Downloadable security and protection methods and apparatus

• US 20080098212A1
• Filed: 10/20/2006
• Published: 04/24/2008
• Est. Priority Date: 10/20/2006
• Status: Active Grant

• Current Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Original Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Inventors: Schnitzer, Jason Kazmir, Carlucci, John B., Helms, William L.
• Granted Patent: US 8,520,850 B2
• Time in Patent Office: Days
• US Class Current: 713/155
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 8/63 Image based installation; Cloning; Build to order
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/605 Copy protection
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/2351 involving encryption of additional data arrangements using cryptography for the use of broadcast information or broadcast-related information H04H60/23
• CPC Class Codes: H04N 21/2541 Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/2543 Billing , e.g. for subscription services payment schemes, architectures or protocols G06Q20/00; e-commerce G06Q30/00; arrangements for billing for the use of broadcast information or broadcast-related information H04H60/21
• CPC Class Codes: H04N 21/25816 : involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/26606 : for generating or managing entitlement messages, e.g. Entitlement Control Message [ECM] or Entitlement Management Message [EMM] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/26613 : for generating or managing keys in general key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04
• CPC Class Codes: H04N 21/4353 : involving decryption of additional data arrangements using cryptography for the use of broadcast information or broadcast-related information H04H60/23
• CPC Class Codes: H04N 21/4363 : Adapting the video stream to a specific local network, e.g. a Bluetooth® network
• CPC Class Codes: H04N 21/4405 : involving video stream decryption
• CPC Class Codes: H04N 21/4623 : Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/4627 : Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/478 : Supplemental services, e.g. displaying phone caller identification, shopping application
• CPC Class Codes: H04N 21/6118 : involving cable transmission, e.g. using a cable modem
• CPC Class Codes: H04N 21/63345 : by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 21/8166 : involving executable data, e.g. software arrangements for executing specific programs G06F9/44; broadcasting computer programmes in broadcast systems H04H20/91; involving the movement of software or configuration parameters H04L67/34
• CPC Class Codes: H04N 21/8193 : dedicated tools, e.g. video decoder software or IPMP tool
• CPC Class Codes: H04N 7/167 : Systems rendering the television signal unintelligible and subsequently intelligible
• CPC Class Codes: H04N 7/1675 : Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

Methods and apparatus for control of data and content protection mechanisms across a network using a download delivery paradigm. In one embodiment, conditional access (CA), digital rights management (DRM), and trusted domain (TD) security policies are delivered, configured and enforced with respect to consumer premises equipment (CPE) within a cable television network. A trusted domain is established within the user'"'"'s premises within which content access, distribution, and reproduction can be controlled remotely by the network operator. The content may be distributed to secure or non-secure “output” domains consistent with the security policies enforced by secure CA, DRM, and TD clients running within the trusted domain. Legacy and retail CPE models are also supported. A network security architecture comprising an authentication proxy (AP), provisioning system (MPS), and conditional access system (CAS) is also disclosed, which can interface with a trusted authority (TA) for cryptographic element management and CPE/user device authentication.

Claims

1. Network apparatus disposed substantially at a first location of a content-based network and adapted for delivery of security information to a second location of said network, comprising:

a content provisioning apparatus;

a conditional access apparatus in communication with said provisioning apparatus; and

an authentication apparatus in communication with at least said conditional access apparatus;

wherein at least said authentication and conditional access apparatus are configured to cooperate to transmit to said second location both;

(i) at least one cryptographic key, and (ii) encrypted code configured to provide at least protection of said content at a secure element disposed at said second location.

2. The network apparatus of claim 1, wherein said first location comprises a cable system head-end, and said second location comprises a residence or business enterprise.

3. The network apparatus of claim 2, wherein said apparatus is configured to deliver said at least one key and encrypted code via a DOCSIS-compliant cable modem.

4. The network apparatus of claim 2, wherein said apparatus is configured to deliver said at least one key and encrypted code via an in-band downstream QAM.

5. The network apparatus of claim 1, wherein said first location comprises a hub within a broadcast switched architecture (BSA) network.

6. The network apparatus of claim 1, further comprising a personalization server (PS) apparatus in communication with said conditional access system, said PS being adapted to select said at least one cryptographic key and encrypted code based at least in part on a communication received from a client device disposed at said second location and comprising said secure element.

7. The network apparatus of claim 6, further comprising an interface to a trusted authority (TA), said TA providing said at least one cryptographic key to said PS based at least in part on information contained in said communication from said client device to said network apparatus.

8. The network apparatus of claim 7, further comprising a trusted authority proxy (TAP), said TAP in at least periodic communication with a remote trusted authority (TA), said TAP providing said at least one cryptographic key to said PS based at least in part on information contained in said communication from said client device to said network apparatus, and substantially independent of communication with said TA.

9. The network apparatus of claim 6, wherein said authentication apparatus comprises software configured to authenticate said secure element based at least in part on said communication received from said secure element, said authentication comprising a condition precedent for downloading of said at least one key and encrypted code.

10. The network apparatus of claim 1, wherein said encrypted code comprises a secure client adapted to run on said secure element of said client device.

11. The network apparatus of claim 10, wherein said network apparatus is further configured to transmit a bootloader program to run on said secure element to enable at least a portion of said transmitting of said cryptographic key and encrypted code.

12. The network apparatus of claim 10, wherein said network apparatus is further configured to transmit second code to said client device, said second code comprising a conditional access (CA) client, said CA client adapted to run on said secure element to enforce at least one CA policy.

13. Network apparatus disposed substantially at a first node of a content-based network and adapted for delivery of security information to a second node of said network, comprising:

a content provisioning apparatus;

a security management apparatus in communication with said provisioning apparatus; and

an authentication apparatus in communication with at least said security management apparatus;

wherein at least said authentication and security management apparatus are configured to cooperate to transmit to said second node encrypted code configured to manage at least one of (i) a trusted domain (TD) policies or configuration, and (ii) digital rights management (DRM) policies or configuration, within a secure element of a client device disposed at said second node.

14. The network apparatus of claim 13, wherein said first node comprises a cable system head-end, and said second node comprises a residence or business enterprise.

15. The network apparatus of claim 14, wherein said apparatus is configured to deliver said encrypted code via a DOCSIS-compliant cable modem.

16. The network apparatus of claim 14, wherein said apparatus is configured to deliver said encrypted code via an in-band downstream QAM.

17. The network apparatus of claim 13, wherein said first node comprises a hub within a broadcast switched architecture (BSA) network.

18. The network apparatus of claim 13, further comprising a personalization server (PS) apparatus in communication with said security management system, said PS being adapted to select said encrypted code based at least in part on a communication received from a client device disposed at said second node.

19. The network apparatus of claim 18, wherein said authentication apparatus comprises software configured to authenticate said secure element of said client device based at least in part on said communication received from said client device, said authentication being required before downloading said encrypted code.

20. The network apparatus of claim 13, wherein said client device disposed at said second node comprises a premises content distribution apparatus for use with a plurality or media-capable devices, said content distribution apparatus comprising:

a first interface capable of at least receiving media content from a first network;

a mass storage device in data communication with said first interface and adapted to store at least a portion of said media content;

a coaxial cable interface configured to provide networking throughout at least a portion of said premises over coaxial cable present therein; and

a wireless access interface adapted to support at least one wireless network substantially within said premises;

wherein said media content is accessible to users on both said coaxial cable network and said at least one wireless network.

21. The network apparatus of claim 13, wherein said encrypted code comprises a secure client adapted to interoperate with said secure element of said client device.

22. The network apparatus of claim 21, wherein said network apparatus is further configured to transmit a bootloader program to interoperate with said secure element to enable at least a portion of said transmitting of said encrypted code and a cryptographic key.

23. The network apparatus of claim 22, wherein said network apparatus is further configured to transmit second code to said client device, said second code comprising a TD or DRM client, said TD or DRM client adapted to interoperate with said secure element to enforce at least one TD or DRM policy, respectively.

24. A method of operating a security management architecture within a content-based network, comprising:

providing an encrypted software image to a client device;

providing a first cryptographic key to said client device;

using said first cryptographic key to enable decryption of said software image;

providing at least a second cryptographic key to said client device; and

using said second key to decrypt encrypted content delivered to said client device.

25. The method of claim 24, wherein said act of providing at least a second key comprises providing a second key and a third key, said third key being used to decrypt said second key.

26. The method of claim 25, wherein:

said second key comprises an encrypted key;

said third key comprises an encrypted portion of a public-private key pair; and

said method further comprises providing said client device with a private portion of said public-private key pair, said private portion being used to decrypt said third key, said third key being used to decrypt said encrypted second key.

27. The method of claim 24, wherein said act of providing a first key comprises providing an encrypted public portion of a public/private key pair, and said method further comprises:

providing said client device with a private portion of said public/private key pair; and

decrypting said encrypted public portion using said private portion.

28. The method of claim 24, wherein at least one of said first and second keys is encrypted using a symmetric block cipher algorithm.

29. The method of claim 24, wherein said software image is encrypted using a symmetric block cipher algorithm comprising a power-of-two key.

30. A method of operating a security management architecture within a content-based network, comprising:

providing an encrypted software image to a client device having a security processor;

providing a first cryptographic key to said client device;

using said first cryptographic key to enable decryption of said software image; and

configuring at least a portion of the security processor of said client device using at least said decrypted software image.

31. The method of claim 30, wherein said act of providing a first key comprises providing an encrypted public portion of a public/private key pair, and said method further comprises:

providing said client device with a private portion of said public/private key pair; and

decrypting said encrypted public portion using said private portion.

32. The method of claim 30, wherein said act of configuring comprises remotely configuring based at least in part on instructions generated remote from said client device.

33. The method of claim 30, wherein said client device comprises an OCAP-compliant digital set-top box, and said acts of providing comprise transmitting said software image and said first key over a hybrid fiber-coax (HFC) network to said client device using a DOCSIS channel for at least one of said image and said first key.

34. The method of claim 33, wherein said act of providing an encrypted software image to a client device comprises providing at least one of a conditional access (CA), digital rights management (DRM), or trusted domain (TD) client to a secure processor of said set-top box, said at least one client being adapted to enforce at least one security policy within said set-top box.

35. Network security apparatus adapted for transmission of security information to an authenticated client device in data communication with said network, the apparatus comprising:

a security management apparatus adapted for communication with said network; and

an authentication apparatus in communication with at least said security management apparatus;

wherein said authentication and security management apparatus are configured to cooperate to transmit to said authenticated client device;

(i) a portion of a public-private key pair, said client device comprising the other portion of said key pair; and

(ii) encrypted code configured to manage at least one aspect of a security architecture within a secure element of a client device;

wherein said public-private key pair is configured to decrypt said encrypted code.

36. The apparatus of claim 35, further comprising a trusted authority proxy, said proxy in data communication with said security management apparatus and configured to securely communicate with a remote trusted authority.

37. The apparatus of claim 35, wherein said at least one aspect comprises security policies relating to distributing content delivered to said client device to one or more secure output domains (SODs).

38. The apparatus of claim 35, wherein said authentication apparatus is configured to communicate with said secure element of said client device in order to authenticate said client device, said physically secure element comprising a security microprocessor.

39. A method of remotely providing a trusted domain for content protection within a premises having a client device, comprising:

transmitting encrypted software to said client over a network;

transmitting a first decryption key to said client device;

using a second decryption key to access said first decryption key;

using said first decryption key to decrypt said software; and

using said software to establish at least a portion of said trusted domain within said client device;

wherein content can be securely transported within said trusted domain.

40. The method of claim 39, wherein said encrypted software comprises a trusted domain (TD) client program, said TD client being adapted to run on a physically secure microprocessor within said client device, said TD client establishing a plurality of security and content distribution policies within said trusted domain, said policies and said trusted domain cooperating to prevent unauthorized reproduction of said content.

41. The method of claim 40, wherein said encrypted software further comprises a conditional access (CA) client program, said CA client being adapted to run on a physically secure microprocessor within said client device, said CA client establishing a plurality of content access policies within said trusted domain, said access policies and said trusted domain cooperating to prevent unauthorized access to said content.

42. Security apparatus for use with a content-based network, comprising:

client-side security management apparatus in operative communication with the network and adapted to maintain at least a portion of a trusted domain within a client device using at least a secure element; and

network security management apparatus in operative communication with the network and said client-side management apparatus, said network security management apparatus adapted to control at least one of the configuration and operation of said client-side apparatus in order to protect content delivered to said client device against unauthorized distribution or reproduction.

43. The security apparatus of claim 42, wherein said network security management apparatus comprises:

a content provisioning apparatus;

a conditional access apparatus in communication with said provisioning apparatus; and

an authentication apparatus in communication with at least said conditional access apparatus;

wherein said authentication, provisioning and conditional access apparatus are configured to cooperate to transmit to said secure element of said client device both;

(i) at least one cryptographic key, and (ii) encrypted code configured to provide at least protection of said content at said client device.

44. The security apparatus of claim 43, wherein said secure element of said client-side security management apparatus comprises:

a physically secure microprocessor adapted to run said encrypted code after decryption thereof, said encrypted code enforcing at least a portion of a plurality of security policies necessary to maintain said trusted domain;

wherein said physically secure microprocessor further comprises;

a bootloader function adapted to cause authentication of said secure microprocessor with said authentication apparatus; and

a conditional access (CA) client adapted to interface with said conditional access apparatus on said network side in order to establish one or more conditional access policies with respect to said content.

45. A method of doing business over a content-based network, comprising:

identifying a plurality of substantially unique client devices in data communication with said network; and

selectively configuring at least one of said plurality of client devices based at least in part on a service request from a subscriber associated with said at least one device, said selective configuration comprising;

generating personalization data specific to said at least one client devices;

transmitting said data to said at least one client device; and

establishing at least one security permission or policy within a secure element of said at least one client device, said at least one permission or policy enabling provision of said requested service.

46. The method of claim 45, wherein said service request comprises part of a feature offered within only selected levels of a network operator service subscription plan.

47. The method of claim 45, wherein said service request comprises a request for download and distribution of protected content to a second device in data communication with said client device.

48. The method of claim 47, wherein said distribution of protected content to a second device in data communication with said client device comprises distribution of encrypted video content to said second device via a Firewire (IEEE-1394) interface.

49. The method of claim 48, wherein said distribution of protected content to a second device in data communication with said client device comprises distribution of encrypted video content to said mobile device via a WiFi (IEEE-802.11) interface.

50. The method of claim 45, wherein said act of generating personalization data comprises generating an encrypted software image and cryptographic key that is unique to said secure element of said at least one client device.

51. A method delivering secure software over a network to a remote client device, comprising:

providing via a first entity device credentials along with the public key for said client device to a second entity;

returning a client device-specific personalized software image to said first entity from said second entity;

returning a common software image to said first entity from said second entity;

encrypting at least the device-specific image for the specific client device based at least in part on said public key; and

sending via the first entity said encrypted device-specific image and said common image.

52. The method of claim 51, wherein said first entity comprises an authentication proxy, and said second entity comprises a personalization server.

53. The method of claim 51, wherein said act of encrypting comprises encrypting using at least a portion of said second entity.

54. The method of claim 51, wherein said act of encrypting comprises encrypting using at least a portion of said first entity.

55. The method of claim 51, wherein said act of sending comprises sending within an encrypted message attachment.

56. The method of claim 51, further comprising the first entity signaling the second entity as to the status of the delivery of at least the device specific image.

57. The method of claim 51, wherein said public key corresponds to a private key retained within said client device, said private key being adapted to decrypt said encrypted at least device-specific image.

58. The method of claim 51, wherein said common image comprises an image applicable to all of a plurality of client devices having a common configuration and disposed within said network, and said device-specific image is specific to only said remote client device.

59. Network apparatus comprising:

a common image server; and

a device-specific image server;

wherein said apparatus is adapted to securely obtain and deliver a device-specific software image, as well as a common software image, to at least a secure element of a target client device, said common image being applicable to all of a plurality of client devices having a common configuration and disposed within a network, and said device-specific image being specific to only said secure element of said target client device.

60. The apparatus of claim 59, wherein said apparatus is adapted to communicate over said network with said secure element disposed on said target device, at least said device-specific image being adapted to run within a software environment of said secure element in order to enforce one or more security policies within a domain associated with said target device.

61. The apparatus of claim 60, wherein said network comprises a content-based delivery network, and said target device comprises an OCAP-compliant premises device having a cable modem and an RF tuner, said cable modem being used to receive at least a portion of said device-specific image.

62. The apparatus of claim 61, wherein said content-based delivery network comprises a cable television network, and said cable modem comprises a DOCSIS gateway (DG) function having a plurality of individual logical tunnels associated therewith, at least one of said tunnels being used to deliver said at least a portion of said device-specific image.

63. Network apparatus for use in providing secure content and software downloads to a plurality of client devices within a cable television network, the apparatus comprising:

secure download infrastructure adapted for data communication with a trusted authority (TA);

a media provisioning system in data communication with said infrastructure;

a billing system in data communication with said provisioning system;

a media security system in data communication with said provisioning system; and

a media services system in data communication with said provisioning system;

wherein;

said secure download infrastructure and said TA cooperate to provide cryptographic elements and at least one secure client device software image for delivery by said infrastructure to said client devices; and

said provisioning system and said security system determine and apply entitlements for selected ones of said client device in order to authorize providing said cryptographic elements and said at least one software image thereto.

64. An on-demand conditional access apparatus for use in a content based network having a plurality of client devices associated therewith, said apparatus comprising a computerized server adapted to establish a security envelope around at least a portion of a requesting one of said client devices, said security envelope allowing for the protection of both content and software images contained therein.

65. The apparatus of claim 64, wherein said at least portion of said client device comprises a secure element resident on said client device.

66. The apparatus of claim 65, wherein said secure element comprises a secure microprocessor, and said apparatus is adapted to securely obtain and transmit a device-specific software image, as well as a common software image, to at least said secure microprocessor, said common image being applicable to those of said plurality of client devices having a common configuration, and said device-specific image being specific to only said secure microprocessor of said requesting client device.

67. The apparatus of claim 64, wherein said security envelope is established substantially in response to a request from said requesting one of said client devices to download content.