Apparatus and methods for provisioning in a download-enabled system

• US 9,674,224 B2
• Filed: 12/30/2013
• Issued: 06/06/2017
• Est. Priority Date: 01/24/2007
• Status: Active Grant

• Current Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Original Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Inventors: Apsangi, Shrikant, Carlucci, John B., Bevilacqua, John G., Markley, Jeffrey P., Guduru, Srinivas, Schnitzer, Jason Kazimir
• Primary Examiner(s): ALAM, MUSHFIKH I
• Application Number:
  US14/144,420
• Publication Number:
  US 20140189353A1
• Time in Patent Office: 1,254 Days
• Field of Search: None
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04N 21/2541 Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/4182 for identification purposes, e.g. storing user identification data, preferences, personal settings or data restricting access to computer systems by authenticating users using a predetermined code in combination with an additional device, e.g. dongle or smart card G06F21/123
• CPC Class Codes: H04N 21/42684 Client identification by a unique number or address, e.g. serial number, MAC address, socket ID network arrangements, protocols or services for addressing or naming H04L61/00
• CPC Class Codes: H04N 21/4623 Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/4627 Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/4753 for user identification, e.g. by entering a PIN or password cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08
• CPC Class Codes: H04N 21/6118 involving cable transmission, e.g. using a cable modem
• CPC Class Codes: H04N 21/63345 by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 21/8355 involving usage data, e.g. number of copies or viewings allowed
• CPC Class Codes: H04N 7/17318 Direct or substantially direct transmission and handling of requests

Abstract

Apparatus and methods for provisioning of customer premise equipment (CPE) equipped with a secure microprocessor to receive e.g., digital video content by entering unique identification of the CPE at one or more servers located at the headend or other location of a content-based network. In one embodiment, the CPE comprises a download-enabled (e.g., DCAS) host with embedded cable modem and embedded set-top box functionality, and the provisioning includes enabling DOCSIS functionality of the CPE, assigning an IP address to the CPE and providing the CPE with a client image for the conditional access system chosen by the network operator. In one variant, the network operator can deactivate a provisioned device while connected to the network, as well when disconnected from the network. The network operator can also add, delete or replace conditional access client image in a provisioned device.

Claims

1. Network apparatus disposed substantially at a first location of a content delivery network and configured to provision a security device at a second location of said network, said apparatus comprising:

a provisioning subsystem comprising both a cable modem and a video provisioning apparatus;

a conditional access apparatus in communication with said provisioning subsystem;

an authentication apparatus in communication with at least said conditional access apparatus; and

a personalization server (PS) apparatus in communication with said conditional access system,

wherein said provisioning apparatus is configured to maintain;

identifying information of said security device;

information regarding a topological context of said security device in said network; and

said software configuration of said security device;

wherein at least said authentication apparatus and said conditional access apparatus are configured to cooperate to transmit to said security device;

(i) at least one cryptographic key, and (ii) an encrypted code configured to provide at least protection of content at said security device, and

wherein said PS apparatus is configured to select said at least one cryptographic key and said encrypted code based at least in part on a communication received from said security device.

2. The network apparatus of claim 1, wherein said first location comprises a cable system head-end, and said second location comprises a residence or business enterprise.

3. The network apparatus of claim 1, wherein said first location comprises a hub within a broadcast switched architecture (BSA) network.

4. The network apparatus of claim 1, further comprising an interface to a trusted authority (TA), said TA configured to provide said at least one cryptographic key to said PS apparatus based at least in part on information contained in said communication from a client device to said network apparatus.

5. The network apparatus of claim 4, wherein said authentication apparatus comprises software configured to authenticate a secure element based at least in part on said communication received from said secure element, said authentication comprising a condition precedent for a download of said at least one key and said encrypted code.

6. The network apparatus of claim 1, wherein said encrypted code comprises a secure firmware configured to run on said secure element of a client device.

7. The network apparatus of claim 6, wherein said network apparatus is further configured to transmit a second code to said client device, said second code comprising a conditional access (CA) client, said CA client configured to run on said secure element and to enforce at least one CA policy.

16. The network apparatus of claim 1, wherein said PS apparatus is further configured to select a secure image based at least in part on a communication received from said security device, said secure image configured to manage at least one of (i) trusted domain (TD) policies or configuration, and/or (ii) digital rights management (DRM) policies or configuration, within said security device disposed at said second location.

8. Network apparatus disposed substantially at a first node of a content delivery network and configured to deliver security information to a second node of said network, said apparatus comprising:

a content provisioning apparatus;

a security management apparatus in communication with said content provisioning apparatus;

an authentication apparatus in communication with at least said security management apparatus; and

a personalization server (PS) apparatus in communication with said security management system;

wherein said content provisioning apparatus, said security management apparatus, and said authentication apparatus are configured to cooperate to;

provision a client device coupled to said network;

establish an account associated with said client device;

authenticate a physically secure element of said client device; and

provide at least one secure software image to said secure element, said at least one secure image enabling at least in part access to content distributed over said network;

wherein at least said authentication apparatus and said security management apparatus are configured to cooperate to transmit to said second node said secure image, said secure image configured to manage at least one of (i) trusted domain (TD) policies or configuration, and/or (ii) digital rights management (DRM) policies or configuration, within said secure element of said client device disposed at said second node; and

wherein said PS apparatus is configured to select said secure image based at least in part on a communication received from said client device.

9. The network apparatus of claim 8, wherein said first node comprises a cable system head-end, and said second node comprises a residence or business enterprise.

10. The network apparatus of claim 9, wherein said apparatus is configured to deliver said secure image via a DOCSIS-compliant cable modem.

11. The network apparatus of claim 9, wherein said apparatus is configured to deliver said secure image via an in-band downstream QAM.

12. The network apparatus of claim 8, wherein said first node comprises a hub within a broadcast switched architecture (B S A) network.

13. The network apparatus of claim 8, wherein said authentication apparatus comprises software configured to authenticate said secure element of said client device based at least in part on said communication received from said client device, said authentication being required before a download of said secure image.

14. The network apparatus of claim 8, wherein said client device disposed at said second node comprises a premises content distribution apparatus for use with a plurality of media-capable devices, said content distribution apparatus comprising:

a first interface configured to receive media content from a first network;

a mass storage device in data communication with said first interface and configured to store at least a portion of said media content;

a coaxial cable interface configured to provide networking throughout at least a portion of said premises over coaxial cable present therein; and

a wireless access interface configured to support at least one wireless network substantially within said premises;

wherein said media content is accessible to users on both said coaxial cable network and said at least one wireless network.

15. Network security apparatus for use with a client-side security management apparatus in operative communication with a content delivery network, said client-side apparatus configured to maintain at least a portion of a trusted domain within a client device using at least a secure element, said network security apparatus comprising:

a content provisioning apparatus;

a conditional access apparatus in communication with said content provisioning apparatus;

an authentication apparatus in communication with at least said conditional access apparatus; and

a personalization server (PS) apparatus in communication with said conditional access system;

wherein said content provisioning apparatus is configured to maintain;

identifying information of said network security apparatus;

information regarding a topological context of said network security apparatus in said content delivery network; and

said software configuration of said network security apparatus;

wherein said authentication apparatus, said content provisioning apparatus, and said conditional access apparatus are configured to cooperate to transmit to said secure element of said client device;

(i) at least one cryptographic key, and (ii) encrypted code configured to provide at least protection of said content at said client device, and

wherein said PS apparatus is configured to select said at least one cryptographic key and said encrypted code based at least in part on a communication received from said client device.

17. The network apparatus of claim 15, wherein said PS apparatus is further configured to select a secure image based at least in part on a communication received from said client device, said secure image configured to manage at least one of (i) trusted domain (TD) policies or configuration, and/or (ii) digital rights management (DRM) policies or configuration, within said secure element of said client device.