Configurable access kernel

• US 8,307,199 B2
• Filed: 03/04/2011
• Issued: 11/06/2012
• Est. Priority Date: 09/14/2007
• Status: Active Grant

• Current Assignee: Comcast Cable Communications LLC (Comcast Corporation)
• Original Assignee: Comcast Cable Holdings LLC (Comcast Corporation)
• Inventors: Taylor, Kevin Norman, Fahrny, James, Helms, William Lynn, Manson, Azita Miahnahri, Twigger, Andrew T., Davoust, Nancy Louise, Lilly, Henry Clarence III
• Primary Examiner(s): TRAN, VINCENT HUY
• Application Number:
  US13/040,353
• Publication Number:
  US 20110191572A1
• Time in Patent Office: 613 Days
• Field of Search: 713/1, 713/2, 713/191, 713/192, 705/901, 348/725, 380/203
• US Class Current: 713/1
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: H04N 21/443 OS processes, e.g. booting an STB, implementing a Java virtual machine in an STB or power management in an STB
• CPC Class Codes: H04N 21/4623 Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14

Abstract

A highly configurable kernel supports a wide variety of content protection systems. The kernel may reside in a host that interacts with a secure processor maintaining content protection clients. After establishing communication with the secure processor, the host receives messages from content protection clients requesting rules for message handling operations to support client operations. This flexible configuration allows for dynamic reconfiguration of host and secure processor operation.

Claims

1. A method comprising:

sending from a host a request to a secure processor requesting information about a plurality of content protection clients maintained by the secure processor;

receiving, in response to the sent request, information identifying each of the plurality of content protection clients maintained by the secure processor;

sending a message to one or more of the identified content protection clients;

receiving message handling instructions from at least one of the identified content protection clients; and

configuring message handling operations for the at least one identified content protection client based on the received message handling instructions, the message handling operations including parameters for selectively filtering received messages.

2. The method of claim 1 further comprising establishing at least one data connection for the at least one identified content protection client based on a connection identifier and a connection type specified in a message received from the at least one identified content protection client.

3. The method of claim 1 further comprising placing a received message into one of a plurality of queues assigned to the at least one identified content protection client based on the results of the selective filtering.

4. The method of claim 1 further comprising processing a duplicate received message based on the results of the selective filtering.

5. The method of claim 1 further comprising:

establishing a first set of message queues, at least one identified content protection client receiving messages from a member queue of the first set;

establishing a second set of message queues having a lower priority than the message queues in the first set of message queues, at least one identified content protection client receiving messages from a member queue of the second set;

establishing a status message queue for each of the at least one identified content protection clients; and

determining from which queue to send a next message based on a dequeuing algorithm that provides priority to the first set of message queues over the second set of message queues, wherein the status message queues are members of both the first set of message queues and the second set of message queues.

6. The method of claim 1 further comprising requesting the secure processor to yield execution in response to a message sent to the secure processor.

7. The method of claim 1 further comprising parsing a received message based on the results of the selective filtering.

8. The method of claim 1 further comprising:

receiving at the host downloaded code implementing at least one of the plurality of content protection clients;

segmenting the downloaded code into a plurality of messages;

sending the plurality of messages to the secure processor; and

sending a request to the secure processor requesting information about the at least one content protection client implemented by the downloaded code.

9. The method of claim 1 further comprising:

setting up a data connection with an external entity and reporting changes in the state of the data connection to the secure processor.

10. The method of claim 1 further comprising:

establishing a hierarchical set of message queues having at least three levels of priority;

receiving, for each identified content protection client, a message specifying queue configuration; and

assigning to each identified content protection client a queue from at least two of the at least three levels of priority based on the received message specifying queue configuration.

11. A system comprising:

one or more computers configured to;

send a request to a secure processor requesting information about a plurality of content protection clients maintained by the secure processor;

receive, in response to the sent request, information identifying each of the plurality of content protection clients maintained by the secure processor;

send a message to one or more of the identified content protection clients;

receive message handling instructions from at least one of the identified content protection clients; and

configure message handling operations for the at least one identified content protection client based on the received message handling instructions, the message handling operations including parameters for selectively filtering received messages.

12. The system of claim 11, wherein the one or more computers are further configured to establish at least one data connection for the at least one identified content protection client based on a connection identifier and a connection type specified in a message received from the at least one identified content protection client.

13. The system of claim 11, wherein the one or more computers are further configured to place a received message into one of a plurality of queues assigned to the at least one identified content protection client based on the results of the selective filtering.

14. The system of claim 11, wherein the one or more computers are further configured to process a duplicate received message based on the results of the selective filtering.

15. The system of claim 11, wherein the one or more computers are further configured to:

establish a first set of message queues, at least one identified content protection client receiving messages from a member queue of the first set;

establish a second set of message queues having a lower priority than the message queues in the first set of message queues, at least one identified content protection client receiving messages from a member queue of the second set;

establish a status message queue for each of the at least one identified content protection clients; and

determine from which queue to send a next message based on a dequeuing algorithm that provides priority to the first set of message queues over the second set of message queues, wherein the status message queues are members of both the first set of message queues and the second set of message queues.

16. The system of claim 11, wherein the one or more computers are further configured to request the secure processor to yield execution in response to a message sent to the secure processor.

17. The system of claim 11, wherein the one or more computers are further configured to parse a received message based on the results of the selective filtering.

18. The system of claim 11, wherein the one or more computers are further configured to:

receive downloaded code implementing at least one of the plurality of content protection clients;

segment the downloaded code into a plurality of messages;

send the plurality of messages to the secure processor; and

send a request to the secure processor requesting information about the at least one content protection client implemented by the downloaded code.

19. The system of claim 11, wherein the one or more computers are further configured to set up a data connection with an external entity and reporting changes in the state of the data connection to the secure processor.

20. The system of claim 11, wherein the one or more computers are further configured to:

establish a hierarchical set of message queues having at least three levels of priority;

receive, for each identified content protection client, a message specifying queue configuration; and

assign to each identified content protection client a queue from at least two of the at least three levels of priority based on the received message specifying queue configuration.