PC secure video path

• US 8,713,685 B2
• Filed: 02/18/2013
• Issued: 04/29/2014
• Est. Priority Date: 03/04/2010
• Status: Active Grant

• Current Assignee: Comcast Cable Communications LLC (Comcast Corporation)
• Original Assignee: Comcast Cable Communications LLC (Comcast Corporation)
• Inventors: Fahrny, James W.
• Primary Examiner(s): Mehedi, Morshed
• Application Number:
  US13/769,618
• Publication Number:
  US 20130163763A1
• Time in Patent Office: 435 Days
• Field of Search: 726/26
• US Class Current: 726/25
• CPC Class Codes: G06F 21/109 by using specially-adapted hardware at the client
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/0827 involving distinctive intermediate devices or communication paths network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04N 21/64715 Protecting content from unauthorized alteration within the network verifying the information received for network security in communication control or processing H04L63/12; integrity in wireless network security H04W12/10

Abstract

A system and method are disclosed for creating a secure video content path, or a protected media content bus, within an unsecure personal computer. A portable security module, or electronic key safe, may be inserted into a personal computer that has different internal components for processing secure and unsecured content. The security module may establish a secure encrypted link with a secure video processor of the personal computer, and may use the personal computer'"'"'s network interface to request authority to receive secured content. The security module may provide content keys to the secure video processor to access secured content received over an external network.

Claims

1. A media method, comprising:

using parallel media paths in a computing device to process content, the parallel media paths comprising a secure media path with a secure video processor configured for handling secured content, and an unsecured media path configured for handling unsecured content;

using a portable key module to supply different content decryption keys from the portable key module to the secure media path for different pieces of secured media content;

using a secure tunnel between the portable key module and the secure video processor to transfer the content decryption keys; and

generating an authentication request that comprises an identification of the portable key module, and an identification of the secure video processor.

2. The method of claim 1, further comprising receiving, by the portable key module, a new encryption or decryption key in response to the authentication request.

3. The method of claim 1, wherein the authentication request is generated by the portable key module.

4. The method of claim 3, further comprising receiving an authentication proxy private key in response to the authentication request, and using the authentication proxy private key to send a sign-on request to an authentication proxy for a piece of media content.

5. The method of claim 3, further comprising transmitting, by the computing device, a content request message containing identifications of a piece of requested content, the portable key module, and a user requesting the content.

6. The method of claim 5, further comprising receiving the requested piece of content along with one or more usage rules for the content.

7. The method of claim 6, further comprising using different content keys to decrypt audio and video portions of the requested content.

8. The method of claim 1, further comprising supplying an output video signal from the secure video processor to an unsecured video processor of the computing device.

9. The method of claim 1, further comprising erasing a key storage of the portable key module in response to removal of the portable key module from the computing device.

10. A computing device, comprising:

parallel media paths configured to process content, wherein a first one of the paths comprises a secure video processor configured to handle encrypted video content, and wherein a second one of the paths comprises an unsecured video processor configured to handle unencrypted video content; and

a portable key module interface, wherein the secure video processor is further configured to use a secure tunnel to obtain a portable key module identification and content decryption keys from a portable key module via the portable key module interface; and

a computing device processor configured to deliver an authentication request that comprises the portable key module identification and an identification of the secure video processor from the portable key module interface to an external network interface.

11. The computing device of claim 10, wherein the computing device processor is further configured to deliver an encryption or decryption key from the external network interface to the portable key module interface in response to the authentication request.

12. The computing device of claim 10, further comprising the portable key module configured to receive an authentication proxy private key in response to the authentication request, and use the authentication proxy private key to send a sign-on request to an authentication proxy for a piece of media content.

13. The computing device of claim 12, wherein the computing device processor is further configured to transmit a content request message containing identifications of a piece of requested content, the portable key module, and a user requesting the content.

14. The computing device of claim 12, wherein the computing device processor is further configured to receive a requested piece of content along with one or more usage rules for the requested piece of content.

15. The computing device of claim 10, wherein the secure video processor is configured to use different content keys to decrypt audio and video portions of received encrypted content.

16. The computing device of claim 10, wherein the secure video processor is configured to decrypt encrypted video using a key received via the portable key module, and supply the unencrypted video to the unsecured video processor.

17. A method comprising:

using parallel media paths in a computing device to process content, the parallel media paths comprising a secure media path with a secure video processor configured for handling secured content, and an unsecured media path configured for handling unsecured content;

generate generating an authentication request identifying a portable module and a video processor of the computing device, and using communication resources of the computing device to transmit the authentication request to an external network; and

receive receiving different content decryption keys for different pieces of encrypted content, and supplying the keys to the video processor of the computing device using a secure tunnel between a processor of the portable module and the video processor of the computing device.

18. The method of claim 17, further comprising receiving an authentication proxy private key in response to the authentication request, and using the authentication proxy private key to send a sign-on request to an authentication proxy for a piece of media content.

19. The method of claim 17, further comprising supplying different audio and video content decryption keys for a first piece of requested content.

20. The method of claim 17, further comprising erasing a key storage of the portable module in response to removal of the portable module from the computing device.