Patent Application
20170005993
The present disclosure relates to secure distribution and protection of content such as media content.
Currently the delivery of encrypted video/audio compressed content is managed with a variety of transport stream (TS) formats. For example, encrypted transport streams are used in Satellite/Cable Broadcast, etc. In these cases the payload of TS packets contain packetized elementary stream (PES) packets. In addition, other devices such as digital video discs (DVDs) and Blu-Ray Discs (BDs) utilize encrypted transport streams. Note that PES packets are large packets which encapsulate an Elementary Stream (ES) which comprises small structures such as slices, macro blocks, and motion vectors for video and compressed pulse code modulation (PCM) samples for audio.
The processing of encrypted transport streams must be performed at various stages of video distribution. The process of decrypting compressed content may involve multiple transfers to/from memory which requires additional memory buffers and consumes bandwidth. This introduces a security risk because clear compressed content resides in memory for a period of time. There are various attacks where hackers attempt to read and export the compressed content, particularly in low end software only solutions where third party software operates in the same memory space that stores the content to be protected. This process can require additional hardware resources such as separate compression and encryption blocks. These are typically implemented as completely separate blocks which operate asynchronously requiring separate data paths and control interfaces.
The limitations and disadvantages of conventional and traditional approaches will become apparent to one of ordinary skill in the art through comparison of such systems with the present disclosure.
The content access device 100 will be described in greater detail in conjunction with
The interface module 120 includes a plurality of interfaces (132, 134, 136, 138, 140 . . . ) that operate in accordance with a corresponding plurality of interface formats. In operation, the interface module 120 is programmable to select at least one of the plurality of interfaces (132, 134, 136, 138, 140 . . . ) to receive a transport stream 110 and also to output a processed transport stream 112. In particular, a single interface (132, 134, 136, 138, 140 . . . ) can be selected to receive the transport stream 110 and output the processed transport stream 112. Alternatively, different interfaces (132, 134, 136, 138, 140 . . . ) can be selected to receive the transport stream 110 and output the processed transport stream 112 and/or different interfaces can be selected to receive a plurality of transport streams 110 and/or output a plurality of processed transport streams 112.
In an embodiment, the transport stream 110 is an audio, video or other media signal such as an over the air broadcast video signal, a satellite video signal, a cable television signal, a streaming video signal sent via the internet or other network, a video signal downloaded via the internet or other network or other media signal.
The interface formats can include a plurality of broadcast video card formats such as a cable card format, a common interface plus format and/or other broadcast video card format. In addition, the plurality of formats can include a plurality of wired computer interface formats such as a universal serial bus (USB) format, an Ethernet format, a small computer system interface (SCSI) format, a Firewire format and/or other wired computer interface format. The plurality of formats can further include least one generic memory card format such as a secure digital (SD) card format, a secure digital input output (SDIO) card format, a CompactFlash card format, a smart media card format, a multimedia card (MMC) format, a memory stick card format and/or other generic memory card format or other interface format for coupling transport stream 110 and processed transport stream 112 to/and from the content access device 100. In addition, interface module 120 optionally includes an interface 132, 134, 136, 138 or 140, such as a smart card interface or other wired or wireless interface for coupling to an external key generator 128 or other external key source for receiving one or more keys for stream decryption, authentication and/or for other processing. Any such keys received via the interface module 120 can be stored in the key storage device 126.
The key storage device 126 stores at least one key. The encryption processing device 124 retrieves the at least one key from the key storage device, and processes a transport stream 110 based on the at least one key to generate a processed transport stream 112. In an embodiment, the encryption processing device 124 generates the processed transport stream 112 from the transport stream 110 based on a digital rights management (DRM) function and/or conditional access system (CAS) function. For example, the encryption processing device can generate the processed transport stream 112 by descrambling or decrypting the transport stream 110, by scrambling or encrypting the transport stream 110, and/or by transcrypting or transscrambling the transport stream 110 from one scrambling or encryption to another scrambling or encryption.
In an embodiment of the present disclosure, the encryption processing device 124 can be implemented using a single processing device or a plurality of processing devices. Such a processing device may be a microprocessor, co-processors, a micro-controller, digital signal processor, microcomputer, central processing unit, field programmable gate array, programmable logic device, state machine, logic circuitry, analog circuitry, digital circuitry, and/or any device that manipulates signals (analog and/or digital) based on operational instructions that are stored in a memory, such as memory device 122.
Memory device 122 may be a single memory device or a plurality of memory devices. Such a memory device can include a hard disk drive or other disk drive, read-only memory, random access memory, volatile memory, non-volatile memory, static memory, dynamic memory, flash memory, cache memory, and/or any device that stores digital information. Note that when the processing module implements one or more of its functions via a state machine, analog circuitry, digital circuitry, and/or logic circuitry, the memory storing the corresponding operational instructions may be embedded within, or external to, the circuitry comprising the state machine, analog circuitry, digital circuitry, and/or logic circuitry. While a particular bus architecture is shown that employs a single bus 130, alternative architectures using direct connectivity between one or more modules and/or additional buses can likewise be implemented in accordance with the present disclosure.
The key storage device 126 can be implemented via a memory device such as a hard disk drive or other disk drive, read-only memory, random access memory, volatile memory, non-volatile memory, static memory, dynamic memory, flash memory, cache memory, and/or any device that stores digital information. In addition, while the key storage device 126 and memory device 122 are shown as separate devices, a single device can be used to implement both devices.
The content access device 100 can be implemented in conjunction with a video encoder, transcoder or decoder that produces the transport stream 110 or that decodes processed transport stream 112. In this fashion, the content access device 100 can embed the encryption or decryption operations within an encoder, transcoder or decoder.
In an example of operation, the content access device 100 is implemented in conjunction with a host device 11-16 that receives a video signal that includes a transport stream that is encrypted or otherwise scrambled. In this fashion, the operation of content access device 100, such as DRM or CAS functionality, can be implemented via a separate module. The interface module 120 is programmed via hardware, software or data generated in response to selection by a user to select one or more particular interfaces (132, 134, 136, 138 or 140, etc.) to receive the transport stream 110 from the host device 11-16 and to send the processed transport stream 112 back to the host device. The encryption processing device 124 decrypts or descrambles the TS 110 into a processed TS 112 such as a compressed video signal in an unencrypted transport stream format. In this example, the host device 11-16 relies solely on the content access device 100 for descrambling or decryption of the transport stream 110.
In another example of operation, the content access device 100 is implemented in conjunction with a host device 11-16 that receives a video signal that includes a transport stream that is encrypted or otherwise scrambled. As in the previous example, the operations of content access device 100, such as DRM or CAS functionality, can be implemented via a separate module. The interface module 100 is programmed via hardware, software or data generated in response to selection by a user to select one or more particular interface to (132, 134, 136, 138 or 140, etc.) to receive the transport stream 110 from the host device and to send the processed transport stream 112 back to the host device. The encryption processing device 124 decrypts or descrambles the TS 110 into a compressed video signal. The encryption processing device 124 then re-encrypts or re-scrambles the unencrypted transport stream into the processed transport stream 112 for transfer to the host device. In this fashion, the content access device 100 can securely descramble or decrypt the transport stream 110 from the scrambling or encryption employed by a content or service provider sending a signal that contains the transport stream 110 to the host device 11-16. The content access device 100 outputs a transport stream 112 that is re-scrambled or re-encrypted for secure transfer to the host device 11-16 and or for transmission, storage or decoding by the host device 11-16 for display. In this example, the host device is only privy to the keys used to re-scramble or re-encrypt the processed transport stream 112 and relies solely on the content access device 100 for descrambling or decryption of the transport stream 110.
In embodiments where the processed transport stream 112 is sent via the same interface from which the transport stream 110 is received, the output interface that sends the processed video signal 112 can operate to save the portions of the packet that are not processed via encryption processing device 124 to simplify the process of generating the packets of transport stream 112. In embodiments where the processed transport stream 112 is sent via a different interface from which the transport stream 110 is received, the output interface that sends the processed video signal 112 operates to generate transport packets in the format associated with the particular output interface that is selected.
Step 406 includes processing the transport stream based on the at least one key to generate the processed transport stream.
In an embodiment, step 406 can include a digital rights management function and/or conditional access system function. Step 406 can include descrambling, decrypting, scrambling, encrypting, transcrypting and/or transscambling the transport stream.
The corresponding plurality of interface formats further include at least one generic memory card format. The at least one generic memory card format can include at least one of: a secure digital card format, a secure digital input output card format, a CompactFlash card format, a smart media card format, a multimedia card format and/or a memory stick card format. The broadcast video card formats can include: a cable card format and/or a common interface plus format. The plurality of wired computer interface formats include at least two of: a universal serial bus format, an Ethernet format, a small computer system interface format, and/or a Firewire format.
The transport stream can be received via a first interface of the plurality of interfaces and the processed transport stream can be output via a second interface of the plurality of interfaces.
As may be used herein, the terms “substantially” and “approximately” provides an industry-accepted tolerance for its corresponding term and/or relativity between items. Such an industry-accepted tolerance ranges from less than one percent to fifty percent and corresponds to, but is not limited to, component values, integrated circuit process variations, temperature variations, rise and fall times, and/or thermal noise. Such relativity between items ranges from a difference of a few percent to magnitude differences. As may also be used herein, the term(s) “configured to”, “operably coupled to”, “coupled to”, and/or “coupling” includes direct coupling between items and/or indirect coupling between items via an intervening item (e.g., an item includes, but is not limited to, a component, an element, a circuit, and/or a module) where, for an example of indirect coupling, the intervening item does not modify the information of a signal but may adjust its current level, voltage level, and/or power level. As may further be used herein, inferred coupling (i.e., where one element is coupled to another element by inference) includes direct and indirect coupling between two items in the same manner as “coupled to”. As may even further be used herein, the term “configured to”, “operable to”, “coupled to”, or “operably coupled to” indicates that an item includes one or more of power connections, input(s), output(s), etc., to perform, when activated, one or more its corresponding functions and may further include inferred coupling to one or more other items. As may still further be used herein, the term “associated with”, includes direct and/or indirect coupling of separate items and/or one item being embedded within another item.
As may also be used herein, the terms “processing module”, “processing circuit”, “processor”, and/or “processing unit” may be a single processing device or a plurality of processing devices. Such a processing device may be a microprocessor, micro-controller, digital signal processor, microcomputer, central processing unit, field programmable gate array, programmable logic device, state machine, logic circuitry, analog circuitry, digital circuitry, and/or any device that manipulates signals (analog and/or digital) based on hard coding of the circuitry and/or operational instructions. The processing module, module, processing circuit, and/or processing unit may be, or further include, memory and/or an integrated memory element, which may be a single memory device, a plurality of memory devices, and/or embedded circuitry of another processing module, module, processing circuit, and/or processing unit. Such a memory device may be a read-only memory, random access memory, volatile memory, non-volatile memory, static memory, dynamic memory, flash memory, cache memory, and/or any device that stores digital information. Note that if the processing module, module, processing circuit, and/or processing unit includes more than one processing device, the processing devices may be centrally located (e.g., directly coupled together via a wired and/or wireless bus structure) or may be distributedly located (e.g., cloud computing via indirect coupling via a local area network and/or a wide area network). Further note that if the processing module, module, processing circuit, and/or processing unit implements one or more of its functions via a state machine, analog circuitry, digital circuitry, and/or logic circuitry, the memory and/or memory element storing the corresponding operational instructions may be embedded within, or external to, the circuitry comprising the state machine, analog circuitry, digital circuitry, and/or logic circuitry. Still further note that, the memory element may store, and the processing module, module, processing circuit, and/or processing unit executes, hard coded and/or operational instructions corresponding to at least some of the steps and/or functions illustrated in one or more of the Figures. Such a memory device or memory element can be included in an article of manufacture.
One or more embodiments have been described above with the aid of method steps illustrating the performance of specified functions and relationships thereof. The boundaries and sequence of these functional building blocks and method steps have been arbitrarily defined herein for convenience of description. Alternate boundaries and sequences can be defined so long as the specified functions and relationships are appropriately performed. Any such alternate boundaries or sequences are thus within the scope and spirit of the claims. Further, the boundaries of these functional building blocks have been arbitrarily defined for convenience of description. Alternate boundaries could be defined as long as the certain significant functions are appropriately performed. Similarly, flow diagram blocks may also have been arbitrarily defined herein to illustrate certain significant functionality.
To the extent used, the flow diagram block boundaries and sequence could have been defined otherwise and still perform the certain significant functionality. Such alternate definitions of both functional building blocks and flow diagram blocks and sequences are thus within the scope and spirit of the claims. One of average skill in the art will also recognize that the functional building blocks, and other illustrative blocks, modules and components herein, can be implemented as illustrated or by discrete components, application specific integrated circuits, processors executing appropriate software and the like or any combination thereof.
In addition, a flow diagram may include a “start” and/or “continue” indication. The “start” and “continue” indications reflect that the steps presented can optionally be incorporated in or otherwise used in conjunction with other routines. In this context, “start” indicates the beginning of the first step presented and may be preceded by other activities not specifically shown. Further, the “continue” indication reflects that the steps presented may be performed multiple times and/or may be succeeded by other activities not specifically shown. Further, while a flow diagram indicates a particular ordering of steps, other orderings are likewise possible provided that the principles of causality are maintained.
The one or more embodiments are used herein to illustrate one or more aspects, one or more features, one or more concepts, and/or one or more examples. A physical embodiment of an apparatus, an article of manufacture, a machine, and/or of a process may include one or more of the aspects, features, concepts, examples, etc. described with reference to one or more of the embodiments discussed herein. Further, from figure to figure, the embodiments may incorporate the same or similarly named functions, steps, modules, etc. that may use the same or different reference numbers and, as such, the functions, steps, modules, etc. may be the same or similar functions, steps, modules, etc. or different ones.
Unless specifically stated to the contra, signals to, from, and/or between elements in a figure of any of the figures presented herein may be analog or digital, continuous time or discrete time, and single-ended or differential. For instance, if a signal path is shown as a single-ended path, it also represents a differential signal path. Similarly, if a signal path is shown as a differential path, it also represents a single-ended signal path. While one or more particular architectures are described herein, other architectures can likewise be implemented that use one or more data buses not expressly shown, direct connectivity between elements, and/or indirect coupling between other elements as recognized by one of average skill in the art.
The term “module” is used in the description of one or more of the embodiments. A module implements one or more functions via a device such as a processor or other processing device or other hardware that may include or operate in association with a memory that stores operational instructions. A module may operate independently and/or in conjunction with software and/or firmware. As also used herein, a module may contain one or more sub-modules, each of which may be one or more modules.
While particular combinations of various functions and features of the one or more embodiments have been expressly described herein, other combinations of these features and functions are likewise possible. The present disclosure is not limited by the particular examples disclosed herein and expressly incorporates these other combinations.
| Number | Date | Country | |
|---|---|---|---|
| 20150271143 A1 | Sep 2015 | US |
| Number | Date | Country | |
|---|---|---|---|
| 61596549 | Feb 2012 | US | |
| 61604228 | Feb 2012 | US |
| Number | Date | Country | |
|---|---|---|---|
| Parent | 13423876 | Mar 2012 | US |
| Child | 14217757 | US |
