US20200068175A1 - Method and apparatus for supporting multiple broadcasters independently using a single conditional access system - Google Patents

Abstract

A method and apparatus for brokering the enablement of the communication of encrypted media programs from a plurality of independent broadcasters to a plurality of receivers is disclosed. The system makes use of a pairing key for each provided service, which is differently encrypted by a pairing server and by the broadcaster providing the service. The encrypted versions of the pairing key are decrypted in a first receiver module using information known to the pairing service but not the broadcaster and in a second receiver module using information known to the broadcaster. The pairing key is used to cryptographically bind the first and second receiver modules.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS
• This application is a continuation of U.S. patent application Ser. No. 15/652,082, entitled “METHOD AND APPARATUS FOR SUPPORTING MULTIPLE BROADCASTERS INDEPENDENTLY USING A SINGLE CONDITIONAL ACCESS SYSTEM,” by Ronald P. Cocchi et al., filed Jul. 17, 2017, which application:
• is a continuation-in-part of U.S. patent application Ser. No. 14/692,500, entitled “METHOD AND APPARATUS FOR SUPPORTING MULTIPLE BROADCASTERS INDEPENDENTLY USING A SINGLE CONDITIONAL ACCESS SYSTEM,” by Ronald P. Cocchi, Gregory J. Gagnon, and Dennis R. Flaharty, filed Apr. 21, 2015, now issued as U.S. Pat. No. 9,712,786, which application is a continuation of U.S. patent application Ser. No. 13/541,492, entitled “METHOD AND APPARATUS FOR SUPPORTING MULTIPLE BROADCASTERS INDEPENDENTLY USING A SINGLE CONDITIONAL ACCESS SYSTEM,” by Ronald P. Cocchi, Gregory J. Gagnon, and Dennis R. Flaharty, filed Jul. 3, 2012, now issued as U.S. Pat. No. 9,014,375, which application is a continuation of U.S. patent application Ser. No. 11/795,272, entitled “METHOD AND APPARATUS FOR SUPPORTING MULTIPLE BROADCASTERS INDEPENDENTLY USING A SINGLE CONDITIONAL ACCESS SYSTEM,” by Ronald P. Cocchi, Gregory J. Gagnon, and Dennis R. Flaharty, filed Jul. 13, 2007, now issued as U.S. Pat. No. 8,243,925, which is a national phase application of International Patent Application No.: PCT/US2005/037197, entitled “METHOD AND APPARATUS FOR SUPPORTING MULTIPLE BROADCASTERS INDEPENDENTLY USING A SINGLE CONDITIONAL ACCESS SYSTEM,” by Ronald P. Cocchi, Gregory J. Gagnon, and Dennis R. Flaharty, filed Oct. 18, 2005, which claims benefit of U.S. Provisional Patent Application No. 60/619,663, entitled “METHOD OF SUPPORTING MULTIPLE BROADCASTERS INDEPENDENTLY USING A SINGLE CONDITIONAL ACCESS SYSTEM,” by Ronald P. Cocchi, Gregory J. Gagnon, and Dennis R. Flaharty, filed Oct. 18, 2004, all of which applications are hereby incorporated by reference herein.
• also claims benefit of U.S. Provisional Patent Application, No. 62/446,196, entitled “SIGNALING METHOD FOR CAS SWITCHING AND KEY DERIVATION,” by Ronald P. Cocchi et al., filed Jan. 13, 2017, which is also incorporated by reference herein.
• This application is also related to U.S. patent application Ser. No. 15/207,332, entitled “METHOD AND APPARATUS FOR A BLACKBOX PROGRAMMING SYSTEM PERMITTING DOWNLOADABLE APPLICATIONS AND MULTIPLE SECURITY PROFILES PROVIDING HARDWARE SEPARATION OF SERVICES IN HARDWARE CONSTRAINED DEVICES,” by Ronald P. Cocchi et al, filed Jul. 11, 2016, which application claims benefit of U.S. Provisional Patent Application No. 62/191,200, entitled “METHOD AND APPARATUS FOR A BLACKBOX PROGRAMMING SYSTEM PERMITTING DOWNLOADABLE APPLICATIONS AND MULTIPLE SECURITY PROFILES PROVIDING HARDWARE SEPARATION OF SERVICES IN HARDWARE CONSTRAINED DEVICES,” by Ronald P. Cocchi et al, filed Jul. 10, 2015, all of which applications are hereby incorporated by reference.
BACKGROUND OF THEINVENTION1. Field of the Invention
• The present invention relates to systems and methods for providing conditional access to media programs, and in particular to a system and method for providing for such conditional access between multiple independent broadcasters and a plurality of customers using a single conditional access system.
2. Description of the Related Art
• For many years, media programs such as television and radio programs have been broadcast to viewers/listeners free of charge. More recently, this free-of-charge dissemination model has been augmented with a fee-for-service and/or fee-for-view model in which paying subscribers are provided access to a greater variety and number of media programs, including video programs, audio programs and the like, by cable, satellite and terrestrial broadcasts.
• However, while subscriber-based services are readily available in some areas, they are not available on a world-wide basis. Further, in current media program subscription business models, subscribers are typically offered services from a small number of providers (e.g. DIRECTV or ECHOSTAR, or the approved local cable provider) each of which typically provide a large number of media channels from a variety of sources (e.g. ESPN, HBO, COURT TV, HISTORY CHANNEL). To assure that only subscribers receive the media programs, each service provider typically encrypts the program material and provides equipment necessary for the customer to decrypt them so that they can be viewed.
• Since they provide a large number of programs and typically at a relatively high cost, the vast majority of customers subscribe to only one of the foregoing services (e.g. DIRECTV, ECHOSTAR, or the local cable provider), but not multiple providers. It is expected that future business models will evolve to the point where customers will subscribe to more than one media provider, each of which provides a smaller number of media channels. The foregoing is especially true in areas where subscriber-based services are in their infancy, including for example, large parts of Asia, Africa, and South America.
• One of the roadblocks to the evolution of such services is the means by which the service provider assures that only paying customers receive their media programs. Existing conditional access systems are not compatible with each other, and it is thought to be prohibitively expensive for each provider of a limited number of media programs to produce and provide its own conditional access system to potential subscribers. Another problem is that customers would typically prefer to receive all media programs through a single device (and hence, a single conditional access system), rather than multiple such systems. Accordingly, there is a need in the art for a method and apparatus that allows multiple program providers (e.g. broadcasters) to transmit media programs to paying subscribers via a single conditional access system. The present invention satisfies that need.
SUMMARY OF THE INVENTION
• To address the requirements described above, the present invention discloses a method, apparatus, article of manufacture for brokering the enabling of communication of encrypted media programs from a plurality of independent broadcasters to a plurality of receivers, each encrypted media program decryptable by a first receiver module securely communicating with a second receiver module according to a pairing key associated with one of the plurality of receivers. In one disclosed embodiment, the method comprises the steps of transmitting a service enabling request from one of the plurality of broadcasters to a broker independent from the one of the plurality of broadcasters, the request comprising an identification of the one of the plurality of receivers; receiving a first encrypted version of the pairing key E_S1[K_p] from the broker, the first encrypted version of the pairing key E_S1[K_p] decryptable by first information S₁securely stored in the first receiver module of the one of the plurality of receivers; generating a second encrypted version of the pairing key K_p, the second encrypted version of the pairing key E_S1[K_p] decryptable by second information S₂securely stored in the second receiver module; and transmitting the first encrypted version of the pairing key E_S1[K_p] and the second encrypted version of the pairing key E_S1[K_p] to the one of the plurality of receivers. In another disclosed embodiment, the apparatus is described by system for brokering the enabling of communication of encrypted media programs from a plurality of independent broadcasters to a plurality of receivers, each encrypted media program decryptable by a first receiver module securely communicating with a second receiver module according to a pairing key K_passociated with one of the plurality of receivers. The system comprises a broker, for providing a first encrypted version of the pairing key E_S1[K_p] in response to a service enabling request from one of the plurality of broadcasters, the service request having an identification of one of the plurality of receivers, wherein the first encrypted version of the pairing key E_S1[K_p] is decryptable by first information S₁stored in the first receiver module. In each of these embodiments, at least one of the first information S₁and the second information S₂may be derived from a hardware root of trust stored in at least one of the first receiver module and the second receiver module
BRIEF DESCRIPTION OF THE DRAWINGS
• Referring now to the drawings in which like reference numbers represent corresponding parts throughout:
• FIG. 1 is a diagram illustrating a media program distribution system;
• FIG. 2 is a diagram of a typical subscriber station;
• FIG. 3 is a diagram illustrating a multiple broadcaster media program distribution system;
• FIGS. 4A-4D are diagrams illustrating one embodiment of how the pairing system cooperatively operates with multiple service providers and equipment at the subscriber stations to implement a conditional access system;
• FIG. 5A is a diagram illustrating one embodiment of the service provider;
• FIG. 5B is a diagram illustrating an embodiment of a table stored in the pairing system;
• FIG. 5C is a diagram illustrating an embodiment of a table stored by the service provider;
• FIG. 6 is a diagram illustrating one embodiment of the STB;
• FIG. 7 is a diagram illustrating an exemplary embodiment of the transport module and the CAM; and
• FIG. 8 is a diagram of a computer that can be used to implement selected modules.
DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS
• In the following description, reference is made to the accompanying drawings which form a part hereof, and which is shown, by way of illustration, several embodiments of the present invention. It is understood that other embodiments may be utilized and structural changes may be made without departing from the scope of the present invention.
• FIG. 1 is a diagram illustrating a mediaprogram distribution system100. Thesystem100 includes a plurality of service providers (hereinafter alternatively referred to as broadcasters)102, including afirst service provider102A that broadcasts media programs from asatellite broadcast facility152A via one or more uplink antennas and one ormore satellites156, asecond service provider102B, that broadcasts media programs fromterrestrial broadcast facility152B and one or moreterrestrial antennas164, and athird service provider102C that broadcasts media programs via acable link160.
• Thesystem100 also comprises a plurality ofsubscriber stations104A,104B (alternatively referred to hereinafter as subscriber station104), each providing service to one ormore subscribers112A,112B (alternatively referred to hereinafter as subscribers112). Eachsubscriber station104A,104B may include asatellite reception antenna106A,106B (alternatively referred to hereinafter as satellite reception antenna104) and/or aterrestrial broadcast antenna108A,108B (alternatively referred to hereinafter as terrestrial broadcast antenna108) communicatively coupled to areceiver110A,110B (alternatively referred to hereinafter as receiver110), which is also known as a set top box (STB) or an integrated receiver/decoder (IRD).
• As described above, in prior art systems, eachreceiver110A,110B (or at least, each conditional access system used with each receiver) is capable of receiving subscriber-based media programs from only one of themedia program providers102. Hence, if asubscriber112 wanted to receive media programs from more than onemedia program provider102 on a subscription basis, the subscriber may need not only to have amultiple receivers110 at thesubscriber station104A, but also, will require multiple conditional access systems.
• FIG. 2 is a diagram of atypical subscriber station104. Eachstation104 includes at least one receiver orSTB110, which itself includes atransport module202 that communicates with a conditional access module (CAM)206. In one embodiment, the CAM206 is a smart card that is removably communicatively coupleable to thetransport module202 and hence, the STB110. In another embodiment, theCAM206 is a device such as a chip or a collection of devices that are physically integrated with theSTB110 and irremovable. To assure that only those who subscribe to the service are provided with media programs, the service providers typically encrypt the media program M with a control word CW, thus producing and encrypted program E_CW[M], and transmit the encrypted media program E_CW[M] and an encrypted version of the control word E[CW] to thereceiver110. Thereceiver110 receives both the encrypted program E_CW[M] and the encrypted control word E[CW]. Thetransport module202 analyzes the incoming data stream and passes the encrypted control E[CW] to theCAM206, which decrypts the control word CW and returns the decrypted control word CW to asecurity module204 or similar device in thetransport module202. Thesecurity module204 then uses the control word CW to decrypt the encrypted media program E_CW[M] to produce the media program M for presentation to the subscriber. This system assures that only those who are in possession of avalid CAM206 can receive and decode media programs. However, it does not prevent the use of theCAM206 in anyother STB110. Hence, if theCAM206 is compromised or duplicated, unauthorized access to media programs is possible.
• FIG. 3 is a diagram illustrating a multiple broadcaster Conditional Access Subscriber Administration System (CASAS)200. The MB system200 is similar to that which is disclosed inFIG. 1, but includes apairing broker304, which can communicate with the broadcast facilities152 via acommunications medium302 such as the Internet.
• FIGS. 4A-4D are diagrams illustrating one embodiment of how thepairing broker304 cooperatively operates withmultiple service providers102 and equipment at thesubscriber stations104 to implement a conditional access system.FIGS. 4A-4D will be described in connection with and with reference toFIGS. 5 and 6, which illustrate one embodiment of theservice provider102 elements andSTB110 elements, respectively.
• FIG. 4A begins with apotential customer112 who has decided to subscribe a media program service offered by aservice provider102. To do so, the subscriber contacts theservice provider102 and transmits information sufficient to identify the STB and the CAM to theservice provider102, as shown inblock402. In one embodiment, this information includes anSTB110 unique identifier (ID) (such as a serial number or other designation) and aCAM206 unique identifier (CAM ID). In a preferred embodiment, this is accomplished by transmitting the information via theInternet302 or similar network.
• This can be accomplished by use of a web browser implemented in acomputer512 disposed at thesubscriber station104 and aweb transaction module502 implemented at theservice provider102. If desired, the subscriber's web browser can include the appropriate references to the URL where the request and STB ID and CAM ID should be transmitted. In one embodiment, in addition to the STB ID, the potential subscriber also transmits his/her credit card information (e.g. the account number) as well. This allows for services to be automatically billed for monthly subscription fees without further interaction. Credit card payment administration can be performed by theservice provider102 or by a third party such as PAYPAL. These functions can be performed by the subscriber administration module (SAM)504. TheSAM504 can also comprise or be integrated with a customer relationship management (CRM) system or systems. If access is approved (e.g. if the supplied credit card information has been verified), thesubscriber administration module504 directs theweb transaction module502 to request a pairing key K_pfrom thepairing broker304.
• This implementation reduces the support requirements for theservice provider102. In other embodiments, thepotential customer112 can contact theservice provider102 via telephone or other means and provide the service request, STB ID, and CAM ID. Further, if desired, thepairing broker304 can receive the service request (preferably via an appropriate Internet interface) and forward the request for service and the appropriate identifying information to theservice provider102.
• Theservice provider102 receives the service request the identifying information, as shown inblock404. Theservice provider102 then transmits an enabling service request and the STB ID to thepairing broker304, as shown inblock408. Inblock410, thepairing broker304 receives the service enabling request and the STB ID. A first encrypted version of a pairing key K_pis then provided. The pairing key K_pwas generated either in block by theservice provider102, as shown inblock406 or, preferably by thepairing broker304, as shown inblock406′. The first encrypted version of the pairing key K_pis provided so as to be decryptable using first information S₁securely stored in a first receiver module such as thetransport module202 shown inFIG. 6 (the first encrypted version of the pairing key K_ptherefore described as E_S1[K_p]). In one embodiment, this is accomplished by use of a secret that is known to thepairing broker304, but unknown to theservice provider102. The STB IDs and related first information S₁can be stored in a table or adatabase514 in thepairing broker304. If desired, the related first encrypted versions of the pairing key E_S1[K_p] can be stored as well.
• Inblock414, the first encrypted version of the pairing key E_S1[K_p] is transmitted to theservice provider102. If the pairing key K_pwas generated by thepairing broker304, the pairing key K_pis also transmitted to theservice provider102. One of both of the first encrypted version of the pairing key E_S1[K_p] and the pairing key K_pcan be securely transmitted to theservice provider102 via a shared secret, a private key, or a public/private key security paradigm, if desired.
• The foregoing process can be used to request all services from a service provider with a single pairing key K_por repeated to request other services from theservice provider102, with each service enabled and controlled via a different pairing key K_p. For example, theservice provider102 may provide both general services (e.g. access to a number of channels as a part of a baseline fee service) and pay-per-view services (e.g. access to a particular program or set of programs on a pay-per-view basis). Therefore, if the foregoing process was undertaken to subscribe to the general services and thepotential subscriber112 desires order ahead pay per view (OPPV) services or impulse pay per view (IPPV) services as well, the foregoing process can be repeated for those services, resulting in the provision of a first encrypted version of a different pairing key for each service. The system200 has the ability to store credit information in thesecurity module204,CAM206, or elsewhere, and can therefore limit the amount of IPPV events the subscriber can purchase prior to requesting additional credits. Finally, thepotential subscriber112 can repeat this process for eachservice provider102 from which they wish to receive service.
• Although thepairing broker304 need not generate or store the pairing keys K_p, it may be desirable to do so.FIG. 5B is a diagram showing a table that might be used to store and relate the STB ID to first information S₁, aservice provider102 identifier (BDCST ID), and pairing keys for general services, IPPV, and multiple OPPV services.
• Inblock420, theservice provider102 receives the first encrypted version of the pairing key K_p, and generates a second encrypted version of the pairing key K_psuch that it is decryptable by second information S₂securely stored in a second receiver module such as the conditional access module206 (the second encrypted version of the pairing key K_ptherefore described as E_S1[K_p]).
• Theservice provider102 can store a table or database relating STB IDs and the pairing keys K_pfor each of the provided services.FIG. 5C is an example of how such information may be stored. Note that the BRDCST ID column is not necessary in this case, because the identity of theservice provider102 is inherently known.
• Inblock422, theservice provider102 transmits an entitlement control message (ECM) or an entitlement management message (EMM) to the subscriber station. The ECM is transmitted to theSTB110 in response to a subscriber request for access to general media programs from theservice provider102, while the EMM is transmitted in response to a subscriber request for a specific program (e.g. an impulse or order ahead pay-per-view). The ECM/EMM includes the first encrypted version of the applicable pairing key E_S1[K_p], the second encrypted version of the pairing key E_S1[K_p], and the ID of the service provider102 (BRDCST ID) which is providing the services related to the pairing key K_p. This transmission can be accomplished via the same system used to transmit the media program M itself, or a different communication system such as the Internet or a public switched telephone network (PSTN) or cellphone network. Inblock424, thetransport module304 receives the first encrypted version of the pairing key E_S1[K_p] and the second encrypted version of the pairing key E_S2[K_p], and the service provider ID. The second encrypted version of the pairing key E_S2[K_p] is provided to the conditional access module310, where it is received, decrypted (using the second information S₂) to obtain the pairing key K_pwhich is stored (along with a reference to the service provider ID (BRDCST ID) from which the pairing key K_pwas received), as shown inblocks428 and430. Similarly, the first encrypted version of the pairing key E_S1[K_p] is decrypted and stored in the transport module304 (also along with a reference to the service provider ID from which the pairing key K_pwas received), as shown inblock432.FIG. 6 shows an exemplary embodiment of how the data relating services, broadcasters, and pairing keys K_pmight be stored in the transport module and the conditional access module.
• Thereafter, the pairing key K_pis used to encrypt communications between theconditional access module206 and thetransport module202. Henceforward, theconditional access module206 cannot be used adifferent STB110, although if desired, more than oneSTB110 can be provided to a customer, each having the same first information the conditional access module to be used withdifferent STBs110 in the same household.
• To begin service, thebroadcast module506 and/or thebroadcast headend516 encrypts media programs M510 according to a control word (CW), encrypts the control word (CW) itself, and broadcasts a program stream comprising the encrypted program material E_CW[M] and the encrypted control word E[CW] to theSTBs100, as shown inblocks450,452 and454. The program stream may also comprise program guide information from theprogram guide module508.
• Thetransport module202 in theSTB110 receives the program stream, separates out the packets of information by channel (typically according to a packet ID), and provides the encrypted control word E[CW] to theconditional access module206. Theconditional access module206 receives the encrypted control word E[CW] decrypts it to recover the control word (CW), encrypts the control word (CW) with the pairing key K_p, and provides the encrypted pairing key E_Kp[CW] to thetransport module202, as shown in blocks460-466. Using anSTB application602 andmedia kernel604, thetransport module202 decrypts the encrypted control word E_Kp[CW] using the pairing key K_pthus recovering the control word (CW), as shown inblock472, and uses the decrypted control word (CW) to decrypt the encrypted media program E_CW[M] to produce the media program M, as shown inblock474.
• The foregoing system can be used to modify or change the provision of services from theservice provider102 as well. This can be accomplished by theservice provider102 deleting, adding, or modifying the pairing keys K_pin cooperation with thepairing broker304 in essentially the same way as described above. Such modification can occur at the subscriber's behest (e.g. the subscriber desires either more, less, or different services than previously), or that of the service provider102 (e.g. if the offered services change or the subscriber's credit card is no longer valid).
• The modules described above can be implemented as one or more software modules comprising instructions being performed by one or more special or general purpose processors, or may be implemented with hardware modules having dedicated circuitry, or with both hardware and software modules. In one embodiment, for example, thepairing broker304 is implemented by a pairing server, and theprogram guide module508,broadcast module506,subscriber administration module504 andweb transaction module502 are all implemented as servers, thetransport module202 andsecurity module204 are implemented in a secure, tamperproof electronic circuit, and the conditional access module is implemented on a smart card.
Derived Key Mechanism in SoCs
• The system and method described above uses unique secrets S₁and S₂into thetransport module202 andCAM206. In the embodiments described below, either or both of the unique secrets S₁and S₂can be derived from a hardware root of trust that is programmed into the device itself. For example, thetransport module202 or CAM may be at least partially implemented using System-on-Chip (SoC) architectures that permit hardware root of trust values to be programmed into the SoC at the SoC manufacturing site using black-box techniques. Since the values of S₁and S₂are computed from the hardware root of trust using software and key values that may be provided by the security provider, this permits later allocation of these SoCs to any one of a number of potential CE device manufacturers and many independent CAS/DRM security providers (security provider in this context broadly refers to any entity that would use the derived key database for a population of fielded CE devices to protect content for purchase by another entity who had a particular CE device in the deployed location (e.g. home). SoC programming can also occur at the packaging or product manufacturing facility by execution of an in-field programming sequence on the SoC.
• In traditional broadcast and cable system, content is offered to subscribers within the content distribution ecosystem directly from the service provider, i.e. satellite or cable provider. In some embodiments of such systems, security based on a hardware root of trust is used for high value content. In both CAS and DRM content distribution paradigms, a security provider independent architecture can support multiple concurrent or serial CAS and DRM implementations using a single black box programming security platform with limited One Time Programming (OTP) resources to store secrets representing the hardware root of trust that are used to derive the S₁and S₂values. This “derived key” security architecture implementation can provide a means for instantaneous switching between security profiles offered by different and independent CAS and DRM security providers.
• Hence, security providers may use black box OTP resources as the basis to derive security keys to enable different security schemes by altering the key generation inputs based on CAS and DRM vendor software and possibly vendor unique OTP inputs. The key generation inputs can be provided in the CAS and DRM application that could be loaded at CE device manufacturing or downloaded over the air for a fielded CE device.
• Key derivation can be accomplished in a number of ways, for example, by taking the black box programmed secret OTP keys, CAS/DRM vendor (security provider) software input and possible CAS/DRM vendor unique OTP values and combining in a series of crypto graphic calculations using AES, DES or Triple DES. Where the black box programmed secret OTP keys are used as the key and the software input and CAS/DRM vendor unique OTP values are the data in the crypto graphic operation.
• By changing the key generation inputs used to compute S₁and S₂values, the SoC can derive unique key outputs for each CAS and DRM security provider used for a given content provider or broadcaster. CAS unique inputs such as their assigned conditional access identifier (CA ID) maybe used to differentiate derived keys for different conditional access systems CAS1 versus CAS2.
• These security provider unique key generation outputs enable support for multiple security providers for fielded CE devices typically found inSTBs110, televisions (TVs), Smart TVs and mobile devices such as smartphones. The black box security provider provides compatible headend applications to each content provider, so that the media programs are encrypted or otherwise protected using the CAS and DRM implementation used.
• Another advantage of using a derived key database is that the black box programmed OTP key secrets programmed into the SoC OTP do not have to be divulged to the multiple CAS and DRM security providers, since these security providers would use the derived key databases for their content protection systems, not the OTP value. This means that if a derived key database were compromised, it only affects the specific CAS/DRM security provider that was using that specific derived key database, i.e. such compromise would not affect the fielded CE devices or derived key databases of any other such CAS/DRM security provider.
• The keys and programming infrastructure provided by an independent black box security provider enables fielded CE devices to add additional revenue baring applications to the CE device manufacturer or content provider giving these entities more flexibility in managing their business and offering new services. Besides switching out a CAS/DRM vendor for any number of reasons, enabling the ability to add applications supporting new CAS/DRM vendors in fielded CE devices can result in generating significantly higher content sale revenues without requiring consumers to upgrade their CE devices. Consumer savings are realized by extending the field life of the CE device by allowing the consumer to download new software images to enable the purchase of new content services without having to replace their fielded CE devices.
Extending Fixed Secrets with Key Derivation
• Key derivation techniques can be used to extend the fixed secret, S₁, shown inFIGS. 5A and 5B to decrypt either of the encrypted paring keys E_S1[K_P], E_S2[K_P] to with secrets S₁and S₂, respectively produce the pairing key K_pthat is used to decrypt the ECW shown inFIG. 4C. The extension provides the ability to: (1) Use derived root keys to produce S₁and alternately or in addition, using such root keys to produce S₂and (2) Use this derivation process as a means of renewing key material for a fielded system.
• For example, in a System-on-Chip architecture such as the architecture described in the above-referenced patent application U.S. patent application Ser. No. 15/207,332, now published as U.S. Patent Publication No. 2017/0012952, hardware root of trust values can provide the basis for security providers such as thepairing broker304 and/or one or more of thebroadcasters102 to derive a plurality of different security keys. Such keys can be used to add new security procedures or modify procedures already implemented. This can be accomplished, for example, by altering the key generation inputs based on security provider software (CAS or DRM) and possibly inputs vendor-unique hardware root of trust values. The key generation inputs can be provided in the CAS and DRM application software that could be loaded at into consumer electronics (CE) devices such as the transport module2002 orCAM206 when the devices are manufacture, or remotely downloaded over the air for a fielded CE device. This permits cryptographic separation of the CE devices at both S₁and S₂.
• Such hardware root of trust values can include one-time-programmable (OTP) values programmed into thetransport module202 and orCAM206 using, for example, black box techniques also described in U.S. Patent Publication No. 2017/0012952. Such OTP values may be held secret from other entities as necessary. For example, thepairing broker304 or third party security provider may provide a black box to thebroadcaster102 or manufacturer of the STB, permitting the storage of an OTP value without disclosing that value to the security provider or broadcaster.
• Another advantage of using a derived key database is that the black box programmed OTP key secrets programmed into the SoC OTP may be held secret from (do not have to be released to) the CAS or DRM security provider, since these security providers would use the OTP key secrets to derive the keys required for their content protection system. This permits supporting multiple security provider vendors. Further, if a database of derived keys database were compromised, this compromise only affects the specific CAS/DRM security provider that was using that specific derived key database, and would not affect the fielded CE devices or derived key databases of any other such CAS/DRM security provider. This allows S₁(and/or S₂) to be updated in the event of an attack that compromises the database of keys.
• FIG. 7 is a diagram illustrating an exemplary embodiment of thetransport module202 and theCAM206, wherein thetransport module202 includes a hardware root oftrust value OTP1702A and/or theCAM206 has another hardware root oftrust value OTP2702B, thus permitting at least one of the first information S₁and second information S₂to be derived from a hardware root of trust secret stored in at least one of thetransport module202 and theCAM206.
• In the illustrated embodiment, thetransport module202 has a SoC with a processor that can performprocessor instructions704A. The processor has access toOTP1702 and can use deriving information such as theprocessor instructions704A to derive or generate the first value S₁via one ormore operations708A. Similarly, theCAM206 comprises a SoC with a processor that can performprocessor instructions704B. The processor has access toOTP1702 and can use theprocessor instructions704A to generate the first value S₁via one ormore operations708B.
• Thetransport module202 may also store one or more further hardware root of trust values OTP1706A1 and OTP2706A2 that can also be used as deriving information to generate the first value S₁. In one embodiment, OTP1706A1 and OTP2706A2 are security provider-unique, with each allocated to different security providers, allowing thetransport module202 to support CAS/DRM procedures of multiple security providers, allowing each such security provider to use their own OTP value706A to generate first information S₁. However, security providers may be provided multiple OTP values as well.
• Likewise, theCAM206 may also store one or more further hardware root of trust values OTP1706B1 and OTP2706B2 that can also be used to generate the second value S₂. OTP1706B1 and OTP2706B2 may be allocated to the same security provider, or different security providers, allowing theCAM206 to support CAS/DRM procedures of multiple security providers.
Hardware Environment
• FIG. 8 illustrates anexemplary computer system800 that could be used to implement the servers or thesubscriber computer512 of the present invention. Thecomputer802 comprises aprocessor804 and a memory, such as random access memory (RAM)806. Thecomputer802 is operatively coupled to adisplay822, which presents images such as windows to the user on agraphical user interface818B. Thecomputer system802 may be coupled to other devices, such as akeyboard814, amouse device816, a printer, etc. Of course, those skilled in the art will recognize that any combination of the above components, or any number of different components, peripherals, and other devices, may be used with thecomputer802.
• Generally, thecomputer802 operates under control of anoperating system808 stored in thememory806, and interfaces with the user to accept inputs and commands and to present results through a graphical user interface (GUI)module818A. Although theGUI module818A is depicted as a separate module, the instructions performing the GUI functions can be resident or distributed in theoperating system808, thecomputer program810, or implemented with special purpose memory and processors. Thecomputer802 also implements acompiler812 which allows anapplication program810 written in a programming language such as COBOL, C++, FORTRAN, or other language to be translated intoprocessor804 readable code. After completion, theapplication810 accesses and manipulates data stored in thememory806 of thecomputer802 using the relationships and logic that was generated using thecompiler812. Thecomputer802 also optionally comprises an external communication device such as a modem, satellite link, Ethernet card, or other device for communicating with other computers.
• In one embodiment, instructions implementing theoperating system108, thecomputer program810, and thecompiler812 are tangibly embodied in a computer-readable medium, e.g.,data storage device820, which could include one or more fixed or removable data storage devices, such as a zip drive,floppy disc drive824, hard drive, CD-ROM drive, tape drive, etc. Further, theoperating system808 and thecomputer program810 are comprised of instructions which, when read and executed by thecomputer802, causes thecomputer802 to perform the steps necessary to implement and/or use the present invention.Computer program810 and/or operating instructions may also be tangibly embodied inmemory806 and/ordata communications devices830, thereby making a computer program product or article of manufacture according to the invention. As such, the terms “article of manufacture,” “program storage device” and “computer program product” as used herein are intended to encompass a computer program accessible from any computer readable device or media.
• Those skilled in the art will recognize many modifications may be made to this configuration without departing from the scope of the present invention. For example, those skilled in the art will recognize that any combination of the above components, or any number of different components, peripherals, and other devices, may be used with the present invention.
CONCLUSION
• This concludes the description of the preferred embodiments of the present invention. The foregoing description of the preferred embodiment of the invention has been presented for the purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise form disclosed. Many modifications and variations are possible in light of the above teaching. It is intended that the scope of the invention be limited not by this detailed description, but rather by the claims appended hereto. The above specification, examples and data provide a complete description of the manufacture and use of the composition of the invention. Since many embodiments of the invention can be made without departing from the spirit and scope of the invention, the invention resides in the claims hereinafter appended.

Claims (20)

What is claimed is:

1. A method of brokering an enabling of communication of at least one encrypted service of a group of encrypted services from a plurality of data providers to a plurality of devices, the at least one encrypted service decryptable by a first device module securely communicating with a second device module according to a pairing key associated with a device of the plurality of devices, comprising:

transmitting a first service enabling request for a first service from a data provider of the plurality of data providers to a broker independent from the data provider, the first service enabling request comprising an identification of the device;

receiving a first encrypted version of the pairing key E_S1[K_p] in the data provider from the broker, the first encrypted version of the pairing key E_S1[K_p] decryptable by first information S₁securely stored in the first device module of the device;

generating a second encrypted version of the pairing key E_S2[K_p] in the data provider, the second encrypted version of the pairing key E_S2[K_p] decryptable by second information S₂securely stored in the second device module; and

transmitting the first encrypted version of the pairing key E_S1[K_p] and the second encrypted version of the pairing key E_S2[K_p] to the device;

wherein each service in the group is enabled by a different pairing key K_p.

2. The method ofclaim 1, wherein the first service is selected from a group consisting of:

a general broadcast service from the data provider, including access to a number of media channels as a baseline fee service;

particular data from the data provider; and

a particular set of data from the data provider.

3. The method ofclaim 2, wherein the service is encrypted according to a control word CW, and the method further comprising

decrypting the first encrypted version of the pairing key E_S1[K_p] in the first device module;

decrypting the second encrypted version of the pairing key E_S2[K_p] in the second device module;

decrypting an encrypted version of the control word E[CW] in the second device module;

re-encrypting the decrypted control word CW according to the decrypted second encrypted version of the pairing key;

providing the re-encrypted control word E_Kp[CW] from the second device module to the first device module; and

decrypting the re-encrypted control word E_Kp[CW] using the decrypted first encrypted version of the pairing key K_p.

4. The method ofclaim 1, further comprising the steps of:

transmitting a second service enabling request for a second service from the data providers to the broker, the second service enabling request comprising an identification of the device;

receiving a first encrypted version of a second pairing key E_S1[K_p2] from the broker, the first encrypted version of the second pairing key E_S1[K_p2] decryptable by the first information S₁securely stored in the first device module of the device;

generating a second encrypted version of the second pairing key E_S2[K_p2], the second encrypted version of the pairing key E_S2[K_p2] decryptable by the second information S₂securely stored in the second device module; and

transmitting the first encrypted version of the second pairing key E_S1[K_p2] and the second encrypted version of the second pairing key E_S1[K_p2] to the device;

wherein the second service is different than the first service.

5. The method ofclaim 4, wherein the data is encrypted according to a control word CW and the method further comprises the steps of:

decrypting the first encrypted version of the second pairing key E_S1[K_p2] in the first device module;

decrypting the second encrypted version of the second pairing key E_S1[K_p2] in the second device module;

decrypting an encrypted version of the control word E[CW] in the second device module;

re-encrypting the decrypted control word CW according to the decrypted second encrypted version of the second pairing key K_p2;

providing the re-encrypted control word

$E_{K_{p_{2}}}\left[\mathrm{CW}\right]$

from the second device module to the first device module; and

decrypting the re-encrypted control word E_KP2[CW] using the decrypted first encrypted version of the second pairing key K_p2.

6. The method ofclaim 2, further comprising the steps of:

transmitting a second service enabling request for a second service from a second data provider of the plurality of data providers to the broker, the request comprising the identification of the device;

receiving a first encrypted version of a second pairing key E_S1[K_p2] from the broker, the first encrypted version of the second pairing key E_S1[K_p2] decryptable by the first information S₁securely stored in the first device module of the device;

generating a second encrypted version of the second pairing key E_S2[K_p2], the second encrypted version of the pairing key E_S2[K_p2] decryptable by the second information S₂securely stored in the second device module; and

transmitting the first encrypted version of the second pairing key E_S1[K_p2] and the second encrypted version of the second pairing key E_S1[K_p2] to the device;

wherein the second service is selected from the group consisting of:

a general broadcast service from the second data provider, including access to a number of media channels as a baseline fee service;

particular data from the second data provider, including an order ahead pay per view service and an impulse pay per view service; and

a particular set of data from the second data provider.

7. The method ofclaim 6, wherein the service is encrypted according to a control word CW, and the method further comprises the steps of:

decrypting the first encrypted version of the second pairing key E_S1[K_p2] in the first device module;

decrypting the second encrypted version of the second pairing key E_S2[K_p2] in the second device module;

decrypting the encrypted version of the control word E[CW] in the second device module;

re-encrypting the decrypted control word CW according to the decrypted second encrypted version of the second pairing key K_p2;

providing the re-encrypted control word

$E_{K_{p_{2}}}\left[\mathrm{CW}\right]$

from the second device module to the first device module; and

decrypting the re-encrypted control word

$E_{K_{p_{2}}}\left[\mathrm{CW}\right]$

using the decrypted first encrypted version of the second pairing key K_p2.

8. The method ofclaim 1, wherein the first service enabling request is transmitted in response to a service request, the service request transmitted from the device to the data provider.

9. The method ofclaim 1, wherein the first information S₁and the second information S₂is known to the broker and the data providers.

10. The method ofclaim 1, wherein the first information S₁is known to the broker and unknown to the data provider, and wherein the second information S₂is known to the data provider and unknown to the broker.

11. The method ofclaim 1, wherein:

the first information S₁is a first secret unique to the device and stored in a first module of the device;

the second information S₂is a second secret is securely stored in a second module of the device.

12. The method ofclaim 11, wherein the second module is a smart card removably coupleable to the first module.

13. The method ofclaim 11, wherein the second module is irremovably integrated with the device.

14. The method ofclaim 1, wherein the pairing key is generated by the data provider and transmitted to the broker.

15. The method ofclaim 1, wherein the pairing key is generated by the broker and transmitted to the data provider in response to the service enabling request.

16. A system for brokering the enabling of communication of at least one encrypted service of a group of encrypted services from a plurality of data providers to a plurality of devices, the at least one encrypted service decryptable by a first device module securely communicating with a second device module according to a pairing key K_passociated with a device of the plurality of devices, the system comprising:

a broker, for providing a first encrypted version of the pairing key E_S1[K_p] in response to a service enabling request for a service from a data provider of the plurality of data providers, the service request having an identification of the device; and

wherein the first encrypted version of the pairing key E_S1[K_p] is decryptable by first information S₁stored in the first device module and wherein the first device module receives the first encrypted version E_S1[K_p] of the pairing key K_pand a second encrypted version of the pairing key E_S2[K_p] from the data provider, the second encrypted version of the pairing key E_S2[K_p] being generated by the data provider and decryptable by second information S₂stored in the second device module;

wherein each service in the group is enabled by a different pairing key K_p.

17. The system ofclaim 16, wherein the service is selected from a group consisting of:

a general broadcast service from the data provider, including access to a number of media channels as a baseline fee service;

particular data from the data provider; and

a particular set of data from the data provider.

18. The system ofclaim 17, wherein the first information S₁and the second information S₂is known to the broker and the data provider.

19. The system ofclaim 17, wherein the first information S₁is known to the broker and unknown to the data provider, and wherein the second information S₂is known to the data provider and unknown to the broker.

20. The system ofclaim 17, wherein:

the first information S₁is a first secret unique to the device and is securely stored in first module of the device; and

wherein the second information S₂is a second secret securely stored in second module of the device.

Images