Preventing unauthorized poaching of set top box assets

• US 8,108,680 B2
• Filed: 07/23/2007
• Issued: 01/31/2012
• Est. Priority Date: 07/23/2007
• Status: Active Grant

• Current Assignee: InterDigital Patent Holdings, Inc. (InterDigital, Inc.)
• Original Assignee: Scientific-Atlanta LLC (Cisco Systems, Inc.)
• Inventors: Murray, Mark R.
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): SHAIFER HARRIMAN, DANT B
• Application Number:
  US11/781,412
• Publication Number:
  US 20090031409A1
• Time in Patent Office: 1,653 Days
• Field of Search: 725/100, 725/110, 725/131, 725/139, 725/151, 713/176
• US Class Current: 713/176
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: H04N 21/25816 involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/42684 Client identification by a unique number or address, e.g. serial number, MAC address, socket ID network arrangements, protocols or services for addressing or naming H04L61/00
• CPC Class Codes: H04N 21/443 OS processes, e.g. booting an STB, implementing a Java virtual machine in an STB or power management in an STB
• CPC Class Codes: H04N 21/462 Content or additional data management, e.g. creating a master electronic program guide from data received from the Internet and a Head-end, controlling the complexity of a video stream by scaling the resolution or bit-rate based on the client capabilities
• CPC Class Codes: H04N 21/8166 involving executable data, e.g. software arrangements for executing specific programs G06F9/44; broadcasting computer programmes in broadcast systems H04H20/91; involving the movement of software or configuration parameters H04L67/34

Abstract

To prevent poaching of an Internet Protocol (IP) set top box (STB) asset or similar network computing device from one system operator to another, code executing in the IP STB not only authenticates downloaded software images using a public key provided in a serial-number assigned digital certificate, but also confirms that the serial number appears on a signed whitelist, or does not appear on a signed blacklist. The code executing in the STB further preferably enforces a rule that only the authority that signed the already-loaded whitelist/blacklist may replace it with a new list. Such a “sticky whitelist/blacklist” ensures that if the STB boots or resets in a new network, the existing authentication list will not be replaced by a list that is valid for a new or different network, and, as a result, that new software code images will not be authenticated.

Claims

1. A method for maintaining control over a set-top-box (STB) asset, comprising:

authenticating, using a hardware-based authentication process, a first software application, the first software application having been generated by a first party, wherein the STB asset is operated by a second party;

once authenticated, using the first software application to authenticate a public key received with a second software application that was generated by a third party and is intended to be run on the STB asset;

once authenticated, using the public key of the third party to authenticate the second software application generated by the third party; and

confirming that the second software application is authorized to be run on the STB asset by consulting a list of authorized third parties, wherein consulting the list of authorized third parties comprise utilizing a list maintenance code signing key (LMCSK) having a unique serial number always recognized by the hardware-based authentication process, and locating the third party that generated the second software application, wherein the list of authorized third parties is itself authenticated by the first software application using the LMCSK.

2. The method of claim 1, wherein the list comprises a plurality of serial numbers associated with the third parties.

3. The method of claim 1, further comprising restricting the ability to replace the list.

4. The method of claim 3, further comprising allowing replacement of the list only by a same signing authority that signed the list.

5. The method of claim 1, wherein said hardware-based authentication comprises authenticating a digital certificate using a public key embedded in hardware.

6. The method of claim 1, wherein the list is compiled in the STB asset.

7. The method of claim 1, wherein the list is downloaded from a server.

8. The method of claim 1, wherein the list is digitally signed with a private key belonging to the second party.

9. The method of claim 8, further comprising authenticating the digitally signed list using a public key compiled in the first software application.

10. The method of claim 8, wherein the first party is the asset hardware vendor.

11. The method of claim 8, wherein the second party is a content service provider.

12. The method of claim 11, wherein the second party is an IPTV service provider.

13. A method, comprising:

storing a first digitally signed list on an electronic device, the first digitally signed list including identification data for a plurality of software vendors authorized to load and run software on the electronic device;

receiving, at the electronic device, a second digitally signed list, the second digitally signed list also including identification data for a plurality of software vendors authorized to load and run software on the electronic device, wherein the identification data comprises a list maintenance code signing key (LMCSK) having a serial number unique to the signing authority that is always recognized by a bootloader;

determining that a signing authority that signed the second digitally signed list is the same as a signing authority that signed the first digitally signed list, wherein determining that the signing authority that signed the second digitally signed list is the same as the signing authority that signed the first digitally signed list comprises authorizing the LMCSK; and

replacing, utilizing the bootloader, the first digitally signed list with the second digitally signed list when it is determined that a signing authority that signed the second digitally signed list is the same as a signing authority that signed the first digitally signed list.

14. The method of claim 13, wherein the electronic device comprises a set top box.

15. The method of claim 13, wherein the first and second digitally signed lists are whitelists.

16. The method of claim 13, wherein said replacing is performed, at least in part, by a software program that has been authenticated via the bootloader.

17. A method comprising:

receiving at a set top box a signed list of serial numbers, wherein the serial numbers respectively identify authorized digital certificates, and a digital certificate includes a public key associated with a developer of a code image;

storing the list of serial numbers in a memory of the set top box;

receiving at the set top box a signed replacement list of serial numbers and a list maintenance code signing key (LMCSK) having a serial number unique to the signing authority that is always recognized by a bootloader;

determining if a signing authority that signed the signed replacement list of serial numbers is the same as a signing authority that signed the list of serial numbers; and

replacing, utilizing the bootloader, the list of serial numbers with the list of serial numbers from the signed replacement list of serial numbers when the signing authority that signed the signed replacement list of serial numbers is the same as a signing authority that signed the list of serial numbers.

18. The method of claim 17, wherein the same signing authority is a system operator for the set top box.

19. The method of claim 17, wherein said replacing is performed, at least in part, by a software program that has been authenticated via a hardware-enforced authentication mechanism.

20. A set-top-box (STB), comprising:

a public key embedded in a hardware device in the STB; and

software code stored and operable on the STB to authenticate, based at least in part on the public key embedded in the hardware device and a stored list of authorized software vendors and a list maintenance code signing key (LMCSK) having a serial number unique to the signing authority that is always recognized by the hardware device, a software image downloaded from a server and prepared by one of a plurality of software vendors, the software code further operable to replace the stored list of authorized software vendors only when a new list of authorized software vendors is signed by a same signing authority that signed the stored list of authorized software vendors and recognized by the LMCSK.

21. The set-top-box of claim 20, wherein the set-top-box communicates over an internet protocol (IP) network.

22. The set-top-box of claim 20, wherein the set-top-box is operable with an internet protocol (IP) television (IPTV) system.

23. The set-top-box of claim 20, wherein the software code is operable to receive the new list of authorized software vendors from a download server.