Technique for securely communicating programming content

• US 9,313,530 B2
• Filed: 11/12/2012
• Issued: 04/12/2016
• Est. Priority Date: 07/20/2004
• Status: Active Grant

• Current Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated), Comcast Cable Holdings LLC (Comcast Corporation)
• Original Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated), Comcast Cable Holdings LLC (Comcast Corporation)
• Inventors: Helms, William, Carlucci, John B., Hayashi, Michael T., Fahrny, John W.
• Primary Examiner(s): Ho, Dao
• Application Number:
  US13/674,866
• Publication Number:
  US 20130104162A1
• Time in Patent Office: 1,247 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/23473 by pre-encrypting
• CPC Class Codes: H04N 21/2541 Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/25816 involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/26613 for generating or managing keys in general key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/4627 Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/6334 for authorisation, e.g. by transmitting a key wireless communications network key management H04W12/04; wireless communications network access security H04W12/08
• CPC Class Codes: H04N 21/63775 for uploading keys, e.g. for a client to communicate its public key to the server key management H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 21/6582 Data stored in the client, e.g. viewing habits, hardware capabilities, credit card number arrangements where receivers interact with the broadcast H04H20/38
• CPC Class Codes: H04N 21/8355 involving usage data, e.g. number of copies or viewings allowed
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58
• CPC Class Codes: H04N 7/17318 Direct or substantially direct transmission and handling of requests
• CPC Class Codes: H04N 7/17354 in an intermediate station common to a plurality of user terminals

Abstract

Technique for securely transferring programming content from a first device in a first layer to a second device in a second layer. Upon request to transfer protected content to the second device, the first device authenticates the second device. After authentication, the first device transfers the protected content and a rights file associated therewith to the second device. The rights file specifies the rights of the second device to use the protected content, according to its security level. These rights may concern, the number of times that the second device may subsequently transfer the protected content to other devices, the time period within which the second device may play the protected content, etc. The higher the security level of the second device is, the more rights accorded thereto. The second device may further need to meet a minimum security level in order for it to receive the protected content.

Claims

1. A computer readable device having a storage medium and a hardware processor, the hardware processor configured to execute a plurality of instructions which are configured to, when executed:

send to a module apparatus a request to record program content;

receive from the module apparatus a response to the request to record, the response comprising;

a data package comprising at least a version of a cryptographic element;

a rights file configured to define one or more transfer rights configured to control a device'"'"'s ability to provide the requested program content to other devices; and

an indicator that the device associated to the request to record is allowed to record the requested program content based at least in part on a plurality of rules; and

encrypt the program content with a second version of the cryptographic element derived from the data package;

store the encrypted program content in association with the data package;

register one or more display devices with the device based at least in part on a verification of data in a digital certificate provided by the one or more display devices;

receive a request to transfer the encrypted program content to the one or more display devices;

determine, before the encrypted content is transferred to the one or more display devices, whether an extent of security of the one or more display devices meets a certain one of the plurality of rules; and

based on the determination, transfer the encrypted program content to the one or more display devices.

2. The computer readable device of claim 1, wherein the rights file comprises one or more of:

a right to play and/or a right to record the requested program content.

3. The computer readable device of claim 1, wherein the rights file comprises a security level of the device.

4. The computer readable device of claim 1, wherein at least one of the plurality of rules concerns a period within which the one or more display devices may play the requested program content.

5. The computer readable device of claim 1, wherein the plurality of rules are instituted by a provider of the requested program content.

6. A method for use in a device connectable to a module apparatus, the device having storage therein, the method comprising:

sending to the module apparatus a request to record a selected programming content;

receiving from the module apparatus a response to the request, the response comprising;

a data package containing at least an encrypted version of a first encryption key; and

an indicator of a determination that the device is allowed to record the selected programming content, the determination based at least in part on a security measure associated with the selected programming content;

based at least in part on the indicator of the determination, recording the selected programming content;

encrypting the recorded programming content with a second encryption key, the second encryption key being derived from the encrypted version of the first encryption key contained within the data package;

storing the encrypted programming content in association with the data package in the storage;

authenticating one or more display devices registered with the device by verifying data in a digital certificate provided by individual ones of the one or more display devices; and

based at least in part on said act of authenticating, making the encrypted programming content available to view on one or more display devices registered with the device.

7. The method of claim 6, wherein the indicator comprises a rights file.

8. The method of claim 7, wherein the rights file comprises a right of individual ones of the one or more display devices registered with the device to play the selected programming content.

9. The method of claim 6, wherein the selected programming content comprises movie content.

10. The method of claim 6, further comprising:

determining whether the security measure meets a certain one of a plurality of rules associated with the selected programming content; and

when the security measure meets the certain one of the plurality of rules, transferring the selected programming content to at least one of the one or more display devices.

11. The method of claim 10, wherein one of the plurality of rules comprises a number of times the device may transfer the selected programming content to the one or more display devices registered with the device.

12. The method of claim 10, wherein one of the plurality of rules specifies rights of the device to transfer the selected programming content to another device as a function of an extent of security of the other device.

13. A device connectable to a module apparatus, the device comprising:

a processor which generates a request to record selected programming content;

an interface which;

transmits the request to the module apparatus; and

receives, from the module apparatus, a response to the request, the response comprising a data package containing at least an encrypted version of a first encryption key, and a determination that the device is entitled to record the selected programming content based at least in part on at least one first security measure associated with the selected programming content, the selected programming content being recorded based on the determination;

an encryption apparatus which causes the processing unit to encrypt the recorded programming content with a second encryption key, the second encryption key being derived from the encrypted version of the first encryption key contained within the data package;

storage which stores the encrypted programming content in association with the data package therein; and

logic which causes the interface to;

authenticate the one or more second devices via verification of data in a digital certificate provided by individual ones of the one or more second devices; and

transfer the recorded programming content to one or more second devices in communication therewith via at least one in band transmission channel of a hybrid fiber coaxial (HFC) network, only when it is determined that the first security measure meets a certain one of a plurality of rules.

14. The device of claim 13, wherein the determination that the device is entitled to record the selected programming content is further based on a security level associated with the device.

15. The device of claim 13, wherein the plurality of rules is instituted by an operator of the HFC network.

16. The device of claim 13, wherein the logic further determines whether the at least one first security measure associated with the selected programming content meets the certain one of a plurality of rules.

17. The device of claim 13, wherein the interface provides data communication between the module apparatus and the device.