SYSTEMS AND METHODS FOR PERFORMING TRANSPORT I/O

• US 20180027288A1
• Filed: 09/20/2017
• Published: 01/25/2018
• Est. Priority Date: 03/13/2013
• Status: Active Grant

• Current Assignee: NagraStar LLC (Kudelski SA)
• Original Assignee: NagraStar LLC (Kudelski SA)
• Inventors: Beals, William Michael, Fischer, Nicolas, Ellis, Benjamin Brian, Duval, Gregory
• Granted Patent: US 10,382,816 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 2209/16 Obfuscation or hiding, e.g. involving white box
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04N 21/23406 involving management of server-side video buffer
• CPC Class Codes: H04N 21/2401 Monitoring of the client buffer
• CPC Class Codes: H04N 21/4181 for conditional access
• CPC Class Codes: H04N 21/4367 Establishing a secure communication between the client and a peripheral device or smart card
• CPC Class Codes: H04N 21/44004 involving video buffer management, e.g. video decoder buffer or video display buffer
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/4408 involving video stream encryption, e.g. re-encrypting a decrypted video stream for redistribution in a home network
• CPC Class Codes: H04N 21/4623 Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/64715 Protecting content from unauthorized alteration within the network verifying the information received for network security in communication control or processing H04L63/12; integrity in wireless network security H04W12/10
• CPC Class Codes: H04N 21/835 Generation of protective data, e.g. certificates protecting software against unauthorised usage in a vending or licensing environment G06F21/10

Abstract

Systems and methods for implementing a Transport I/O system are described. Network encrypted content may be received by a device. The device may provide the network encrypted content to a secure processor, such as, for example, a smart card. The secure processor obtains a network control work that may be used to decrypt the network encrypted content. The secure processor may decrypt the network encrypted content to produce clear content. In embodiments, the secure processor may then use a local control word to generate locally encrypted content specific to the device. The device may then receive the locally encrypted content from the secure processor and proceed to decrypt the locally encrypted content using a shared local encryption key. The transport I/O system ensures the protection of the network control word by maintaining the network control word on the secure processor.

Claims

1. A removable security device for performing a method comprising:

receiving a first network encrypted elementary stream;

receiving a second network encrypted elementary stream;

decrypting the first and second network encrypted elementary streams using at least one network control word to generate first and second clear content streams;

obtaining at least one local control word;

encrypting the first and second clear content streams to produce first and second locally encrypted content streams, wherein the first and second locally encrypted content streams are generated using the at least one local control word;

multiplexing the first and second locally encrypted content streams into an output stream; and

providing, to a video processing device, the output stream.

2. The removable security device of claim 1, wherein the removable security device is a smart card in a set-top-box.

3. The removable security device of claim 1, wherein the removable security device supports a legacy form factor.

4. The removable security device of claim 3, wherein the legacy form factor is compatible with the ISO-7816 standard.

5. The removable security device of claim 1, wherein encrypting the first and second clear content streams utilizes a transport mode encryption.

7. The removable security device of claim 1, wherein the removable security device and the video processing device communicate using LVDS signaling.

8. The removable security device of claim 1, wherein a first network control word is used to decrypt the first network encrypted elementary stream and second network control word is used to decrypt the second network encrypted elementary stream, and wherein the first and second network control words are different.

9. The removable security device of claim 1, wherein the at least one local control word is generated by the removable security device.

10. The removable security device of claim 1, wherein the local control word is obtained from a key ladder.

12. The removable security device of claim 1, wherein the method further comprises:

receiving at least one additional network encrypted elementary stream;

decrypting the at least one additional network encrypted elementary stream using at least one additional network control word to generate at least one additional clear content stream;

encrypting the at least one additional clear content stream to produce at least one additional locally encrypted content stream; and

wherein multiplexing further comprises multiplexing the first, second, and at least one additional locally encrypted content stream into the output stream.

13. The removable security device of claim 1, further comprising:

obtaining a first local control word, wherein the first clear content stream is encrypted using the first local control word; and

obtaining optional additional local control word(s), wherein the optical additional network content stream(s) are encrypted using the optional additional local control word(s), and wherein some or all of the local control words are different.

6. The removable security device of claim I, wherein encrypting the first and second clear content streams utilizes a bulk mode encryption.

14. A method of partially resetting a secure device, the method comprising:

receiving a signal to reset the device; and

in response to receiving the signal, resetting the core functionality of the device while maintaining the transport functionality of the device, wherein maintaining the transport functionality of the secure device comprises;

receiving packets from a transport stream;

processing the packets; and

providing the packets to another device.

15. The method of claim 14, resetting the core functionality is performed to perform a software update for the secure device.

16. The method of claim 14, wherein the core functionality comprise software for controlling the secure device.

18. A video processing device, comprising:

at least one input, wherein the at least one input receives a data stream comprising at least one network encrypted content stream;

a removable security device, wherein the removable security device receives the at least one network encrypted content from the at least one input, and performing a method comprising;

receiving the network encrypted content stream, wherein the network encrypted stream comprises content and data;

obtaining a network control word;

decrypting the network encrypted content stream using the network control word to generate a clear content stream;

obtaining a local control word;

encrypting the clear content stream to produce a locally encrypted content stream, wherein the locally encrypted content stream is generated using the local control word; and

a processor, wherein the processor receives the locally encrypted content stream from the removable security device, the processor performing a method comprising;

obtaining the local control word(s);

decrypting the locally encrypted content stream(s) using the local control word(s) to produce clear content; and

processing the clear content stream(s).

19. The video processing device of claim 18, wherein the data stream further comprises at least one of:

at least one clear content stream; and

metadata.

20. The video processing device of claim 18, wherein processing the clear content stream(s) comprises one of:

providing the clear content stream(s) to a display device; and

storing the clear content stream(s).

21. A secure device performing a method comprising:

monitoring a buffer;

determining that a number of packets queued in the buffer fall below a threshold;

when the number of packets queued in the buffer fall below the threshold, sending a signal to trigger the receipt of additional data packets.

22. The secure device of claim 21, wherein the secure device operates in a variable bandwidth environment.

23. The secure device of claim 21, wherein the buffer is a FIFO buffer.

24. The secure device of claim 21, wherein the signal is a clear to send (CTS) signal.

25. The secure device of claim 24, wherein the CTS signal is sent to a video processing device.