Method and apparatus for billing and security architecture for venue-cast services

• US 8,452,011 B2
• Filed: 09/29/2009
• Issued: 05/28/2013
• Est. Priority Date: 10/24/2008
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Guo, Jiming, Fan, Mingxi
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): CRIBBS, MALCOLM
• Application Number:
  US12/569,705
• Publication Number:
  US 20100104103A1
• Time in Patent Office: 1,337 Days
• Field of Search: None
• US Class Current: 380/241
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent

Abstract

A security system is applied to venue-cast content transmissions over a broadcast/multicast network infrastructure. The broadcast network infrastructure may be Evolution-Data Only Broadcast Multicast Services (BCMCS) that facilitates distribution of a subscription-based content delivery service. A venue-cast service can be part of the subscription-based content delivery service and has an associated service key. Upon subscribing to the content delivery service, the subscriber access terminal is given the service key. Such service key may be associated with a particular subscriber package and/or venue location. The same service key is provided to the broadcast network infrastructure that broadcasts venue-cast content. A broadcast access key is generated by the broadcast network infrastructure and used to encrypt venue-specific content to be broadcasted. Consequently, only access terminals that have received the service key (e.g., subscribe to the associated subscription package and/or are located at a specific venue or location) can decrypt the broadcasted content.

Claims

1. A method operational on an access terminal for receiving venue-specific broadcast content, comprising:

initiating a subscription or licensing process with a subscription-based service;

receiving a venue service key and a flow identifier from the subscription-based service, wherein the venue service key is specific to a particular venue;

generating a broadcast access key based on at least the venue service key and the flow identifier;

updating the venue service key based on an identifier;

updating the broadcast access key based on the updated venue service key;

receiving a venue-specific content broadcast encrypted with the broadcast access key; and

decrypting the received venue-specific content using the broadcast access key.

2. The method of claim 1, wherein the venue-specific content is received from an Evolution Data-Only (EVDO) broadcast/multicast server (BCMCS).

3. The method of claim 1, wherein the venue service key is specific to a particular subscription package for the subscription-based service.

4. An access terminal, comprising:

a first wireless interface;

a processing circuit coupled to the first wireless interface, the processing circuit adapted to

initiate a subscription or licensing process with a subscription-based service;

receive a venue service key and a flow identifier from the subscription-based service, wherein the venue service key is specific to a particular venue;

generate a broadcast access key based on at least the venue service key and the flow identifier;

update the venue service key based on an identifier;

update the broadcast access key based on the updated venue service key;

receive a venue-specific content broadcast encrypted with the broadcast access key; and

decrypt the received venue-specific content using the broadcast access key.

5. The access terminal of claim 4, further comprising:

a second wireless interface coupled to the processing circuit, wherein the subscription or licensing process is performed over the first wireless interface and the venue-specific content broadcast is received over the second wireless interface.

6. The access terminal of claim 4, wherein the venue service key is specific to a particular subscription package for the subscription-based service.

7. An access terminal, comprising:

means for initiating a subscription or licensing process with a subscription-based service;

means for receiving a venue service key and a flow identifier from the subscription-based service, wherein the venue service key is specific to a particular venue;

means for generating a broadcast access key based on at least the venue service key and the flow identifier;

means for updating the venue service key based on an identifier;

means for updating the broadcast access key based on the updated venue service key;

means for receiving a venue-specific content broadcast encrypted with the broadcast access key; and

means for decrypting the received venue-specific content using the broadcast access key.

8. A processor comprising:

a processing circuit to;

initiate a subscription process with a subscription-based service;

receive a venue service key and a flow identifier from the subscription-based service, wherein the venue service key is specific to a particular venue;

generate a broadcast access key based on at least the venue service key and the flow identifier;

update the venue service key based on an identifier;

update the broadcast access key based on the updated venue service key;

receive broadcast venue-specific content encrypted by the broadcast access key; and

decrypt the received venue-specific content using the broadcast access key.

9. A non-transitory machine-readable medium comprising instructions operational in an access terminal for receiving venue-specific broadcast content, which when executed by one or more processors causes the processors to:

initiate a subscription or licensing process with a subscription-based service;

receive a venue service key and a flow identifier from the subscription-based service, wherein the venue service key is specific to a particular venue;

generate a broadcast access key based on at least the venue service key and the flow identifier;

update the venue service key based on an identifier;

update the broadcast access key based on the updated venue service key;

receive a venue-specific content broadcast encrypted with the broadcast access key; and

decrypt the received venue-specific content using the broadcast access key.

10. A method operational on a venue service gateway for securely delivering a venue-specific content broadcast to access terminals, comprising:

receiving a venue service key from a subscription-based service, wherein the venue service key is associated with a subscription package and a particular venue; and

updating the venue service key based on an identifier; and

updating a broadcast/multicast services server with the venue service key, wherein the broadcast/multicast services server encrypts venue-specific content using a broadcast access key generated based on the venue service key.

11. The method of claim 10, further comprising:

sending a flow identifier to the broadcast/multicast services server which is also used to generate the broadcast access key.

12. The method of claim 10, further comprising:

sending a venue identifier to the broadcast/multicast services server which is also used to generate the broadcast access key.

13. The method of claim 10, further comprising:

aggregating venue-specific content; and

forwarding the aggregated venue-specific content to the broadcast/multicast services server.

14. A venue service gateway, comprising:

a first communication interface for communicating with a subscriber-based service;

a second communication interface for communicating with a broadcast/multicast services server;

a processing circuit coupled to the first and second communication interfaces, the processing circuit adapted to receive a venue service key from the subscription-based service via the first communication interface, wherein the venue service key is associated with a subscription package and a particular venue;

update the venue service key based on an identifier; and

update the broadcast/multicast services server via the second communication interface with the venue service key, wherein the broadcast/multicast services server encrypts venue-specific content using a broadcast access key generated based on the venue service key.

15. The venue service gateway of claim 14, wherein the processing circuit is further adapted to:

send a flow identifier to the broadcast/multicast services server which is also used to generate the broadcast access key.

16. The venue service gateway of claim 14, wherein the processing circuit is further adapted to

send a venue identifier to the broadcast/multicast services server which is also used to generate the broadcast access key.

17. The venue service gateway of claim 14, further comprising:

a content aggregator adapted to

aggregate venue-specific content; and

forward the aggregated venue-specific content to the broadcast/multicast services server.

18. A venue service gateway, comprising:

means for receiving a venue service key from a subscription-based service, wherein the venue service key is associated with a subscription package and a particular venue;

means for updating the venue service key based on an identifier; and

means for updating the broadcast/multicast services server with the updated venue service key.

19. The venue service gateway of claim 18, further comprising:

means for receiving a new service epoch identifier used to update the venue service key; and

means for updating the broadcast/multicast services server with the new service epoch identifier which is used to update the venue service key and, consequently, the broadcast access key.

20. A processor comprising:

a processing circuit to;

receive a venue service key from a subscription-based service, wherein the venue service key is associated with a subscription package and a particular venue;

update the venue service key based on an identifier; and

update a broadcast/multicast services server with the venue service key, wherein the broadcast/multicast services server encrypts venue-specific content using a broadcast access key generated based on the venue service key.

21. A non-transitory machine-readable medium comprising instructions operational in a venue service gateway, which when executed by one or more processors causes the processors to:

receive a venue service key from a subscription-based service, wherein the venue service key is associated with a subscription package and a particular venue;

update the venue service key based on an identifier; and

update a broadcast/multicast services server with the venue service key, wherein the broadcast/multicast services server encrypts venue-specific content using a broadcast access key generated based on the venue service key.

22. A method operational on a broadcast/multicast services server for facilitating secure delivery of a venue-specific content broadcast to access terminals, comprising:

receiving a venue service key from a venue service gateway for a subscription-based service, wherein the venue service key is associated with a subscription package and a particular venue;

generating a broadcast access key based on at least the venue service key and a flow identifier;

receiving an updated venue service key based on an identifier;

updating the broadcast access key based on the updated venue service key;

encrypting venue-specific content based on the broadcast access key; and

broadcasting the encrypted venue-specific content.

23. The method of claim 22, further comprising:

receiving an epoch identifier from the venue service gateway;

updating the venue service key using the epoch identifier; and

updating the broadcast access key using the updated venue service key.

24. The method of claim 22, further comprising:

receiving the flow identifier from the venue service gateway.

25. The method of claim 22, further comprising:

receiving a venue identifier from the venue service gateway; and

generating the broadcast access key using the venue identifier.

26. The method of claim 22, further comprising:

aggregating the venue-specific content for broadcasting.

27. A broadcast/multicast services server adapted for facilitating secure delivery of venue-specific broadcast content to access terminals, comprising:

a network interface for communicating with a venue service gateway;

a broadcast interface for broadcasting to access terminals; and

the processing circuit is adapted to;

receive a venue service key from the venue service gateway for a subscription-based service, wherein the venue service key is associated with a subscription package and a particular venue;

receive an updated venue service key based on an identifier from the venue service gateway;

generate a broadcast access key based on at least the venue service key and a flow identifier;

encrypt venue-specific content based on the broadcast access key; and

broadcast the encrypted venue-specific content via the broadcast interface.

28. The server of claim 27, wherein the processing circuit is adapted to:

receive an epoch identifier from the venue service gateway;

update the venue service key using the epoch identifier; and

update the broadcast access key using the updated venue service key.

29. The server of claim 27, wherein the processing circuit is adapted to:

receive the flow identifier from the venue service gateway.

30. The server of claim 27, wherein the processing circuit is adapted to:

receive a venue identifier from the venue service gateway; and

generate the broadcast access key using the venue identifier.

31. The server of claim 27, further comprising:

a content aggregator adapted to aggregate the venue-specific content.

32. A broadcast/multicast services server, comprising:

means for receiving a venue service key from a venue service gateway for a subscription-based service, wherein the venue service key is associated with a subscription package and a particular venue;

means for receiving an updated venue service key based on an identifier from the venue service gateway;

means for generating a broadcast access key based on the venue service key and a flow identifier;

means for encrypting venue-specific content based on the broadcast access key; and

means for broadcasting the encrypted venue-specific content.

33. A processor comprising:

a processing circuit to;

receive a venue service key from a venue service gateway for a subscription-based service, wherein the venue service key is associated with a subscription package and a particular venue;

update the venue service key based on an identifier;

generate a broadcast access key based on the venue service key and a flow identifier;

encrypt venue-specific content based on the broadcast access key; and

broadcast the encrypted venue-specific content.

34. A non-transitory machine-readable medium comprising instructions operational in a broadcast/multicast services server, which when executed by one or more processors causes the processors to:

receive a venue service key from a venue service gateway for a subscription-based service, wherein the venue service key is associated with a subscription package and a particular venue;

update the venue service key based on an identifier;

generate a broadcast access key based on the venue service key and a flow identifier;

encrypt venue-specific content based on the broadcast access key; and

broadcast the encrypted venue-specific content.