Data authentication with a secure environment

• US 7,715,552 B2
• Filed: 07/05/2006
• Issued: 05/11/2010
• Est. Priority Date: 07/05/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Scientific-Atlanta LLC (Cisco Systems, Inc.)
• Inventors: Pinder, Howard G., Sedacca, David A.
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): Reza; Mohammad W
• Application Number:
  US11/428,746
• Publication Number:
  US 20080010469A1
• Time in Patent Office: 1,406 Days
• Field of Search: 380/28, 380/230, 380/239, 380/280
• US Class Current: 380/28
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/2351 involving encryption of additional data arrangements using cryptography for the use of broadcast information or broadcast-related information H04H60/23
• CPC Class Codes: H04N 21/25816 involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/25875 involving end-user authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; arrangements for secret or secure communication including means for verifying the identity or authority of a user of the system H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/26613 for generating or managing keys in general key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04
• CPC Class Codes: H04N 21/4353 involving decryption of additional data arrangements using cryptography for the use of broadcast information or broadcast-related information H04H60/23
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/4623 Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/4627 Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/8355 involving usage data, e.g. number of copies or viewings allowed
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

Included are systems and methods for data authentication. At least one embodiment of a system includes a secure processor configured as a physically secure environment, the secure processor further configured to receive a control word from a headend, the secure processor further configured to encrypt the received control word using a first encryption key. Other embodiments of a system includes a transport processor configured to receive the encrypted control word, the transport processor further configured to decrypt the received control word using a first decryption key, wherein the first decryption key is compatible with the first encryption key.

Claims

1. A system for data authentication, comprising:

a secure processor comprising a physically secure environment wherein, subsequent to manufacture of the secure processor, operations and calculations made within the secure environment are unobservable by other components outside of the secure processor, the secure processor configured to;

receive an encrypted control word from a headend via a first Entitlement Control Message (ECM),

decrypt the encrypted control word using a second decryption key to render the control word,

encrypt the control word using a first encryption key,

receive usage rights data from the headend via a second ECM,

encrypt the received usage rights data using the control word, and

send the received usage rights data; and

a transport processor configured to;

receive the encrypted control word that was encrypted using the first encryption key from the secure processor,

decrypt the received control word using a first decryption key, wherein the first decryption key is compatible with the first encryption key,

receive the encrypted usage rights data from the secure processor,

decrypt the received usage rights data using the control word, and

send the decrypted usage rights data to a display device.

2. The system of claim 1, wherein the transport processor is further configured to receive encrypted programming data from the headend, wherein the transport processor is further configured to decrypt the encrypted programming data using the decrypted control word.

3. The system of claim 2, wherein the transport processor is further configured to send the decrypted programming data to the display device.

4. The system of claim 1, wherein the secure processor is further configured to create at least one pattern in the usage rights data.

5. The system of claim 1, wherein the transport processor and the transport processor are contained in one set top terminal.

6. A method for data authentication, the method comprising:

receiving, at a secure processor, an encrypted control word from a headend via a first Entitlement Control Message (ECM), wherein the secure processor comprises a physically secure environment wherein, subsequent to manufacture of the secure processor, operations and calculations made within the secure environment are unobservable by other components outside of the secure processor;

decrypting, at the secure processor, the encrypted control word using a second decryption key to render the control word;

encrypting, at the secure processor, the control word using a first encryption key;

receiving, at the secure processor, usage rights data from the headend via a second ECM;

encrypting, at the secure processor, the received usage rights data using the control word;

sending, from the secure processor, the received usage rights data;

receiving, at a transport processor, the encrypted control word that was encrypted using the first encryption key from the secure processor;

decrypting, at the transport processor, the received control word using a first decryption key, wherein the first decryption key is compatible with the first encryption key;

receiving, at the transport processor, the encrypted usage rights data from the secure processor;

decrypting, at the transport processor, the received usage rights data using the control word; and

sending, from the transport processor, the decrypted usage rights data to a display device.

7. The method of claim 6, further comprising:

receiving, at the transport processor, encrypted programming data from the headend; and

decrypting, at the transport processor, the encrypted programming data using the decrypted control word.

8. The method of claim 7, further comprising sending, from the transport processor, the decrypted programming data to the display device.

9. The method of claim 6, further comprising creating, at the secure processor, at least one pattern in the usage rights data.

10. The method of claim 6, wherein the transport processor and the transport processor are contained in one set top terminal.

11. Computer-readable storage media that store sets of instructions which when executed on respective processors perform a method for providing data authentication, the method executed by the sets of instructions comprising:

receiving, at a secure processor, an encrypted control word from a headend via a first Entitlement Control Message (ECM), wherein the secure processor comprises a physically secure environment wherein, subsequent to manufacture of the secure processor, operations and calculations made within the secure environment are unobservable by other components outside of the secure processor;

decrypting, at the secure processor, the encrypted control word using a second decryption key to render the control word;

encrypting, at the secure processor, the control word using a first encryption key;

receiving, at the secure processor, usage rights data from the headend via a second ECM;

encrypting, at the secure processor, the received usage rights data using the control word;

sending, from the secure processor, the received usage rights data;

receiving, at a transport processor, the encrypted control word that was encrypted using the first encryption key from the secure processor;

decrypting, at the transport processor, the received control word using a first decryption key, wherein the first decryption key is compatible with the first encryption key;

receiving, at the transport processor, the encrypted usage rights data from the secure processor;

decrypting, at the transport processor, the received usage rights data using the control word; and

sending, from the transport processor, the decrypted usage rights data to a display device.

12. The computer-readable storage media of claim 11, further comprising:

receiving, at the transport processor, encrypted programming data from the headend; and

decrypting, at the transport processor, the encrypted programming data using the decrypted control word.

13. The computer-readable storage media of claim 12, further comprising sending, from the transport processor, the decrypted programming data to the display device.

14. The computer-readable storage media of claim 11, further comprising creating, at the secure processor, at least one pattern in the usage rights data.

15. The computer-readable storage media of claim 11, wherein the transport processor and the transport processor are contained in one set top terminal.