Downloadable security and protection methods and apparatus

• US 10,362,018 B2
• Filed: 03/19/2018
• Issued: 07/23/2019
• Est. Priority Date: 10/20/2006
• Status: Active Grant

• Current Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Original Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Inventors: Helms, William L., Carlucci, John B., Schnitzer, Jason Kazmir
• Primary Examiner(s): Pwu, Jeffrey C
• Assistant Examiner(s): Ambaye, Samuel
• Application Number:
  US15/925,554
• Publication Number:
  US 20180278597A1
• Time in Patent Office: 491 Days
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 8/63 Image based installation; Cloning; Build to order
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/605 Copy protection
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/2351 involving encryption of additional data arrangements using cryptography for the use of broadcast information or broadcast-related information H04H60/23
• CPC Class Codes: H04N 21/2541 Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/2543 Billing , e.g. for subscription services payment schemes, architectures or protocols G06Q20/00; e-commerce G06Q30/00; arrangements for billing for the use of broadcast information or broadcast-related information H04H60/21
• CPC Class Codes: H04N 21/25816 : involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/26606 : for generating or managing entitlement messages, e.g. Entitlement Control Message [ECM] or Entitlement Management Message [EMM] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/26613 : for generating or managing keys in general key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04
• CPC Class Codes: H04N 21/4353 : involving decryption of additional data arrangements using cryptography for the use of broadcast information or broadcast-related information H04H60/23
• CPC Class Codes: H04N 21/4363 : Adapting the video stream to a specific local network, e.g. a Bluetooth® network
• CPC Class Codes: H04N 21/4405 : involving video stream decryption
• CPC Class Codes: H04N 21/4623 : Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/4627 : Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/478 : Supplemental services, e.g. displaying phone caller identification, shopping application
• CPC Class Codes: H04N 21/6118 : involving cable transmission, e.g. using a cable modem
• CPC Class Codes: H04N 21/63345 : by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 21/8166 : involving executable data, e.g. software arrangements for executing specific programs G06F9/44; broadcasting computer programmes in broadcast systems H04H20/91; involving the movement of software or configuration parameters H04L67/34
• CPC Class Codes: H04N 21/8193 : dedicated tools, e.g. video decoder software or IPMP tool
• CPC Class Codes: H04N 7/167 : Systems rendering the television signal unintelligible and subsequently intelligible
• CPC Class Codes: H04N 7/1675 : Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

Methods and apparatus for control of data and content protection mechanisms across a network using a download delivery paradigm. In one embodiment, conditional access (CA), digital rights management (DRM), and trusted domain (TD) security policies are delivered, configured and enforced with respect to consumer premises equipment (CPE) within a cable television network. A trusted domain is established within the user'"'"'s premises within which content access, distribution, and reproduction can be controlled remotely by the network operator. The content may be distributed to secure or non-secure “output” domains consistent with the security policies enforced by secure CA, DRM, and TD clients running within the trusted domain. Legacy and retail CPE models are also supported. A network security architecture comprising an authentication proxy (AP), provisioning system (MPS), and conditional access system (CAS) is also disclosed, which can interface with a trusted authority (TA) for cryptographic element management and CPE/user device authentication.

Claims

1. A computerized method of operating a security management architecture within a content delivery network, the computerized method comprising:

identifying a plurality of computerized client devices in data communication with the content delivery network;

receiving data representative of a request for a service from a subscriber associated with at least one of the plurality of computerized client devices; and

configuring the at least one of the plurality of computerized client devices based at least in part on the request, the configuring comprising;

generating personalization data specific to the at least one computerized client device;

transmitting the personalization data to the at least one computerized client device, wherein the transmitting of the personalization data comprises transmitting a message having a common image encryption key, the message being specifically encrypted for the at least one computerized client device, and wherein the common image encryption key enables the at least one computerized client device to decrypt a common software image, the common software image being applicable to all of the plurality of computerized client devices based on a shared hardware and software configuration of respective processor apparatus of the plurality of computerized client devices; and

establishing at least one security permission or policy within a secure element of the at least one computerized client device, the at least one security permission or policy enabling provision of the requested service to the at least one client device.

2. The computerized method of claim 1, wherein the receiving the data representative of the request for the service comprises receiving data representative of a service request for a feature offered within only selected levels of a network operator service subscription plan.

3. The computerized method of claim 1, wherein the receiving the data representative of the request for the service comprises receiving data representative of a service request for download and distribution of protected digitally rendered content to a second computerized device in data communication with the at least one computerized client device.

4. The computerized method of claim 3, further comprising distributing, based at least on the service request, the protected digitally rendered content to the second computerized device, the distributing comprising delivering encrypted digitally rendered video content to the second computerized device via a high-speed serialized bus protocol interface.

5. The computerized method of claim 3, further comprising distributing, based at least on the service request, the protected digitally rendered content to the second computerized device, the distributing comprising delivering encrypted digitally rendered video content to the second computerized device via a Wi-Fi (IEEE-802.11) interface.

6. The computerized method of claim 1, wherein the generating of the personalization data comprises generating an encrypted software image and cryptographic key that is unique to the secure element of the at least one computerized client device.

7. Computerized network apparatus for use in providing secure digitally rendered content and software downloads to a plurality of computerized client devices within a content delivery network, the computerized network apparatus comprising:

secure download infrastructure adapted for data communication with a computerized trusted authority (TA);

a media provisioning system in data communication with the secure download infrastructure;

a billing system in data communication with the media provisioning system;

a media security system in data communication with the media provisioning system; and

a media services system in data communication with the media provisioning system;

wherein;

the media provisioning system and the media security system determine and cause application of data relating to entitlements for at least one of the plurality of computerized client devices in order to authorize provision of a least one cryptographic element and at least one secure client device software image to the at least one of the plurality of computerized client devices;

the secure download infrastructure and the TA are configured to cooperate to provide the at least one cryptographic element and the at least one secure client device software image for delivery by the secure download infrastructure to the at least one of the plurality of computerized client devices based at least upon said authorization thereof;

the provision of the at least one secure client device software image comprises provision of a device-specific software image within an encrypted data structure; and

decryption of the encrypted data structure is required by the at least one of the plurality of computerized client devices to load a common software image.

8. The computerized network apparatus of claim 7, wherein the common software image is applicable to all of the plurality of computerized client devices having a common configuration and disposed within the content delivery network, and the device-specific software image is specific to only the at least one of the plurality of computerized client devices.

9. The computerized network apparatus of claim 8, wherein:

the common software image comprises a software image that is provided to all of the plurality of computerized client devices associated with a first service level, the first service level indicative of one or more functions enabled at the plurality of computerized client devices associated with the first service level; and

the device-specific software image is provided only to the at least one of the plurality of computerized client devices, the device-specific software image comprising a software image based on the at least one of the plurality of computerized client devices being associated with a second service level, the second service level indicating one or more additional functions relative to the first service level.

10. The computerized network apparatus of claim 7, wherein the computerized network apparatus is adapted to communicate over the network with at least one respective secure element disposed on the at least one of the plurality of computerized client devices, the device-specific software image being configured to run within at least one respective software environment of the at least one secure element in order to enforce one or more security policies within a domain associated with the at least one of the plurality of computerized client devices.

11. The computerized network apparatus of claim 10, wherein:

the at least one respective secure element comprises a secure microprocessor (SM) of the at least one of the plurality of computerized client devices;

the computerized network apparatus further comprises a computerized server configured to establish a security envelope around the SM of the at least one of the plurality of computerized client devices, the security envelope configured to protect both digitally rendered content and the at least one secure client device software image processed via the SM.

12. The computerized network apparatus of claim 11, wherein the security envelope is established based at least on receipt of data representative of a request from at least one of the at least one of the plurality of computerized client devices to download the digitally rendered content.

13. The computerized network apparatus of claim 7, wherein the at least one cryptographic element comprises a public key, the public key corresponding to a private key retained within the at least one of the plurality of computerized client devices, the private key configured to decrypt the encrypted data structure.

20. The computerized network apparatus of claim 7, wherein execution of the common software image comprises execution of a separate graphical user interface (GUI) from at least one respective computer program applications of the at least one of the plurality of computerized client devices.

14. A computerized method delivering secure software over a network to a computerized client device, the computerized method comprising:

providing, via a first network entity, credentials along with a public key for the computerized client device to a second network entity;

receiving a device-specific software image to the first network entity from the second network entity, the device-specific software image being specific to only the computerized client device, the device-specific software image encrypted for the computerized client device based at least in part on the public key;

receiving a common software image from the second network entity, the common image comprising an image applicable to all of a plurality of computerized client devices having a common configuration and disposed within the network, the plurality of computerized client devices comprising the computerized client device; and

transmitting, via the first network entity, the encrypted client device-specific software image and the common software image;

wherein a private key corresponding to the public key is required by the computerized client device to decrypt the encrypted client device-specific software image, and decryption of the encrypted client device-specific software image is required to decrypt the common software image.

15. The computerized method of claim 14, wherein the providing, via the first network entity, the credentials along with the public key for the computerized client device to the second network entity comprises providing, via a computerized authentication proxy apparatus, the credentials along with the public key for the computerized client device to a personalization server apparatus.

16. The computerized method of claim 14, wherein the encryption of the device-specific software image comprises using at least a portion of the personalization server apparatus to personalize the device-specific software image according to an account associated with a user of the computerized client device, the account identifying a service level indicating one or more capabilities, the personalized device-specific software image configured to support the one or more capabilities.

17. The computerized method of claim 16, wherein the encryption of the personalized device-specific software image comprises using at least a portion of the computerized authentication proxy apparatus to verify the account.

18. The computerized method of claim 14, wherein the transmitting comprises transmitting the encrypted device-specific image and the common image within an encrypted message attachment.

19. The computerized method of claim 14, further comprising causing the first network entity to notify the second network entity of a status of the delivery of at least the device-specific software image.