Configurable access kernel

• US 7,934,083 B2
• Filed: 09/14/2007
• Issued: 04/26/2011
• Est. Priority Date: 09/14/2007
• Status: Active Grant

• Current Assignee: Comcast Cable Holdings LLC (Comcast Corporation)
• Original Assignee: Comcast Cable Holdings LLC (Comcast Corporation)
• Inventors: Fahrny, James, Manson, Azita Miahnahri, Davoust, Nancy Louise, Lilly, Henry Clarence III, Twigger, Andrew T., Helms, William Lynn, Taylor, Kevin Norman
• Primary Examiner(s): TRAN, VINCENT HUY
• Application Number:
  US11/855,735
• Publication Number:
  US 20090077362A1
• Time in Patent Office: 1,320 Days
• Field of Search: 713/1, 713/2, 713/191, 713/192, 348/725, 380/203
• US Class Current: 713/1
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: H04N 21/443 OS processes, e.g. booting an STB, implementing a Java virtual machine in an STB or power management in an STB
• CPC Class Codes: H04N 21/4623 Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14

Abstract

A highly configurable kernel supports a wide variety of content protection systems. The kernel may reside in a host that interacts with a secure processor maintaining content protection clients. After establishing communication with the secure processor, the host receives messages from content protection clients requesting rules for message handling operations to support client operations. This flexible configuration allows for dynamic reconfiguration of host and secure processor operation.

Claims

1. A content stream system, comprising:

a secure processor configured to maintain a plurality of content protection clients, each content protection client having a set of functional requirements for message communication; and

a host in local communication with the secure processor, the host configured to support a configurable kernel for interfacing with the secure processor, the kernel configured to send a request to the secure processor, identify at least one content protection client maintained by the secure processor based on a response to the request, send a message to at least one of the at least one identified content protection client, receive at least one parameter group request from the at least one identified content protection client, and configure message handling for the at least one identified content protection client based on the received at least one parameter group request.

2. The system of claim 1 wherein the host is further configured to receive a message and, if the message is destined for the at least one identified content protection client, apply operations specified in the at least one parameter group request to the received message.

3. The system of claim 1 wherein the host is configured to support a plurality of connection types, the kernel further configured to establish at least one connection of at least one connection type for each of the at least one identified content protection client based on a connection identifier and a connection type specified in a message received from the at least one identified content protection client.

4. The system of claim 1 wherein the host is configured to request the secure processor to yield execution in response to a message sent to the secure processor.

5. The system of claim 1, wherein the secure processor is configured to manage connections with an entity that is external to the host and external to the secure processor by using the host as a proxy;

and wherein the host is configured to report the status of the connections to the secure processor.

6. The system of claim 1 wherein the at least one parameter group request specifies filtering parameters for selectively filtering messages received by the host.

7. The system of claim 6 wherein the host is configured to implement a plurality of queues arranged in a priority hierarchy for each of the at least one identified content protection client, the at least one parameter group request specifying into which queue messages received by the host will be placed based on the specified filter parameters.

8. The system of claim 6 wherein the host is configured to process duplicate received messages based on the selective filtering.

9. A content method, the method comprising:

sending a request to a secure processor requesting information about a plurality of content protection clients;

receiving, in response to the sent request, information identifying each of the plurality of content protection clients;

sending a message to each of the identified content protection clients;

receiving message handling instructions from at least one of the identified content protection clients;

configuring message handling operations for the at least one identified content protection client based on the received message handling instructions, the message handling operations including parameters for selectively filtering received messages;

establishing a hierarchical set of message queues having at least three levels of priority;

receiving, for each identified content protection client, a message specifying queue configuration; and

assigning to each identified content protection client a queue from at least two of the at least three levels of priority based on the received message specifying queue configuration.

10. The method of claim 9 further comprising establishing at least one data connection for the at least one identified content protection client based on a connection identifier and a connection type specified in a message received from the at least one identified content protection client.

11. The method of claim 9 further comprising placing a received message into one of the queues assigned to the at least one identified content protection client based on the results of the selective filtering.

12. The method of claim 9 further comprising processing a duplicate received message based on the results of the selective filtering.

13. The method of claim 9 further comprising:

establishing a status message queue for each of the at least one identified content protection client; and

determining from which queue to send a next message based on a dequeuing algorithm that provides priority to higher-priority message queues over lower-priority message queues, wherein the status message queues are considered members of each of the levels of priority.

14. The method of claim 9 further comprising requesting the secure processor to yield execution in response to a message sent to the secure processor.

15. The method of claim 9 further comprising parsing a received message based on the results of the selective filtering.

16. The method of claim 9 further comprising:

receiving at a host downloaded code implementing at least one of the plurality of content protection clients;

segmenting the downloaded code into a plurality of messages;

sending the plurality of messages to the secure processor; and

sending a request to the secure processor requesting information about the at least one content protection client implemented by the downloaded code.

17. A content stream system, comprising:

a secure processor configured to maintain a plurality of content protection clients, each content protection client having a set of functional requirements for message communication; and

a host in local communication with the secure processor, the host configured to support a configurable kernel for interfacing with the secure processor, the kernel configured to send a request to the secure processor, identify at least one content protection client maintained by the secure processor based on a response to the request, send a message to at least one of the at least one identified content protection client, receive at least one parameter group request from the at least one identified content protection client, and configure message handling for the at least one identified content protection client based on the received at least one parameter group request;

wherein the host is configured to implement a high priority queue for at least one content protection client and at least one lower priority queue for each of a plurality of content protection clients based on configuration information for each content protection client, the host configured to handle every message in the high priory queue for each of the at least one content protection client before handling any message in the lower priority queues.

18. The system of claim 17 wherein the host is further configured to receive a message and, if the message is destined for the at least one identified content protection client, apply operations specified in the at least one parameter group request to the received message.

19. The system of claim 17 wherein the host is configured to support a plurality of connection types, the kernel further configured to establish at least one connection of at least one connection type for each of the at least one identified content protection client based on a connection identifier and a connection type specified in a message received from the at least one identified content protection client.

20. The system of claim 17 wherein the host is configured to request the secure processor to yield execution in response to a message sent to the secure processor.

21. The system of claim 17 wherein the at least one parameter group request specifies filtering parameters for selectively filtering messages received by the host.

22. The system of claim 21 wherein the filtering parameters specify which queue messages received by the host will be placed into.

23. The system of claim 21 wherein the host is configured to process duplicate received messages based on the selective filtering.

24. The system of claim 17 wherein the at least one lower priority queue for each of the plurality of content protection clients is at least two lower priority queues for each of the plurality of content protection clients, a mid priority queue and a low priority queue with priority less than the mid priority queue, and the host is configured to handle a plurality of messages in the mid priority queues in a round robin fashion according to a queue selection algorithm before handling messages in the low priority queues, then to handle at least one message in the low priority queues.

25. The system of claim 24 wherein each of the plurality of content protection clients is assigned a status queue for holding status messages, and the host is configured to treat each status queue as a mid priority queue during round robin processing of the mid priority queues and to treat each status queue as a low priority queue during round robin processing of low priority queues.