DOWNLOADABLE SECURITY AND PROTECTION METHODS AND APPARATUS

• US 20180278597A1
• Filed: 03/19/2018
• Published: 09/27/2018
• Est. Priority Date: 10/20/2006
• Status: Active Grant

• Current Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Original Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Inventors: Helms, William L., Carlucci, John B., Schnitzer, Jason Kazmir
• Granted Patent: US 10,362,018 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 8/63 Image based installation; Cloning; Build to order
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/605 Copy protection
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/2351 involving encryption of additional data arrangements using cryptography for the use of broadcast information or broadcast-related information H04H60/23
• CPC Class Codes: H04N 21/2541 Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/2543 Billing , e.g. for subscription services payment schemes, architectures or protocols G06Q20/00; e-commerce G06Q30/00; arrangements for billing for the use of broadcast information or broadcast-related information H04H60/21
• CPC Class Codes: H04N 21/25816 : involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/26606 : for generating or managing entitlement messages, e.g. Entitlement Control Message [ECM] or Entitlement Management Message [EMM] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/26613 : for generating or managing keys in general key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04
• CPC Class Codes: H04N 21/4353 : involving decryption of additional data arrangements using cryptography for the use of broadcast information or broadcast-related information H04H60/23
• CPC Class Codes: H04N 21/4363 : Adapting the video stream to a specific local network, e.g. a Bluetooth® network
• CPC Class Codes: H04N 21/4405 : involving video stream decryption
• CPC Class Codes: H04N 21/4623 : Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/4627 : Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/478 : Supplemental services, e.g. displaying phone caller identification, shopping application
• CPC Class Codes: H04N 21/6118 : involving cable transmission, e.g. using a cable modem
• CPC Class Codes: H04N 21/63345 : by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 21/8166 : involving executable data, e.g. software arrangements for executing specific programs G06F9/44; broadcasting computer programmes in broadcast systems H04H20/91; involving the movement of software or configuration parameters H04L67/34
• CPC Class Codes: H04N 21/8193 : dedicated tools, e.g. video decoder software or IPMP tool
• CPC Class Codes: H04N 7/167 : Systems rendering the television signal unintelligible and subsequently intelligible
• CPC Class Codes: H04N 7/1675 : Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

Methods and apparatus for control of data and content protection mechanisms across a network using a download delivery paradigm. In one embodiment, conditional access (CA), digital rights management (DRM), and trusted domain (TD) security policies are delivered, configured and enforced with respect to consumer premises equipment (CPE) within a cable television network. A trusted domain is established within the user'"'"'s premises within which content access, distribution, and reproduction can be controlled remotely by the network operator. The content may be distributed to secure or non-secure “output” domains consistent with the security policies enforced by secure CA, DRM, and TD clients running within the trusted domain. Legacy and retail CPE models are also supported. A network security architecture comprising an authentication proxy (AP), provisioning system (MPS), and conditional access system (CAS) is also disclosed, which can interface with a trusted authority (TA) for cryptographic element management and CPE/user device authentication.

Claims

1-67. -67. (canceled)

68. A computerized method of operating a security management architecture within a content delivery network, the computerized method comprising:

identifying a plurality of computerized client devices in data communication with the content delivery network;

receiving data representative of a request for a service from a subscriber associated with at least one of the plurality of computerized client devices; and

configuring the at least one of the plurality of computerized client devices based at least in part on the request, the configuring comprising;

generating personalization data specific to the at least one computerized client device;

transmitting the personalization data to the at least one computerized client device; and

establishing at least one security permission or policy within a secure element of the at least one computerized client device, the at least one security permission or policy enabling provision of the requested service to the at least one client device.

69. The computerized method of claim 68, wherein the receiving the data representative of the request for the service comprises receiving data representative of a service request for a feature offered within only selected levels of a network operator service subscription plan.

70. The computerized method of claim 68, wherein the receiving the data representative of the request for the service comprises receiving data representative of a service request for download and distribution of protected digitally rendered content to a second computerized device in data communication with the at least one computerized client device.

71. The computerized method of claim 70, further comprising distributing, based at least on the service request, the protected digitally rendered content to the second computerized device, the distributing comprising delivering encrypted digitally rendered video content to the second computerized device via a high-speed serialized bus protocol interface.

72. The computerized method of claim 70, further comprising distributing, based at least on the service request, the protected digitally rendered content to the second computerized device, the distributing comprising delivering encrypted digitally rendered video content to the second computerized device via a Wi-Fi (IEEE-802.11) interface.

73. The computerized method of claim 68, wherein the generating of the personalization data comprises generating an encrypted software image and cryptographic key that is unique to the secure element of the at least one computerized client device.

74. Computerized network apparatus for use in providing secure digitally rendered content and software downloads to a plurality of computerized client devices within a content delivery network, the computerized network apparatus comprising:

secure download infrastructure adapted for data communication with a computerized trusted authority (TA);

a media provisioning system in data communication with the secure download infrastructure;

a billing system in data communication with the media provisioning system;

a media security system in data communication with the media provisioning system; and

a media services system in data communication with the media provisioning system;

wherein;

the media provisioning system and the media security system determine and cause application of data relating to entitlements for selected ones of the plurality of computerized client devices in order to authorize provision of the a least one cryptographic element and the at least one secure client device software image to the selected ones of the plurality of computerized client devices, the secure download infrastructure and the TA configured to cooperate to provide the at least one cryptographic element and at least one secure client device software image for delivery by the secure download infrastructure to each of the plurality of computerized client devices based at least upon said authorization.

75. The computerized network apparatus of claim 74, further comprising:

a common image server apparatus; and

a device-specific image server apparatus;

wherein the provision of the at least one secure client device software image to the selected ones of the plurality of computerized client devices comprises delivery, via the common image server apparatus and the device-specific image server apparatus, of device-specific software images and a common software image, to respective secure elements of the selected ones of the plurality of computerized client devices.

76. The computerized network apparatus of claim 75, wherein the common software image is applicable to all of the plurality of computerized client devices having a common configuration and disposed within the content delivery network, and the device-specific software images are each specific to only the respective secure elements of the selected ones of the plurality of computerized client devices.

77. The computerized network apparatus of claim 76, wherein:

the common software image comprises a software image that is provided to all of the plurality of computerized client devices associated with a first service level, the first service level indicative of one or more functions enabled at the selected ones of the plurality of computerized client devices; and

the device-specific software images are provided only to the respective selected ones of the plurality of computerized client devices, the device-specific software images comprising software images based on the selected ones of the plurality of computerized client devices being associated with a second service level, the second service level indicating that device-specific software images have one or more additional functions relative to the first service level.

78. The computerized network apparatus of claim 75, wherein the computerized network apparatus is adapted to communicate over the network with the respective secure elements disposed on the selected ones of the plurality of computerized client devices, at least the respective device-specific images being configured to run within respective software environments of the secure elements in order to enforce one or more security policies within respective domains associated with the selected ones of the plurality of computerized client devices.

79. The computerized network apparatus of claim 74, wherein:

the respective secure elements comprise secure microprocessors (SMs) of the selected ones of the plurality of computerized client devices;

the computerized network apparatus further comprises a computerized server configured to establish respective security envelopes around the respective SMs of the selected ones of the plurality of computerized client devices, the security envelopes configured to protect both digitally rendered content and the at least one secure client device software image processed via the respective SMs.

80. The computerized network apparatus of claim 79, wherein the security envelope is established based at least on receipt of data representative of a request from at least one of the selected ones of the plurality of computerized client devices to download the digitally rendered content.

81. The computerized network apparatus of claim 74, wherein the cryptographic elements comprise public keys, the public keys corresponding to private keys respectively retained within the selected ones of the plurality of computerized client devices, the private keys configured to decrypt the at least one secure client device software image when encrypted.

82. A computerized method delivering secure software over a network to a computerized client device, the computerized method comprising:

providing, via a first network entity, credentials along with a public key for the computerized client device to a second network entity;

providing a device-specific software image to the first network entity from the second network entity, the device-specific software image being specific to only the computerized client device;

providing a common software image to the first network entity from the second network entity, the common image comprising an image applicable to all of a plurality of computerized client devices having a common configuration and disposed within the network, the plurality of computerized client devices comprising the computerized client device;

encrypting at least the device-specific software image for the computerized client device based at least in part on the public key; and

transmitting, via the first network entity, the encrypted client device-specific software image and the common software image.

83. The computerized method of claim 82, wherein the providing, via the first network entity, the credentials along with the public key for the computerized client device to the second network entity comprises providing, via a computerized authentication proxy apparatus, the credentials along with the public key for the computerized client device to a personalization server apparatus.

84. The computerized method of claim 82, wherein the encrypting comprises encrypting at least the device-specific software image using at least a portion of the personalization server apparatus to personalize the device-specific software image according to an account associated with a user of the computerized client device, the account identifying a service level indicating one or more capabilities, the personalized device-specific software image configured to support the one or more capabilities.

85. The computerized method of claim 84, wherein the encrypting comprises encrypting at least the personalized device-specific software image using at least a portion of the computerized authentication proxy apparatus to verify the account.

86. The computerized method of claim 82, wherein the transmitting comprises transmitting the encrypted device-specific image and the common image within an encrypted message attachment.

87. The computerized method of claim 82, further comprising causing the first network entity to notify the second network entity of a status of the delivery of at least the device-specific software image.