Method and apparatus for content protection within an open architecture system

• US 7,502,470 B2
• Filed: 10/03/2003
• Issued: 03/10/2009
• Est. Priority Date: 01/13/2003
• Status: Active Grant

• Current Assignee: Optimum Content Protection LLC (Acacia Research Corporation)
• Original Assignee: Silicon Image, Inc. (Lattice Semiconductor Corporation)
• Inventors: Hanko, James G., Lyle, James D., Northcutt, J. Duane, Lavelle, Michael G.
• Primary Examiner(s): TRAN, ELLEN C
• Application Number:
  US10/679,055
• Publication Number:
  US 20080148063A1
• Time in Patent Office: 1,985 Days
• Field of Search: 713/165, 713/162, 380/200, 380/217, 380/239, 380/241
• US Class Current: 380/200
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G11B 20/00086 Circuits for prevention of unauthorised reproduction or copying, e.g. piracy indicating unauthorised use of record carriers in general G11B23/28; scrambling for television signal recording H04N5/913; network architectures or network protocols for network security H04L63/00; cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
• CPC Class Codes: G11B 20/0021 involving encryption or decryption of contents recorded on or reproduced from a record carrier
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04N 21/2541 Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/4334 Recording operations recording of a television signal H04N5/76; arrangements for recording or accumulating broadcast information or broadcast-related information H04H60/27
• CPC Class Codes: H04N 21/4367 Establishing a secure communication between the client and a peripheral device or smart card
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/4408 involving video stream encryption, e.g. re-encrypting a decrypted video stream for redistribution in a home network
• CPC Class Codes: H04N 21/4627 Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/835 Generation of protective data, e.g. certificates protecting software against unauthorised usage in a vending or licensing environment G06F21/10
• CPC Class Codes: H04N 5/913 for scrambling ; for copy protection
• CPC Class Codes: H04N 7/088 the inserted signal being digital
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

In a class of embodiments, the invention is an open computing system (e.g., a PC) in which a protected, closed subsystem is embedded. The closed subsystem typically includes multiple parts that ensure that content protection keys and protected content are never revealed outside the closed subsystem. Content (e.g., high-definition digital video) that enters the closed subsystem (and is typically decrypted and re-encrypted within the closed subsystem) is afforded a similar level of protection within the open system as can be obtained in standalone closed systems. Other aspects of the invention are methods for protecting content within an open computing system, a closed system (or disk drive thereof) configured to be embedded in an open computing system, and circuitry configured to be embedded in an open computing system for combining the output of a closed subsystem with other output (e.g., graphics and/or audio output) of the open computing system.

Claims

1. A method for content protection in an apparatus comprising:

receiving encrypted data in the apparatus according to a first encryption protocol wherein the apparatus comprises;

an open system architecture configured to allow end users to add or remove hardware components, software modules, or both;

a closed subsystem of the apparatus to receive the encrypted data, wherein the closed subsystem does not allow end users to add hardware components or software modules thereto or remove hardware components or software modules therefrom; and

combiner circuitry that may add unprotected graphics and audio data to raw data;

generating raw data in a closed subsystem of the apparatus within the open system architecture, the raw data being generated in the closed subsystem by decrypting the encrypted data and performing additional processing on the encrypted data wherein the additional processing comprises;

decompressing the encrypted data if compressed encrypted data is received;

and manipulating the encrypted data for output;

preventing access to the raw data outside of the closed subsystem;

adding any applicable unprotected graphics and audio data to the raw data using the combiner circuitry;

generating protected data in the closed subsystem by re-encrypting the raw data using a second encryption protocol to generate protected data with any added graphics and audio data; and

asserting the protected data from the closed subsystem to an external device or system.

2. The method of claim 1, wherein the apparatus is an entertainment device.

3. The method of claim 1, wherein the encrypted data comprises digital video data.

4. The method of claim 3, wherein receiving encrypted data includes reading the digital video data from a disk.

5. The method of claim 3, wherein the digital video data comprises high-definition digital video data, and wherein re-encrypting the raw data includes re-encrypting the raw data in accordance with the HDCP (High-bandwidth Digital Data Protection) protocol.

6. The method of claim 1, wherein re-encrypting the raw data includes the use of key data, and further comprising preventing the key data from being disclosed outside of the closed subsystem except to the external device or system.

7. The method of claim 1, wherein the encrypted data is received from a source external to the apparatus.

8. The method of claim 7, wherein the source external to the apparatus is the Internet.

9. The method of claim 1, further comprising generating additional unprotected data and asserting the additional unprotected data to the closed system.

10. The method of claim 9, further comprising asserting the additional unprotected data from the closed system to the external device or system without encryption.

11. The method of claim 1, wherein the external device or system comprises a display device.

12. An apparatus comprising:

an open system architecture configured to allow end users to add or remove hardware components, software modules, or both;

combiner circuitry that may add unprotected graphics and audio data to raw data;

a closed subsystem within the open system architecture wherein the closed subsystem does not allow end users to add hardware components or software modules thereto or remove hardware components or software modules therefrom, the closed subsystem configured to;

receive encrypted data according to a first encryption protocol,

decrypt and perform additional processing on the encrypted data to generate raw data wherein the additional processing comprises;

decompressing the encrypted data if compressed encrypted data is received, and

manipulating the encrypted data for output,

add any applicable unprotected graphics and audio data to the raw data using the combiner circuitry, and

re-encrypt the raw data to generate protected data usin a second encryption protocol to generate protected data with any added graphics and audio data,

further wherein the closed system prevents access to the raw data outside of the closed subsystem; and

an output, the closed subsystem to assert the protected data to an external device or system via the output.

13. The apparatus of claim 12, wherein the protected data comprises encrypted high-definition digital video data.

14. The apparatus of claim 12, further comprising a second subsystem configured to generate additional unprotected data and to assert the additional unprotected data to the closed subsystem.

15. The apparatus of claim 14, wherein the additional unprotected data comprises audiovisual data.

16. The apparatus of claim 14, wherein the additional unprotected data comprises menu information.

17. The apparatus of claim 14, wherein the closed subsystem is operable in a first mode to assert the protected data to the output and in a second to assert the additional unprotected data to the output.

18. The apparatus of claim 12, wherein the closed subsystem is operable to re-encrypt the raw data using key data.

19. The apparatus of claim 18, wherein the closed subsystem is operable to prevent release of the key data outside of the closed subsystem except to the external device or system.

20. The apparatus of claim 12, wherein the output includes one or more HDMI (Definition Multimedia Interface) compatible links from the apparatus to the external device or system.

21. The apparatus of claim 12, wherein the closed subsystem comprises an HD-DVD drive configured to decrypt high-definition digital video read from a disk to generate decrypted data, to perform decompression on the decrypted data to generate raw data, and to generate the protected data by re-encrypting the raw data.

22. The apparatus of claim 12, wherein the closed subsystem is configured to re-encrypt the raw data in accordance with the HDCP (High-bandwidth Digital Data Protection) protocol.

23. The apparatus of claim 12, wherein the apparatus is configured to communicate bidirectionally with the external device or system to execute an authentication protocol the prior to assertion of the re-encrypted data to the external device or system.

24. The apparatus of claim 23, wherein the apparatus executing the authentication protocol includes verifying that the external device or system is authorized to receive the protected data and to establish shared secret values for use in encryption and decryption of data.

25. The apparatus of claim 12, wherein the apparatus is an entertainment device.

26. The apparatus of claim 14, wherein the closed subsystem is to re-encrypt the raw data using key data, and is to prevent release of the key data outside of the closed subsystem except to the external device or system.

27. The apparatus of claim 14, wherein the apparatus is configured to communicate bidirectionally with the external device or system to execute an authentication protocol the prior to assertion of the re-encrypted data to the external device or system.

28. The apparatus of claim 27, wherein the apparatus executing the authentication protocol includes verifying that the external device or system is authorized to receive the protected data and to establish shared secret values for use in encryption and decryption of data.

29. A system comprising:

a first apparatus with an open system architecture configured to allow end users to add or remove hardware components, software modules, or both, the first apparatus including combiner circuitry that may add unprotected graphics and audio data to raw data, a closed subsystem within the open system architecture wherein the closed subsystem does not allow end users to add hardware components or software modules thereto or remove hardware components or software modules therefrom, the closed subsystem configured to

receive encrypted content according to a first encryption protocol,

decrypt and perform additional processing on the encrypted data to generate raw data wherein the additional processing comprises;

decompressing the encrypted data if compressed encrypted data is received, and

manipulating the encrypted data for output,

add any applicable unprotected graphics and audio data to the raw data using the combiner circuitry,

re-encrypt the raw content to generate protected content using a second encryption protocol to generate protected data with any added graphics and audio data, and

transmit the protected data via an output, the closed system preventing access to the raw content outside of the closed subsystem; and

a second apparatus including an input to receive the protected content and decryption circuitry to generate raw content by decrypting the encrypted video data.

30. The system of claim 29, wherein the protected content comprises encrypted high-definition digital video data.

31. The system of claim 30, wherein the second apparatus includes a digital video monitor.

32. The system of claim 29, wherein the closed subsystem is configured to receive the encrypted content from a remote source.

33. The system of claim 29, wherein the closed subsystem is further to perform decompression on the decrypted data in the generation of the raw content.