Technique for securely communicating programming content

• US 8,312,267 B2
• Filed: 12/07/2004
• Issued: 11/13/2012
• Est. Priority Date: 07/20/2004
• Status: Active Grant

• Current Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated), Comcast Cable Communications LLC (Comcast Corporation)
• Original Assignee: Time Warner Cable Inc. (Charter Communications Incorporated)
• Inventors: Helms, William, Carlucci, John B., Hayashi, Michael T., Fahrny, James W.
• Primary Examiner(s): Armouche, Hadi
• Application Number:
  US11/006,404
• Publication Number:
  US 20060047957A1
• Time in Patent Office: 2,898 Days
• Field of Search: 380/231, 713/165, 726/29
• US Class Current: 713/165
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/23473 by pre-encrypting
• CPC Class Codes: H04N 21/2541 Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/25816 involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/26613 for generating or managing keys in general key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/4627 Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/6334 for authorisation, e.g. by transmitting a key wireless communications network key management H04W12/04; wireless communications network access security H04W12/08
• CPC Class Codes: H04N 21/63775 for uploading keys, e.g. for a client to communicate its public key to the server key management H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 21/6582 Data stored in the client, e.g. viewing habits, hardware capabilities, credit card number arrangements where receivers interact with the broadcast H04H20/38
• CPC Class Codes: H04N 21/8355 involving usage data, e.g. number of copies or viewings allowed
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58
• CPC Class Codes: H04N 7/17318 Direct or substantially direct transmission and handling of requests
• CPC Class Codes: H04N 7/17354 in an intermediate station common to a plurality of user terminals

Abstract

A technique for securely transferring content from a first device in a first layer to a second device in a second layer. In one embodiment, the first device is a device in a trusted domain and the second device is outside of the trusted domain. Transfer of protected content to another device may require authentication of the receiving device. A rights file which specifies the rights of the receiving device to use the protected content, according to its security level is also transferred. These rights may concern, e.g., the number of times the receiving device may transfer the protected content to other devices, the time period within which the receiving device may play the protected content, etc. The higher the security level of the receiving device, the more rights accorded thereto. A minimum security level requirement may be imposed in order for protected content to be transferred to a device.

Claims

1. A method for transferring programming content between devices, comprising:

defining a first protective layer, devices within the first protective layer transferring programming content to one another pursuant to a first process; and

defining a second protective layer, a first device in the first protective layer transferring selected programming content to a second device in the second protective layer pursuant to a second process which comprises;

authenticating the second device to determine legitimacy of the second device for receiving the selected programming content, the second device being assigned an indicator indicating an extent of security thereof;

transferring to the second device the selected programming content and a set of rules associated with the selected programming content after the second device is authenticated, at least some of the rules in the set being associated with the indicator and indicating an authorization of the second device to transfer the programming content to one or more third devices; and

transferring the selected programming content to the one or more third devices based at least in part on the rules, the third devices being registered to a user of the second device.

2. The method of claim 1 wherein the first device includes a set-top terminal for receiving the selected programming content from a broadband communications network.

3. The method of claim 2 wherein the broadband communications network includes a cable network.

4. The method of claim 3 wherein the set of rules is instituted by an operator of the cable network.

5. The method of claim 1 wherein the set of rules is instituted by a provider of the selected programming content.

6. The method of claim 1 wherein the second device is authenticated by verifying data in a digital certificate provided by the second device.

7. The method of claim 1 wherein the selected programming content includes movie content.

8. The method of claim 1 further comprising before the selected programming content is transferred to the device, determining whether the extent of the security of the second device indicated by the indicator meets a certain one of the rules in the set.

9. The method of claim 8 wherein the programming content is transferred after it is determined that the extent of the security of the second device indicated by the indicator meets the certain rule.

10. The method of claim 1 wherein one of the rules in the set concerns the number of times the second device can transfer the selected programming content to other devices.

11. The method of claim 1 wherein one of the rules in the set concerns a period within which the second device can play the selected programming content.

12. The method of claim 1 wherein one of the rules in the set specifies rights of the second device to transfer the selected programming content to another device as a function of an extent of security of the other device.

13. A system for transferring programming content between devices, comprising:

devices within a first protective layer transferring programming content to one another pursuant to a first process; and

a first device in the first protective layer transferring selected programming content to a second device pursuant to a second process, the first and second devices being registered to a single user and the first device including a processor programmed to perform the second process which comprises;

authenticating the second device to determine legitimacy of the second device for receiving the selected programming content, the second device being assigned an indicator indicating an extent of security thereof; and

transferring to the second device the selected programming content and a set of rules associated with the selected programming content after the second device is authenticated, at least some of the rules in the set being associated with the indicator and applicable to the second device with respect to use of the selected programming content;

wherein each of the first and second devices utilizes a decryption key specific to the single user to decrypt the selected programming content.

14. The system of claim 13 wherein the first device comprises a set-top terminal for receiving the selected programming content from a broadband communications network.

15. The system of claim 14 wherein the broadband communications network includes a cable network.

16. The system of claim 15 wherein the set of rules is instituted by an operator of the cable network.

17. The system of claim 13 wherein the set of rules is instituted by a provider of the selected programming content.

18. The system of claim 13 wherein the second device is authenticated by verifying data in a digital certificate provided by the second device.

19. The system of claim 13 wherein the selected programming content includes movie content.

20. The system of claim 13 wherein before the selected programming content is transferred to the device, whether the extent of the security of the second device indicated by the indicator meets a certain one of the rules in the set is determined.

21. The system of claim 20 wherein the programming content is transferred after it is determined that the extent of the security of the second device indicated by the indicator meets the certain rule.

22. The system of claim 13 wherein one of the rules in the set concerns the number of times the second device can transfer the selected programming content to other devices.

23. The system of claim 13 wherein one of the rules in the set concerns a period within which the second device can play the selected programming content.

24. The system of claim 13 wherein one of the rules in the set specifies rights of the second device to transfer the selected programming content to another device as a function of an extent of security of the other device.

25. A client device configured to transfer programming content to one or more second devices registered to a same user as said client device, said client device comprising:

a storage apparatus configured to store said programming content; and

a processor configured to run at least one computer program thereon, said computer program comprising a plurality of instructions which are configured to, when executed;

authenticate said one or more second devices to determine legitimacy of said one or more second devices for receiving said programming content, said authentication being based at least in part on respective indicators assigned to respective ones of said one or more second devices and indicating an extent of security thereof; and

transfer to said one or more second devices said programming content and a plurality of rules associated with said programming content after said one or more second devices are authenticated, at least some of said plurality of rules being associated with said indicator and applicable to respective ones of said one or more second devices;

with respect to use of said programming content;

wherein said client device and said one or more second devices utilize a decryption key specific to said same user to decrypt said programming content.

26. The device of claim 25, wherein at least one of said plurality of rules specifies rights of said one or more second devices to transfer said programming content to one or more third devices as a function of an extent of security of said one or more third devices.

27. The device of claim 25, wherein said computer program is further configured to, when executed, encrypt said programming content with a cryptographic element derived at least in part from information regarding said same user.

28. The device of claim 25, wherein at least one of said plurality of rules specifies rights of said one or more second devices to play or record said programming content.

29. A method of for transferring programming content from a first device to a second device, said method comprising:

authenticating said second device in order to determine legitimacy of said second device for receiving said programming content, said second device being assigned an indicator indicating an extent of security thereof and said authentication being based at least in part on said indicator; and

upon completion of said determination, transferring to said second device (i) said programming content, and (ii) one or more rules associated with said programming content, at least a portion of said one or more rules being associated with said indicator and applicable to said second device with respect to use of said programming content;

wherein said first and second devices are registered to a single user; and

wherein each of the first and second devices utilizes a decryption key specific to said single user to decrypt said programming content.

30. The method of claim 29, further comprising said second device transferring said programming content to said one or more third devices based at least in part on one or more of said rules.

31. The method of claim 30, wherein said one or more third devices are registered to said single user.

32. The method of claim 29, wherein at least one of said one or more rules specifies rights of said one or more second devices to play or record said programming content.