Authentication and authorization for internet video client

• US 8,843,736 B2
• Filed: 05/18/2010
• Issued: 09/23/2014
• Est. Priority Date: 05/04/2010
• Status: Active Grant

• Current Assignee: Sony Corporation (Sony Group Corp.)
• Original Assignee: Sony Corporation (Sony Group Corp.)
• Inventors: Pedlow, Leo, Candelore, Brant
• Primary Examiner(s): WANG, HARRIS C
• Application Number:
  US12/782,174
• Publication Number:
  US 20110276797A1
• Time in Patent Office: 1,589 Days
• Field of Search: 713/151
• US Class Current: 713/151
• CPC Class Codes: G06Q 30/0205 Location or geographical consideration
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04N 21/222 Secondary servers, e.g. proxy server, cable television Head-end provisioning of proxy services in data packet switching networks H04L67/56
• CPC Class Codes: H04N 21/2396 characterized by admission policies admission control, resource allocation in open networks H04L12/5692; arrangements for network security using user profiles for access control H04L63/102; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/2408 Monitoring of the upstream path of the transmission network, e.g. client requests monitoring data switching networks utilization H04L43/0876; scheduling or organising the servicing of application requests H04L67/60
• CPC Class Codes: H04N 21/2541 Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/2543 Billing , e.g. for subscription services payment schemes, architectures or protocols G06Q20/00; e-commerce G06Q30/00; arrangements for billing for the use of broadcast information or broadcast-related information H04H60/21
• CPC Class Codes: H04N 21/25816 involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/25875 involving end-user authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; arrangements for secret or secure communication including means for verifying the identity or authority of a user of the system H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/441 Acquiring end-user identification , e.g. using personal code sent by the remote control or by inserting a card
• CPC Class Codes: H04N 21/4508 Management of client data or end-user data
• CPC Class Codes: H04N 21/4627 Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/47211 for requesting pay-per-view content payment schemes payment architectures or payment protocols G06Q20/00, G07F
• CPC Class Codes: H04N 21/6125 involving transmission via Internet transmission by internet of broadcast information H04H60/82
• CPC Class Codes: H04N 21/6175 involving transmission via Internet broadcast-related systems characterised by the transmission system being the Internet H04H60/82
• CPC Class Codes: H04N 21/64322 IP
• CPC Class Codes: H04N 21/8352 : involving content or source identification data, e.g. Unique Material Identifier [UMID]
• CPC Class Codes: H04N 21/8586 : by using a URL processing chained hypermedia data for information retrieval G06F16/94; information retrieval from the Internet by using URLs G06F16/955; URL in broadcast information H04H20/93; Web-based protocols H04L67/02

Abstract

A device is enabled to display Internet TV by accessing a management server with a secret unique ID and receiving back from the server, assuming the ID is approved, a user token and a service list of content servers with knowledge of the user token. A user can select a content server which causes the device to upload its user token and in response receive a content list from the content server, from which content can be selected for display. Neither list may be modified by the device and the device can access only content on a content list.

Claims

1. A Consumer electronic (CE) device comprising:

a display;

a network interface;

a processor configured for controlling the display and communicating with the Internet through the network interface;

the processor programmed for executing logic including;

registering with a management server at least in part by sending to the management server a unique CE device identification (ID) in a secure transaction;

subsequent to registering with the management server and prior to a user request for content using the CE device, periodically contacting the management server to establish periodic contacts therewith;

during each periodic contact, after receiving correct authentication information from the management server ensuring the CE device is not being spoofed, sending to the management server the unique CE device ID in a secure transaction, responsive to successful authentication with the management server each periodic contact, receiving from the management server a user token along with one or more service lists each of which contains a list of network addresses of approved content servers such that the service list is configured to be updated and provided by the management server to the CE device each periodic contact without a user of the CE device requesting an updated service list of content from a content server on the service list;

presenting a service list on the display for selection of a content server thereon;

responsive to user input indicating selection of a content server on the service list, uploading, though the network interface, the user token to the content server selected by the user;

receiving from the content server a content list of content available for selection by the CE device;

responsive to user input indicating selection of a piece of content on the content list, sending a signal representative thereof to the content server; and

responsive to receiving the piece of content from the content server, playing or making available for presentation on the display the piece of content, wherein neither the content list nor service list can be modified by the CE device.

2. The CE device of claim 1, wherein the processor cannot access content on the Internet other than content on the content list.

3. The CE device of claim 1, wherein the secure transaction is a secure socket layer (SSL) transaction.

4. The CE device of claim 1, wherein the processor is configured to verify authenticity of the management server using a public key of a certificate authority providing a server certificate received by the processor from the management server.

5. The CE device of claim 1, wherein the user token has an expiration time after which it is no longer accepted by content servers

6. A Method comprising:

registering with a management server at least in part by sending to the management server a unique Consumer electronic (CE) device identification (ID) in a secure transaction;

subsequent to registering with the management server and prior to a user request for content using the CE device, periodically contacting the management server to establish periodic contacts therewith;

during each periodic contact, after receiving correct authentication information from the management server ensuring the CE device is not being spoofed, sending to the management server the unique CE device ID in a secure transaction;

responsive to successful authentication with the management server each periodic contact, receiving from the management server a user token along with one or more service lists each of which contains a list of network addresses of approved content servers such that the service list can be updated and provided by the management server to the CE device each periodic contact

without a user of the CE device requesting an updated service list of content from a content server on the service list;

presenting a service list on a display for selection of a content server thereon;

responsive to user input indicating selection of a content server on the service list, uploading, though the network interface, the user token to the content server selected by the user;

receiving from the content server a content list of content available for selection by the CE device;

responsive to user input indicating selection of a piece of content on the content list, sending a signal representative thereof to the content server; and

responsive to receiving the piece of content from the content server, playing or making available for presentation on the display the piece of content, wherein neither the content list nor service list is configured to be modified by the CE device.

7. The method of claim 6 wherein the management server is authenticated using a secure socket layer (SSL) certificate.

8. The method of claim 6 wherein the secure fashion uses secure socket layer (SSL).

9. The method of claim 6, wherein responsive to a determination that the value is valid, the management server delivers a list of content servers to the device, the device being programmed to access only content servers on the list and no other assets on the Internet.

10. The method of claim 9, wherein the device cannot modify the list.

11. The method of claim 9, wherein the list is signed by the management server and delivered in a unique session to the device such that it is not feasible to intercept and change or substitute the list externally.

12. The method of claim 9, wherein the list is delivered to the device in an encrypted channel.

13. The method of claim 9, wherein a mere presentation of the token to an asset server allows access by the device to content on a content list returned to the device by the content server.