System and method for secured delivery of content stream across multiple channels

• US 20030233540A1
• Filed: 06/13/2002
• Published: 12/18/2003
• Est. Priority Date: 06/13/2002
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Banerjee, Dwip N., Ravi, Kumar, Yellepeddy, Krishna Kishore
• Application Number:
  US10/171,846
• Publication Number:
  US 20030233540A1
• Time in Patent Office: Days
• US Class Current: 713/153
• CPC Class Codes: H04L 12/185 with management of multicast group membership
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols
• CPC Class Codes: H04N 21/4623 Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58
• CPC Class Codes: Y02D 30/50 in wire-line communication networks, e.g. low power modes or reduced link rate

Abstract

A system and method for securely delivering data content to devices across a computer network, such as the Internet, is provided. A secure channel (i.e., using Secure Socket Layers or other encryption technology) is used to provide details regarding a non-secure channel. The details may include a multicast group identifier if multicast broadcasting is used or a port identifier if a number of ports are used. The legitimate clients receive the details and listen for packets corresponding to the multicast group or port number. The details change periodically or in response to the detection of illicit receivers. Details regarding subsequent non-secure channel details are provided on the secure channel so that legitimate clients are able to continue receiving data packets, while illicit receivers are unable to continue receiving the data stream without interruption.

Claims

1. A method for sending data over a computer network to a client device, said method comprising:

establishing a secure channel with the client device over the computer network;

transmitting channel data to the client device over the secure channel, the channel data including details corresponding to one or more non-secure channels;

sending data to the client device over a first non-secure channel selected from the one or more non-secure channels.

2. The method as described in claim 1 further comprising:

transmitting a switching algorithm over the secure channel, the switching algorithm including timing details regarding switching through a sequence of a plurality of non-secure channels wherein the first non-secure channel is the first of the sequence;

determining a number of packets to send over the first non-secure channel; and

sending data to the client device over a second non-secure channel selected from the sequence in response to the number of packets being sent over the first non-secure channel.

3. The method as described in claim 1 further comprising:

transmitting a first non-secure channel identifier over the secure channel prior to the sending, the first non-secure channel identifier corresponding to the first non-secure channel;

transmitting a second non-secure channel identifier over the secure channel; and

sending data to the client device over a second non-secure channel that corresponds to the second non-secure channel identifier.

4. The method as described in claim 1 wherein the channel data includes one or more multicast group addresses and the first non-secure channel is a first multicast group address selected from the multicast group addresses, the method further comprising:

receiving, from an endpoint router attached to the computer network, receiver data corresponding to one or more receivers, wherein each of the receivers has joined a multicast group corresponding to the first multicast group identifier;

comparing a tally included in the receiver data with a second tally corresponding to a number of subscribers authorized to receive data sent to the multicast group; and

changing the multicast group identifier to a second multicast group identifier to which the data is sent over the computer network in response to the comparison.

5. The method as described in claim 4 further comprising:

identifying an illicit receiver limit; and

determining whether the tally exceeds the second tally by the illicit receiver limit, wherein the changing is performed in response to the determination.

6. The method as described in claim 4 wherein the receiver data includes demographic data corresponding to the receivers and wherein the method further comprises:

identifying group demographic data from the receiver data; and

analyzing the group demographic data.

7. The method as described in claim 1 further comprising:

receiving a subscription request from the client device; and

validating the subscription request, wherein the establishing, transmitting, and sending are each performed in response to the validation.

8. The method as described in claim 1 wherein the channel data includes one or more port numbers and wherein the first non-secure channel corresponds with a first port number selected from the one or more port numbers.

9. The method as described in claim 1 wherein the channel details include one or more multicast group identifiers and wherein the first non-secured channel corresponds to a first multicast group identifier selected from the multicast group identifiers, the method further comprising:

retrieving a tally of receivers corresponding to a first multicast group corresponding to the first multicast group identifier;

computing a quantity of illicit receivers by subtracting a number of subscribers from the tally;

selecting a second multicast group identifier in response to the computed quantity of illicit receivers;

transmitting the second multicast group identifier to a plurality of subscribers that includes the client device; and

sending additional data to the subscribers, including the client device, over the computer network addressed to the second multicast group identifier.

10. An information handling system comprising:

one or more processors;

a memory accessible by the processors;

a network interface connecting the information handling system to a computer network; and

a transmission tool for sending data over a computer network to a client device, the transmission tool including;

means for establishing a secure channel with the client device over the computer network;

means for transmitting channel data to the client device over the secure channel, the channel data including details corresponding to one or more non-secure channels;

means for sending data to the client device over a first non-secure channel selected from the one or more non-secure channels.

11. The information handling system as described in claim 10 further comprising:

means for transmitting a switching algorithm over the secure channel, the switching algorithm including timing details regarding switching through a sequence of a plurality of non-secure channels wherein the first non-secure channel is the first of the sequence;

means for determining a number of packets to send over the first non-secure channel; and

means for sending data to the client device over a second non-secure channel selected from the sequence in response to the number of packets being sent over the first non-secure channel.

12. The information handling system as described in claim 10 further comprising:

means for transmitting a first non-secure channel identifier over the secure channel prior to the sending, the first non-secure channel identifier corresponding to the first non-secure channel;

means for transmitting a second non-secure channel identifier over the secure channel; and

sending data to the client device over a second non-secure channel that corresponds to the second non-secure channel identifier.

13. The information handling system as described in claim 10 wherein the channel data includes one or more multicast group addresses and the first non-secure channel is a first multicast group address selected from the multicast group addresses, the information handling system further comprising:

means for receiving, from an endpoint router attached to the computer network, receiver data corresponding to one or more receivers, wherein each of the receivers has joined a multicast group corresponding to the first multicast group identifier;

means for comparing a tally included in the receiver data with a second tally corresponding to a number of subscribers authorized to receive data sent to the multicast group; and

means for changing the multicast group identifier to a second multicast group identifier to which the data is sent over the computer network in response to the comparison.

14. The information handling system as described in claim 13 further comprising:

means for identifying an illicit receiver limit; and

means for determining whether the tally exceeds the second tally by the illicit receiver limit, wherein the means for changing is performed in response to the determination.

15. The information handling system as described in claim 13 wherein the receiver data includes demographic data corresponding to the receivers and wherein the information handling system further comprises:

means for identifying group demographic data from the receiver data; and

means for analyzing the group demographic data.

16. The information handling system as described in claim 10 further comprising:

means for receiving a subscription request from the client device; and

means for validating the subscription request, wherein the establishing, transmitting, and sending are each performed in response to the validation.

17. The information handling system as described in claim 10 wherein the channel data includes one or more port numbers and wherein the first non-secure channel corresponds with a first port number selected from the one or more port numbers.

18. The information handling system as described in claim 10 wherein the channel details include one or more multicast group identifiers and wherein the first non-secured channel corresponds to a first multicast group identifier selected from the multicast group identifiers, the information handling system further comprising:

means for retrieving a tally of receivers corresponding to a first multicast group corresponding to the first multicast group identifier;

means for computing a quantity of illicit receivers by subtracting a number of subscribers from the tally;

means for selecting a second multicast group identifier in response to the computed quantity of illicit receivers;

means for transmitting the second multicast group identifier to a plurality of subscribers that includes the client device; and

means for sending additional data to the subscribers, including the client device, over the computer network addressed to the second multicast group identifier.

27. The computer program product as described in claim 18 wherein the channel details include one or more multicast group identifiers and wherein the first non-secured channel corresponds to a first multicast group identifier selected from the multicast group identifiers, the computer program product further comprising:

means for retrieving a tally of receivers corresponding to a first multicast group corresponding to the first multicast group identifier;

means for computing a quantity of illicit receivers by subtracting a number of subscribers from the tally;

means for selecting a second multicast group identifier in response to the computed quantity of illicit receivers;

means for transmitting the second multicast group identifier to a plurality of subscribers that includes the client device; and

means for sending additional data to the subscribers, including the client device, over the computer network addressed to the second multicast group identifier.

19. A computer program product stored in a computer operable media for sending data to a client device, said computer program product comprising:

means for establishing a secure channel with the client device over the computer network;

means for transmitting channel data to the client device over the secure channel, the channel data including details corresponding to one or more non-secure channels;

means for sending data to the client device over a first non-secure channel selected from the one or more non-secure channels.

20. The computer program product as described in claim 19 further comprising:

means for transmitting a switching algorithm over the secure channel, the switching algorithm including timing details regarding switching through a sequence of a plurality of non-secure channels wherein the first non-secure channel is the first of the sequence;

means for determining a number of packets to send over the first non-secure channel; and

means for sending data to the client device over a second non-secure channel selected from the sequence in response to the number of packets being sent over the first non-secure channel.

21. The computer program product as described in claim 19 further comprising:

means for transmitting a first non-secure channel identifier over the secure channel prior to the sending, the first non-secure channel identifier corresponding to the first non-secure channel;

means for transmitting a second non-secure channel identifier over the secure channel; and

sending data to the client device over a second non-secure channel that corresponds to the second non-secure channel identifier.

22. The computer program product as described in claim 19 wherein the channel data includes one or more multicast group addresses and the first non-secure channel is a first multicast group address selected from the multicast group addresses, the computer program product further comprising:

means for receiving, from an endpoint router attached to the computer network, receiver data corresponding to one or more receivers, wherein each of the receivers has joined a multicast group corresponding to the first multicast group identifier;

means for comparing a tally included in the receiver data with a second tally corresponding to a number of subscribers authorized to receive data sent to the multicast group; and

means for changing the multicast group identifier to a second multicast group identifier to which the data is sent over the computer network in response to the comparison.

23. The computer program product as described in claim 20 further comprising:

means for identifying an illicit receiver limit; and

means for determining whether the tally exceeds the second tally by the illicit receiver limit, wherein the means for changing is performed in response to the determination.

24. The computer program product as described in claim 20 wherein the receiver data includes demographic data corresponding to the receivers and wherein the computer program product further comprises:

means for identifying group demographic data from the receiver data; and

means for analyzing the group demographic data.

25. The computer program product as described in claim 19 further comprising:

means for receiving a subscription request from the client device; and

means for validating the subscription request, wherein the establishing, transmitting, and sending are each performed in response to the validation.

26. The computer program product as described in claim 19 wherein the channel data includes one or more port numbers and wherein the first non-secure channel corresponds with a first port number selected from the one or more port numbers.