Delivering secure IPTV services to PC platforms

• US 8,321,950 B2
• Filed: 03/20/2009
• Issued: 11/27/2012
• Est. Priority Date: 03/20/2009
• Status: Active Grant

• Current Assignee: Synamedia Limited
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Oran, David R.
• Primary Examiner(s): Gee, Jason K.
• Assistant Examiner(s): Leung, Robert
• Application Number:
  US12/407,810
• Publication Number:
  US 20100239090A1
• Time in Patent Office: 1,348 Days
• Field of Search: None
• US Class Current: 726/26
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04N 21/25816 involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/4143 embedded in a Personal Computer [PC]
• CPC Class Codes: H04N 21/4181 for conditional access
• CPC Class Codes: H04N 21/4183 providing its own processing capabilities, e.g. external module for video decoding
• CPC Class Codes: H04N 21/4184 providing storage capabilities, e.g. memory stick
• CPC Class Codes: H04N 21/426 Internal components of the client ; Characteristics thereof H04N5/44 takes precedence
• CPC Class Codes: H04N 21/4367 Establishing a secure communication between the client and a peripheral device or smart card
• CPC Class Codes: H04N 21/4623 Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/6125 involving transmission via Internet transmission by internet of broadcast information H04H60/82
• CPC Class Codes: H04N 21/63345 by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 21/63775 for uploading keys, e.g. for a client to communicate its public key to the server key management H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 21/8173 End-user applications, e.g. Web browser, game
• CPC Class Codes: H04N 7/17318 Direct or substantially direct transmission and handling of requests

Abstract

To prevent theft of protected content when IPTV services are provided, a conditional access device (CAD) is connected to a personal computer (PC). An application is launched on the PC from the CAD over universal serial bus (USB) interface. The application configures the PC to allow a user to receive secure internet protocol television (IPTV) services. The conditional access device and an IPTV service provider determine user access to the IPTV services via a network by using a trusted computing base (TCB) on the CAD and keys stored on the CAD. The application decrypts and decodes the IPTV services using the processing and storage capability of the PC. The CAD also receives and processes remote control signals received from a remote control interface. The remote control signals are requests or responses from the user interacting with the application. The application displays content requested by the user or indications of responses by the user via a user interface on the PC.

Claims

1. A method comprising:

detecting an active interface between a conditional access device (CAD) and a general purpose computer;

launching an application previously stored on the CAD on the general purpose computer from the CAD via the active interface, wherein the application configures the general purpose computer to allow a user to interact with the application in order to subscribe to internet protocol television (IPTV) services, receive and interact with the IPTV services, decrypt and decode content provided by the IPTV services, display the content to the user, process user requests, and present options associated with the IPTV services to the user;

requesting access to the IPTV services via a network using the general purpose computer, wherein the conditional access device and an IPTV service provider determine user access to the IPTV services via the network by using a trusted computing base (TCB) on the CAD and using a hierarchy of keys derived from root keys stored on the CAD;

deriving a content decryption key using the hierarchy of keys;

providing access to the IPTV services upon determining the user has access to the IPTV services by sending content decryption keys supplied by the TCB from the CAD to the application, wherein the application decrypts and decodes the IPTV services using the content decryption key, and processing and storage capability of the general purpose computer;

receiving and processing remote control signals at and by the CAD, wherein the signals are requests or responses from the user interacting with the application; and

displaying content requested by the user or indications of responses from the user.

2. The method of claim 1, wherein detecting comprises detecting a Universal Serial Bus (USB) interface, wherein the CAD is present on the USB.

3. The method of claim 1, further comprising detecting from the IPTV service provider when a new version of the application is available and securely upgrading the application via the network, wherein securely upgrading comprises upgrading by using a secure communication channel and/or digitally signed application code.

4. The method of claim 1, further comprising detecting from the IPTV service provider when a new version of CAD software is available and securely upgrading the conditional access device software via the network, wherein securely upgrading comprises upgrading by using a secure communication channel and/or digitally signed software media.

5. The method of claim 1, wherein accessing comprises accessing the content using digital rights management (DRM).

6. The method of claim 1, wherein receiving and processing comprises receiving and processing remote control signals comprising subscriber account information, channel change requests, digital video recorder commands, and interactive inputs associated with the IPTV services.

7. The method of claim 1, wherein the application requires a username and/or password, and wherein the username and or password are associated with a level of allowable IPTV content.

8. An apparatus comprising:

a first interface configured to communicate with a general purpose computer;

a processing suite comprising a trusted computing base with non-volatile memory and configured to;

launch an application via the first interface, wherein the application configures the general purpose computer to allow a user to interact with the application in order to subscribe to IPTV services, receive and interact with the IPTV services, decrypt and decode content provided by the IPTV services, display the content to the user, process user requests, and present options associated with the IPTV services to the user;

generate content decryption keys via a key hierarchy;

send the content decryption keys to the application for the application to decrypt the content;

a memory for storing the application, data, and a processing instruction set; and

a second interface configured to communicate with a remote control device, wherein the remote control device allows the user to interact with the application.

9. The apparatus of claim 8, wherein the first interface is a Universal Serial Bus (USB) interface.

10. The apparatus of claim 8, wherein the processing suite further comprises a reduced instruction set processor.

11. The apparatus of claim 8, wherein the processing suite is further configured to securely upgrade the application, wherein the processing suite upgrades the application using a secure communication channel and/or digitally signed application code.

12. The apparatus of claim 8, wherein the processing suite is further configured to securely upgrade the processing instruction set, wherein the processing suite upgrades the application using a secure communication channel and/or a digitally signed processing instruction set.

13. The apparatus of claim 8, wherein the processing suite is further configured to control access to the content using digital rights management (DRM).

14. The apparatus of claim 8, wherein the second interface is one of an infrared interface, a radio frequency interface, and a wireline interface.

15. The apparatus of claim 8, wherein the apparatus is portable.

16. A system comprising:

a general purpose computer coupled to a network and configured to receive an application from a conditional access device and run the application, wherein the application configures the general purpose computer to allow a user to interact with the application in order to subscribe to the IPTV services, receive and interact with the IPTV services, decrypt and decode content provided by the IPTV services, display the content to the user, process user requests, and present options associated with the IPTV services to the user; and

a conditional access device (CAD) coupled to the general purpose computer comprising;

a first interface configured to communicate with the general purpose computer;

a processing suite comprising a trusted computing base with non-volatile memory configured to;

launch the application via the first interface;

generate content decryption keys via a key hierarchy;

send the content decryption keys to the application for the application to decrypt the content;

a memory for storing the application, data, and a processing instruction set; and

a second interface configured to communicate with a remote control device.

17. The system of claim 16, wherein the first interface of the CAD is a Universal Serial Bus (USB) interface.

18. The system of claim 16, wherein the processing suite of the CAD further comprises a reduced instruction set processor.

19. The system of claim 16, wherein the processing suite of the CAD is further configured to securely upgrade the application, wherein the processing suite upgrades the application using a secure communication channel and/or digitally signed application code.

20. The system of claim 16, wherein the processing suite of the CAD is further configured to securely upgrade the processing instruction set, wherein the processing suite upgrades the application using a secure communication channel and/or a digitally signed processing instruction set.

21. The system of claim 16, wherein the processing suite of the CAD is further configured to control access to the content using digital rights management (DRM).

22. The system of claim 16, wherein the second interface of the CAD is one of an infrared interface, a radio frequency interface, and a wireline interface.