Methods and apparatus for premises content distribution

• US 8,732,854 B2
• Filed: 11/01/2006
• Issued: 05/20/2014
• Est. Priority Date: 11/01/2006
• Status: Active Grant

• Current Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Original Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Inventors: Cholas, Chris, Helms, William L., Carlucci, John B., Markley, Jeffrey P.
• Primary Examiner(s): Arani, Taghi
• Assistant Examiner(s): VICTORIA, NARCISO F
• Application Number:
  US11/592,054
• Publication Number:
  US 20080112405A1
• Time in Patent Office: 2,757 Days
• Field of Search: 726/26
• US Class Current: 726/29
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services

Abstract

Apparatus and methods for protected content access, browsing and transfer over a network. In one embodiment, the network comprises a premises (e.g., residential) LAN, and the apparatus comprises a server and renderer consumer premise equipment (CPE). The renderer CPE scans the network to search for a server CPE that implement a compatible security framework. The renderer authenticates itself with the server, and the server allows content browsing and selection access only to an authorized and authenticated renderer. A negotiation and exchange protocol comprises messages exchanged between the renderer and the server that include one or more of device identification, encryption key exchange, digital certificates and information regarding security package used by each CPE.

Claims

1. A method of sharing protected digital content between two client premises devices associated with a premises network, comprising:

storing protected digital content at a first of said two client premises devices;

said first client premises device authenticating a second of said client premises devices requesting access to said protected digital content from said first client premises device, said authentication comprising determining rights of said second client premises device to access said protected digital content, and said first and second client premises devices thereby creating an authorized service domain (ASD) for maintaining protection of said protected digital content;

selectively providing access to said second client premises device for browsing said protected digital content;

receiving a request for transmission of at least a portion of said protected digital content; and

said first client premises device selectively transmitting said at least portion of said protected digital content to said second client premises device while maintaining said content protection;

wherein said selective transmission is conducted entirely between said two client premises devices, and is irrespective of any network entities outside said premises network.

2. The method of claim 1, wherein at least said acts of authenticating, providing access, and transmitting are performed without access to a remote network agent.

3. The method of claim 2, wherein said network comprises a premises local area network (LAN), and said remote agent comprises a head-end process of a cable television network with which at least a portion of said LAN is in communication.

4. The method of claim 1, wherein said stored digital content comprises a plurality of media files each having a respective unique title, and said act of selectively providing access for browsing comprises providing access to at least said titles.

5. The method of claim 1, further comprising verifying that said second client premises device comprises security provisions needed for protecting said content before said act of transferring is commenced.

6. The method of claim 1, further comprising placing said first and second client premises devices in data communication with one another via a standardized communications interface.

7. The method of claim 6, wherein said communications interface comprises a Universal Plug and Play (UPnP) interface, and said first client premises device completes said authentication using a standardized security architecture.

8. User premises apparatus configured as a content server for one or more devices over a user premises network, said user premises server apparatus comprising:

storage apparatus configured to store a plurality of digital content;

authentication apparatus configured to authenticate at least one device requesting content from said server apparatus;

browsing apparatus configured to enable at least one requesting device to browse a directory of available ones of said plurality of content; and

security apparatus configured to control access to said content by said browsing apparatus based at least in part on successful authentication of said at least one requesting device, said browsing apparatus and said at least one requesting device comprising an authorized service domain (ASD) for protection of said content.

9. The server apparatus of claim 8, further comprising transmission apparatus, said transmission apparatus configured to transfer at least a portion of said plurality of content to said requesting device based at least in part on said successful authentication thereof.

10. The server apparatus of claim 9, wherein said transmission apparatus comprises a plug-and-play operable data interface, and said transfer of said at least portion of content is further based on said security apparatus determining that said requesting device possesses a security apparatus used to protect at least one aspect of said at least portion of content to be transferred.

11. The server apparatus of claim 8, wherein said authentication apparatus and security apparatus comprise at least one computer program disposed on said server apparatus within a security architecture.

12. The server apparatus of claim 11, wherein said security architecture comprises a secure microprocessor, and said server apparatus comprises at least a portion of a trusted domain (TD).

13. The server apparatus of claim 8, wherein said server apparatus is granted access to said digital content based at least in part on cryptographic elements and encrypted software downloaded from a network operator entity to a secure microprocessor resident on said server apparatus.

14. The server apparatus of claim 8, wherein said server apparatus further comprises:

a first interface capable of at least receiving said content from a content-based network;

a coaxial cable interface configured to provide networking throughout at least a portion of said premises over coaxial cable present therein; and

a wireless access interface configured to support at least one wireless network within said premises;

wherein said content is accessible to users on both said coaxial cable network and said at least one wireless network.

15. A system for sharing protected digital content over a premises network, said system comprising at least a first device in communication with said premises network, said first device configured to:

receive said protected content over an interface to a content delivery network;

store said content on said first device;

receive a query from a second device in communication with said premises network, said query requesting security framework capabilities of said first device;

receive in response to an answer to said query, a request for access to said content from said second device;

authenticate said second device when said second device requests access to said digital content from said first device, said authentication comprising verification that said second device is compatible with said security framework capabilities of said first device;

create an authorized service domain (ASD) comprising said first and second devices, said ASD configured to maintain protection of said protected digital content;

selectively provide access to said second device for browsing said stored digital content;

receive a request for transmission of at least a portion of said content; and

selectively transmit said at least portion of said content to said second device while maintaining said content protection.

16. The system of claim 15, wherein said first device comprises a plug-and-play interface over which at least said protected content can be transmitted.

17. The system of claim 15, wherein said first device comprises a storage device having a plurality of security-related information stored therein, at least a portion of said security-related information being used to perform said authentication.

18. The system of claim 15, wherein said first device comprises a secure microprocessor having a plurality of security-related information stored therein, said information being received from said content delivery network according to a downloadable conditional access protocol, at least a portion of said security-related information being used to perform said authentication of said second device.

19. A method of providing a premises network configured to enable sharing of plurality of protected content between a plurality of devices associated with said premises network without requiring said plurality of devices to access a remote network agent, said method comprising:

storing said plurality of protected content at a first of said plurality of devices;

creating a directory of said plurality of protected content, said directory indicating at least a title for individual ones of said plurality of protected content;

establishing an authorized service domain (ASD) for maintaining protection of said plurality of protected content, said plurality of devices communicating within said ASD via said premises network;

authenticating a second of said plurality of devices to said first of said plurality of devices via said ASD to enable communication of content therebetween;

selectively providing access to said second of said plurality of devices to said directory, said access enabling said second of said plurality of devices to browse said plurality of protected content stored at said first of said plurality of devices by at least said titles; and

upon receipt of a selection of at least one of said plurality of protected content, transmitting said at least one of said plurality of protected content and digital copyright data relating thereto to said second of said plurality of devices;

wherein said transmission of said at least one of said plurality of protected content and said digital copyright data relating thereto to said second of said plurality of devices is based at least in part on said authentication; and

wherein said transmission of said at least one of said plurality of protected content occurs in an absence of intervention by entities outside said premises network.

20. The method of claim 19, wherein said act of enabling said second of said plurality of devices to browse said plurality of protected content comprises providing a preview of said content associated with said titles.

21. The method of claim 19, further comprising verifying that said second of said plurality of devices comprises security provisions which are adequate for protecting said plurality of protected content prior to said transmission of said at least one of said plurality of protected content thereto.

22. The method of claim 19, wherein said act of communication within said ASD via said premises network between said plurality of devices comprises utilization of a Universal Plug and Play (UPnP) interface.

23. The method of claim 19, wherein said act of communication within said ASD via said premises network between said plurality of devices comprises utilization of a high-speed serialized bus protocol capable of at least 800 Mbps data transfer rate.

24. The method of claim 19, wherein said plurality of protected content is encrypted before said act of transmitting, and said second of said plurality of devices may decrypt said protected content using at least one decryption algorithm and at least a portion of a public-private key pair.

25. The method of claim 19, wherein said selectively providing access to said second of said plurality of devices to said directory further comprises said second of said plurality of devices to re-authenticate itself when said second of said plurality of devices changes said directory that said second of said plurality of devices is browsing.

26. The method of claim 19, further comprising transferring security capabilities information between said first and second of said plurality of devices.

27. The method of claim 26, wherein said capabilities information comprises information relating to at least one of:

(i) a public-private key pair, and (ii) an encryption algorithm.

28. A first consumer device in communication with a premises network for sharing protected digital content over said premises network, said first device comprising:

a first interface configured to receive said protected content from a content delivery network;

a second interface configured to communicate with a second device in said premises network;

a storage entity configured to store said protected content;

a processor comprising at least one computer program configured to;

receive from said second device a request for security framework capabilities of said first device;

provide said security framework capabilities of said first device to said second device via said second interface;

receive a request for access to said protected content from said second device;

authenticate said second device as being within an authorized service domain (ASD);

transmit a directory of said protected content stored at said first device to said second device for browsing thereof;

receive a selection of an individual one of said protected content; and

selectively transmit said individual one of said protected content to said second device while maintaining said content protection.

29. The device of claim 28, wherein said provision of said security framework capabilities of said first device to said second device via said second interface occur upon receipt of a request therefore from said second device.

30. The device of claim 28, wherein said act to authenticate said second device as being within said ASD further comprises said at least one computer program being further configured to verify said second device to a device list, said device list comprises devices authorized to be within said ASD.

31. The device of claim 28, wherein said second interface comprises a plug-and-play interface over which at least said protected content can be transmitted to said second device in said premises network.

32. The device of claim 28, wherein said storage entity is further configured to store a plurality of security-related information therein, at least a portion of said security-related information being used to perform said authentication.

33. The device of claim 28, further comprising a secure microprocessor having a plurality of security-related information stored therein, said information being received from said content delivery network according to a downloadable conditional access protocol.

34. The device of claim 33, wherein at least a portion of said security-related information is used to perform said authentication of said second device.

35. The device of claim 28, wherein said browsing of said directory of said protected content stored at said first device comprises providing a preview of said protected content.

36. The device of claim 28, wherein said at least one computer program is further configured to verify that said second device comprises security provisions needed for protecting said content before said act of transmitting is commenced.