers of claim 1, further comprising a step of randomly placing the unauthorized activity in the message.

3. The method for detecting modification to a video content receiver within a conditional access system having a plurality of video content receivers of claim 1, further comprising steps of detecting if the video content receiver fails to check at least one of authentication of the message and authorization of the message.

4. The method for detecting modification to a video content receiver within a conditional access system having a plurality of video content receivers of claim 1, further comprising a step of loading a portion of the message that disrupts operation of the video content receiver when unauthorized activity occurs.

5. The method for detecting modification to a video content receiver within a conditional access system having a plurality of video content receivers of claim 1, further comprising steps of:

interacting with an unauthorized resource;

detecting if the video content receiver fails to report the interacting step; and

loading a portion of the message that disrupts operation of the video content receiver.

6. The method for detecting modification to a video content receiver within a conditional access system having a plurality of video content receivers of claim 1, further comprising a step of checking authorization of the message.

7. The method for detecting modification to a video content receiver within a conditional access system having a plurality of video content receivers of claim 6, further comprising a step of reporting an exception condition if the video content receiver fails to report the unauthorized activity in response to the checking step.

8. The method for detecting modification to a video content receiver within a conditional access system having a plurality of video content receivers of claim 1, wherein the unauthorized activity is processing the message.

9. The method for detecting modification to a video content receiver within a conditional access system having a plurality of video content receivers of claim 1, wherein the private content distribution network includes one of a cable television network, a satellite television network, a cellular data network, and a packet switched network.

10. A method for detecting modification to a content receiver within a system, the method comprising steps of:

generating a message by a content provider;

sending the message to the content receiver by way of a network, wherein;

the message includes an intentionally-inserted error, and

a normally-operating content receiver would detect the intentionally-inserted error when at least one of the following steps is performed;

checking authenticity of the message, and

checking authorization of the message;

receiving the message by the content receiver from the network; and

automatically detecting, at a point physically remote to the content receiver, that the content receiver failed to detect the intentionally-inserted error in the message.

11. The method for detecting modification to a content receiver within the system of claim 10, wherein the content receiver is a set top box.

12. The method for detecting modification to a content receiver within the system of claim 10, wherein the automatically determining step includes a step of automatically determining an exception condition if the content receiver fails to report an error in response to either of the checking sub-steps.

13. The method for detecting modification to a content receiver within the system of claim 10, further comprising a step of loading a portion of the message that disrupts operation of the content receiver.

14. The method for detecting modification to a content receiver within the system of claim 10, further comprising steps of:

interacting with an unauthorized resource;

detecting if the content receiver fails to report the interacting step; and

loading a portion of the message that disrupts operation of the content receiver.

15. A method for detecting modification to a content receiver within a system, the method comprising steps of:

generating a message by a content provider of the system;

sending the message to a content receiver by way of a network;

receiving the message by the content receiver from the network; and

loading a portion of the message that disrupts operation of the content receiver if the content receiver fails to check at least one of authentication of the message and authorization of the message.

16. The method for detecting modification to the content receiver within the system of claim 15, further comprising a step of verifying the validity of the message as it passes from the content provider to the content receiver.

17. The method for detecting modification to the content receiver within the system of claim 15, further comprising a step of recording an exception condition if the content receiver notifies the content provider of an error in the message.

18. The method for detecting modification to the content receiver within the system of claim 15, further comprising a step of detecting if the content receiver fails to report interacting with an unauthorized resource proscribed by the message.

19. The method for detecting modification to the content receiver within the system of claim 15, further comprising steps of:

checking authenticity of the message, and

checking authorization of the message.