Patent Application
20110206202
1. Field of the Invention
The present invention relates to systems and methods for providing conditional access to media programs, and in particular to a system and method for providing for conditional access entitlement and control information to subscribers in a digital video broadcasting (DVB) environment.
2. Description of the Related Art
For many years, media programs such as television and radio programs have been broadcast to viewers/listeners free of charge. More recently, this free-of-charge dissemination model has been augmented with a fee-for-service and/or fee-for-view model in which paying subscribers are provided access to a greater variety and number of media programs, including video programs, audio programs and the like, by cable, satellite and terrestrial broadcasts.
However, while subscriber-based services are readily available in some areas, they are not available on a world-wide basis. Further, in current media program subscription business models, subscribers are typically offered services from a small number of providers (e.g. DIRECTV or ECHOSTAR, or the approved local cable provider) each of which typically provide a large number of media channels from a variety of sources (e.g. ESPN, HBO, COURT TV, HISTORY CHANNEL). To assure that only subscribers receive the media programs, each service provider typically encrypts the program material and provides equipment necessary for the customer to decrypt them so that they can be viewed.
One of the roadblocks to the evolution of such services is the means by which the service provider assures that only paying customers receive their media programs. Existing conditional access systems were initially developed for small markets and grew to larger markets over a long period of time. This growth has attributed to the success of the pay TV industry but has come at some cost to the conditional access infrastructure. Designs initially conceived in smaller systems do not scale well as the once small system with relatively few subscribers became large with millions of subscribers. As a result, the distribution and renewal of Entitlement Management Information (EMI) (typically, in a message called an Entitlement Management Message (EMM)) that are required to renew their services used for viewing has become inefficient. Further, when sending these renewals, current conditional access systems fail to add a cryptographic component to the renewal process, thus exposing the conditional access system to hacking and compromise.
What is needed is a simple, efficient means to securely distribute EMI. The present invention satisfies these needs.
To address the requirements described above, the present invention discloses a method, apparatus, article of manufacture for providing conditional access to media programs. In one embodiment, the invention is described by a method comprising the steps of transmitting media information encrypted according to a control word (CW) to a receiver station, transmitting entitlement management information (EMI) to the receiver station, the EMI comprising a service bitmap, and transmitting entitlement control information (ECI) to the receiver station, the entitlement control information including the control word (CW) encrypted according to a key (K) and an index to an element of the service bitmap, wherein the control word (CW) is decrypted by the receiver stations according to a value of the indexed element of the service bitmap and/or by processing the entire services bitmap.
In another embodiment, the invention is described by an apparatus for providing conditional access to media programs, the apparatus comprising a first encryptor for encrypting media information according to a control word (CW), a second encryptor for encrypting the control word according to a key (K), processor for generating entitlement management information (EMI), including a service bitmap and for generating entitlement control information (ECI) including the encrypted control word (CW) and an index to an element of the service bitmap, a transmitter for transmitting the entitlement management information (EMI) in a first message and for transmitting the entitlement control information (ECI) in a second message, wherein the control word (CW) is decrypted by the receiver stations according to a value of the indexed element of the service bitmap. The foregoing permits the transmission and reception of media programs while significantly reducing the bandwidth required to distribute renewal messages. Since the number of EMMs required to send EMI to subscribers to is substantially reduced, the present invention permits the transmission of many more messages without increasing throughput or bandwidth requirements, thus allowing subscriber entitlement information to be updated for individual subscribers or small groups of subscribers (via positive addressing, for example). The present invention allows provision of additional security by the addition of a cryptographic component to the EMI renewal process. In one embodiment, the present invention also describes a unique method by which the key that is used to encrypt the media programs is generated instead of being explicitly included as a field in the ECM. The present invention also allows broadcasters to allocate additional broadcast capacity to other revenue-bearing services.
Referring now to the drawings in which like reference numbers represent corresponding parts throughout:
In the following description, reference is made to the accompanying drawings which form a part hereof, and which is shown, by way of illustration, several embodiments of the present invention. It is understood that other embodiments may be utilized and structural changes may be made without departing from the scope of the present invention.
The system 100 also comprises a plurality of subscriber stations 104A, 104B (alternatively referred to hereinafter as subscriber station(s) or receiving station(s) 104), each providing service to one or more subscribers 112A and 112B (alternatively referred to hereinafter as subscribers 112). Each subscriber station 104A, 104B may include a satellite reception antenna 106A, 106B (alternatively referred to hereinafter as satellite reception antenna 106) and/or a terrestrial broadcast antenna 108A, 108B (alternatively referred to hereinafter as terrestrial broadcast antenna 108) communicatively coupled to a receiver 110A, 110B (alternatively referred to hereinafter as receiver(s) 110, set top box(es) (STBs), or integrated receiver/decoder(s) (IRDs)).
The first packet segment 252 comprises information from a first video channel (for a first media program). Packet segment 254 comprises information relevant for a second video channel (for a second media program). Packet segment 256 comprises information from video channel 5 (for yet another media program). Packet segment 258 comprises program guide information such as the information provided by the program guide subsystem. Packet 260 comprises additional first media channel information. Packet 262 includes an entitlement management message (EMM) 262, which carries entitlement management information that is used by the receiving station 104 to determine whether the user is permitted to view or record media programs on one or more of the media channels, as described further below. Packet 266 includes the audio information for the media program transmitted on video channel 1. The data stream includes a packet with an entitlement control message (ECM) 264. The ECM is also used to determine whether the user is permitted to view or record the media programs on the media channels, as described below.
The data stream therefore comprises a series of TDMA packets from a number of data sources. The data stream is modulated and transmitted on a frequency band to the satellite via the antenna 154. The receiving station 104 receives these signals via the antenna 106, and using the system channel identifier (SCID) described below, reassembles the packets to regenerate the program material for each of the channels.
The flags include 4 bits that are used to control other features. The second packet segment 272 is made up of a 4-bit packet type indicator. The packet type identifies the packet by data type (video, audio, ECM, etc.). When combined with the SCID, the packet type determines how the data packet will be used. The next packet segment 274 comprises 127 bytes of payload data, which in the cases of packets 252 is a portion of the video program provided by the video program source. The final packet segment 276 is data required to perform forward error correction.
In one embodiment, the ECM 264 and EMM 262 are provided to a verifier 306 for authentication purposes before further use. Authentication can be accomplished in a number of ways. For example, the ECM 264 may include a hash 322 of the access conditions 318, generated using the same key (K) that is used to encrypt the control word (CW). In this case, the verifier 306 uses the locally stored key (K) 310 to compute a hash of the access conditions 318, and compares the result with the hash 322 value in the ECM 264. If the computed and recited hash compare favorably, the access conditions 318 are verified, and the ECM 264 is authenticated for use. The same technique can be used to verify the encrypted control word EK[CWi] 320 and the access information 328 as well (e.g. by comparison of the hash 330 received in the EMM 262 and a hash computed using the key 310).
Although
In another embodiment, the control word CWi and the access control information 318 can be encrypted according to the key (K) (resulting in EK[CWi+ACI] or EK[CWi] and EK[ACI]). In this case, the access control information ACI is decrypted by the decryptor 314, sent to the access controller 312 where it is compared to the entitlement management information stored in memory 308. If the comparison indicates that the media program should be made available to the subscriber, the access controller instructs the decryptor 314 to decrypt the encrypted control word EK[CWi] to produce the control word CWi, and the control word CWi, is used to decrypt the media program.
The access controller 312 compares the access condition information 318 with the access entitlement information 328 to determine if the subscriber should have access to the media program that was encrypted with the control word CWi. If so, the access controller 312 instructs the decryptor 314 to decrypt the encrypted control word EK[CWi] using key 310 to produce the control word CWi. The STB 110 uses the control word to decrypt the media program.
Existing conditional access systems were initially developed for small markets and grew to larger markets over a long period of time. This growth has attributed to the success of the Pay TV industry but has come at some cost to the conditional access infrastructure. The design initially conceived in the smaller system did not scale well as the once small system with relatively few subscribers became large with millions of subscribers.
As described above, EMMs 262 can be used to extend the service authorization period for paid programming services stored on a subscriber's conditional access module 206. This can be accomplished by pushing the expiration date forward in time or generating new EMMs 262 for each service and sending them to the conditional access module 206. These EMMs 262 can be delivered to the conditional access module 206 using positive addressing. This permits the message to be addressed to a single smart card (unique addressing) or to a group of cards (group addressing).
Group addressing can be used to send an updated or new EMM 262 to the CAMs 206 of subscribers who have subscribed to a particular service. However, group addressing is typically less effective since the group size is usually too small compared to the large number of subscribers that are subscribed to many services. Small groups also become less effective because the CAMs 206 of the subscribers in the group may no longer be used due to the CAM 206 failure or the subscriber 112 ending their service.
Unique addressing (sending renewal EMMs 262 by individual service separately to each CAM 206) is also extremely inefficient. For example, if a broadcaster had 20 million smart cards in the field and each card had 30 services, the broadcaster would be required to send 600 million EMMs 262 to renew the services for all CAMs 206 and services on the CAMs 206. This is extremely expensive in terms of bandwidth that could be used for other purposes including offering additional pay services.
With large subscriber populations, a significantly more efficient method of distributing service data and renewals is desired, particularly when using positive addressing to distribute information to a group of subscribers 112. As described below, this can be accomplished by transmitting a service bitmap for the services stored on a CAM 206.
In one embodiment, each service offered by a broadcaster is represented by a single element in an array of single-bit elements, known as a service bitmap. The ECM 264 contains a service authorization index or program ID indicating which service must be present on the CAM 206 for the CAM 206 to be able to generate the control word CWi and thereby decrypt the media program (M). The CAM 206 maps the service or program ID into a specific element or bit position in the array or bitmap using the index. If the value of the array element is a “1”, the CAM 206 can attempt to generate the control word. If the value of the array element is a “0” then the smart card will not attempt to generate the control word CWi.
In another embodiment, each of the elements in the array of elements that together comprise the service bitmap 400 can represent a subscriber and the value of a bit associated with that element indicates whether that subscriber is authorized to receive (subscribe to) a particular media service. For example, if there are 20 million subscribers to a general broadcast service, but only 5 million subscribers to a particular media service (e.g. a particular channel or pay-per-view event), the EMM 262 authorizing that media service would comprise an array of elements, each having a value of a “1” (indicating that the subscriber is authorized to receive the service), or a “0” (indicating that the subscriber is not authorized to receive the service). Using service map, the broadcaster can send group based EMMs authorizing a specific service ID which would be addressed to specific groups of cards instead of an individual card. Card groups can be identified based on a subset of their card ID. For example, if the card ID is a 4 byte alphanumeric, the card group could consist of all cards that share the high order three bytes of the 4 byte Card ID.
A service bitmap 400 may be generated for each CAM 206. The number of EMMs 262 generated in our example above is 20 million instead of 600 million as in the case of generating an EMM 262 for every subscriber's CAM 206 and every service. As described below, a signature can be added over the bitmap 400 for additional security. The access controller 312 can also check the expiration date of the service bitmap 400, if one is provided. In this embodiment, the signature and the revised expiration date is transmitted to the CAM 206 along with the service bitmap. This significant reduction in the number of EMMs 262 (in terms of the number of EMM 262 messages sent and in total number of bytes transmitted) allows the renewal period to be shorter, which allows tighter control over the maintenance of the services (including updating and canceling such services).
The use of a service bitmap also allows the use of negative addressing to remove services associated with bits that may have been set by an attacker. It also saves a significant amount of memory space within the CAM 206 compared to previously deployed systems, because each service requires only one bit as opposed to several bytes with an associated expiration date. While existing CAM 206 can store data for only about 100 services, the storage efficiency provided by the bitmap allows thousands of services to be stored on a single CAM 206. The service bitmap also enables proposed a-la-carte services to be supported by the CAM 206.
The ECM 264 includes access control information (ECI) 318 for the media programs or services. In one embodiment, the ECI 318 includes an index 401 to an element 408 of the service bitmap 400. The index 401 indicates where the entitlement management information 328 related to the applicable media program or service may be found in the service bitmap 400. That is, which element 408 of the service bitmap 400 holds the value indicating the subscriber's entitlement to view the associated media program or service.
For example, in one embodiment, an index 401 value of “34” or “4D” accompanying or associated with the media program indicates that the logical value of the 34th element of the service bitmap 400 (or 4th column and row D) is to be used to determine if the subscriber is entitled to view the program or service that was encrypted by the (encrypted) control word E[CWi] 320 transmitted in the ECM 264. In the example shown in
In the foregoing example, the service bitmap 400 provided a direct mapping to entitlements (e.g. a “1” indicated that the subscriber was entitled to receive the service). Other, ostensibly more secure embodiments are possible. For example, the service bitmap may be hashed according to the key 310 before transmission, and the hashed service bitmap used to determine whether the subscriber is entitled to receive the media program or service, or hashed again to recover the service bitmap 400. A logical exclusive OR (XOR) of the service bitmap element values and elements of an identically dimensioned array may also be used to determine whether the user is entitled to receive the service or program.
The service bitmap 400 may also be digitally signed before transmission to the STB 110 to assure that it has not been compromised. This can be accomplished by hashing (e.g. computing a digest of) the service bitmap 400, signing the message by using the key (K) 310 or a private key to encrypt the digest, and sending the resulting signature 402 along with the service bitmap 400. The key (K) 310 or the public key of the sender can be used to decrypt the data and validate the signature, thus providing the digest. This is compared to the locally computed digest of the message, and if they match, allowing the service bitmap 400 to be used. The signature and the message can also together be encrypted before sending to the receiver station 104 and then decrypted, to secure not only the integrity of the service bitmap, but its privacy as well. These operations can be performed by the verifier(s) 306 shown in
The EMM 262 may also include an expiration date 403 indicating a date (and optionally, a time) after which the service bitmap 400 is no longer in force. The expiration date 403 may also be signed to assure it is not tampered with before it is received in the CAM 206. Although
The use of a bitmap 400 to transmit entitlement information also ameliorates CAM 206 storage requirements associated with blackouts. The CAM 206 may have a separate set of service bitmaps 400 that are used in determining whether the subscriber in possession of the CAM 206 resides in a broadcast area that is authorized to view a particular service.
As described above, the encrypted control word EK[CWi] 320 is transmitted to the receiving station 104 in an 8 byte portion of the ECM 264. Most systems encrypt the CWi using some form of global key (K), as described in
To make the process of deciphering the CWi significantly more secure, one embodiment of the present invention generates the encrypted control word to include the access information 318 (e.g. E[CVi+AC]). This pairs the control word and the access conditions 318, making each more difficult to tamper with. Alternatively, the entire ECM 264 may be encrypted and incorporated into the CW generation, forcing the receiver to process and decrypt data from the entire ECM 264. This has at least two benefits. First, the ECM 264 cannot be modified or it will certainly generate the wrong CWi. Second, the entire ECM 264 must be accepted (and processed), rather than getting or generating a global transmission key from only one 8 byte field to produce the control word CWi. Requiring the CAM 206 to process the entire ECM 264 may result in positive and/or negative actions that could affect an unauthorized CAM 206, thus improving the security of the conditional access system.
The service bitmap 400 may be related to the key (K) 310, to prevent the service bitmap and index 401 from being tampered with. This can be implemented by generating the key (K) 310 at least in part from the service bitmap 400 or generating the service bitmap 400 at least in part from the key (K).
The ECM 264 and EMM 262 are typically sent in different data packets of the same data stream that is used to transmit the encrypted program material ECW[M] to the receiving station 104, but this need not be the case. The EMM 262 is also typically transmitted to the receiving station 104 much less frequently than the ECM 264.
The receiving station 104 provides the EMM 262 a non-volatile memory (NVM) 507 where the EMI may be temporarily stored for later use. The information in the EMM 262 is then provided to an information processor 509, which provides subscriber or subscriber group-unique information (e.g. which programs the subscriber has subscribed to) such as the service bitmap 400 to the access controller 312 and general services information (such as the key (K)) to a hashing processor 508.
The access controller 312 hashes the EMI when the STB 110 passes the ECM 264 to the CAM 206. This hash can be incorporated in CW generation to include a real time component in the calculation. The ECMs 264 are received in real time by the receiving station 104. Data fields are extracted from the ECM 264 and passed to the Information Processor 104. The information processor 509 uses the ECM data (which can include the Service ID, access conditions, and/or the date and time) to provide a real time input to the control word (CW) generation process. This can be used to prevent pre-calculation of CWS in the event that keys delivered in the EMM 262 have been compromised.
The access controller 312 (after verifying the service bitmap 400, if desired, using the optional signature 402) looks up the value of the service bitmap 400 corresponding to the index 401, and from this value as well as the expiration date 403, determines whether to enable the first decryptor 510 to decrypt the encrypted control word EK[CWi] in the ECM 264 to recover the control word CWi.
The hashing processor 508 hashes the general service information (including the key (K) 310) to recover the key (K), and provides the key to the first decryptor 510, thus providing the first encryptor with the information required to decrypt the encrypted control word Ek[CWi] to recover the control word CWi. The control word CWi is provided to decrypt the encrypted media program ECW[M], which produces the media program M.
In the foregoing embodiment, the access controller 312 provided a command to the first decryptor 510 to control recovery of the control word CWi, however, the access controller 312 may provide a command to the second decryptor 512 or both decryptors 510, 512 to control the recovery of the media program M from the encrypted media program.
Note that in the foregoing embodiment, if the service bitmap 400 has been altered (e.g. by a hacker in order to gain access to a particular service or media program), the proper key (K) will not be recovered by the hashing process 508, and the media program M will not be properly decrypted. Thus, the foregoing embodiment discourages modification of the service bitmap 400.
The service bitmap 400 and the key (K2′) 602 (and optionally, the signature 402 and expiration date 403) are transmitted to the receiving station 104 as an EMM 262.
The general service information is hashed by a hashing processor 502, and combined with the second key (K2) 603 via combiner 604 to produce the control word CWi. In the illustrated embodiment, the combination processor 604 implements an logical “exclusive or” (XOR) of the hashed version of the service bitmap 400, signature 402, and expiration date 403 and the second key (K2) to produce the control word CWi.
Encryptor 606 encrypts the media program (M) using the control word CWi to produce the encrypted version of the media program ECW[M]. The headend 102 transmits the encrypted media program ECW[M] to the receiving station 104, along with the index 401 and optional other information.
The EMM 262 is received by the receiving station 104 and temporarily stored in NVM 507. The EMI and key (K2′) is provided to information processor (IP) 509, which generates the second key (K2) from key (K2′), using a complementary operation to that which was performed by the key generator 605 to generate the key (K2′) from the second key (K2). The IP 509 also separates the general service information (K) and the customer or customer group unique information (e.g. service bitmap 400 and optional signature 402 and expiration date 403).
When the subscriber tunes to a channel (selects a channel), an ECM is received by the receiving station 104. The ECM along with the embedded service ID containing the Index 401 is passed to the access controller 312. The unique information related to the Index 401 extracted from the ECM is provided to the access controller 312 from the Info Processor 509. As described above with respect to
The control word CWi required to decrypt the encrypted media program ECW[M] obtained by hashing the key (K), and combining the result with the second key (K2) 602, using a second combiner 608. The second combiner 608 is complimentary to that of the first combiner 604 so that when the second combiner operates on an output of the first combiner 604, the input of the first combiner 604 is recovered. For example, in the illustrated embodiment, the first combiner 604 and second combiner 608 are logical circuits which implement a logical “exclusive OR” (XOR) operation. The result of the combining operation is the control word CWi, which, when provided to the decryptor 610, permits decryption of the encrypted media program ECW[M] to produce the media program (M).
The general service information (K) is optionally hashed by hashing processor 502 to produce a hashed key (K′). The hashed result (K′) is combined with the second key (K2) 603 via combiner 604 to produce an intermediate key (Ki) that is used to encrypt the control word CWi that is used to encrypt the media program (M).
The index 401 and optional other information is added to the encrypted control word EK
The receiving station 104 receives the EMM 262, ECM 264, and the encrypted media program ECW[M]. The EMM 262 is provided to a non-volatile memory 507 for temporary storage. Upon receipt of the ECM containing the Index 401 from the channel being viewed by the subscriber, the related EMI data is passed to the information processor 509. Using processes complementary to those employed in the key generator 605. The information processor 509 processes the EMI to generate the general service information (K), second key (K2), and the customer unique service information.
The customer unique service information (service bitmap 400 and optional signature 402 and expiration date 403) is provided to the access controller 312, the key (K) is provided to an optional hashing processor 508, and the second key (K2) is provided to combiner 608.
The hashing processor 508 hashes the key (K), and provides the result to combiner 608. The combiner 608 combines the optionally hashed key (K) and the second key (K2) to regenerate the intermediate key (KI) that was used to generate the encrypted control word EK
The access controller 312 receives the index 401 from the ECM 264, and the customer unique service information. Using the value of the service bitmap 400 corresponding to the index 401, the access controller 312 determines whether the media program should be presented to the subscriber 112, and according to this determination, controls either one or both of the first and the second decryptors 618 and 610 in order to enable or disable the decryption of the media program (M).
The control value CV1 is combined with the control word CWi to produce a second control value CV2 using combiner 612. The index 401 and other optional information is added to the result and transmitted to the receiving station 104 in the form of the ECM 264. To further increase security, the result can be encoded by encoding processor 616 before being transmitted to the receiver station 104. The media program (M) is encrypted according to the control word CWi by encryptor 606. The result is also transmitted to the receiving station 104.
The receiving station 104 receives the EMM 262 and stores the EMI in NVM 507. Upon receipt of the ECM containing the Index 401 from the channel being viewed by the subscriber, the related EMI data is passed to an information processor 509 which performs operations complementary to that of the key generator 605 to recover the customer unique information (e.g. the service bitmap 400 and optional signature 402 and expiration date 403), the general service information (K), and the second key (K2′). The customer unique information is provided to the access controller 312, key (K) to hashing processor 508, and the second key (K2) to combiner 608. The key (K) is hashed by the hashing processor and combined with the second key (K2) to reproduce the control value CV1. In the illustrated embodiment, the combiner 608 is implemented by a logical XOR circuit or processor. The resulting control value CV1 is used to regenerate the control word CWi.
The receiving station 104 also hashes the ECM 264 with decoding processor 618 (if it was encoded by the broadcaster 102 before transmission to the receiving station 104) to regenerate the second control value CV2. The second control value CV2 and the first control value CV1 are provided to the combiner 614, which implements a function complimentary to that which was performed by combiner 612 in the headend to regenerate the control word CWi. In the illustrated embodiment, both combiner 612 and 614 implement XOR functions. The control word CWi is provided to decryptor 610, which decrypts the encrypted media program ECW[M].
The receiving station 104 also provides the service bitmap 400 (and optionally, the signature and expiration date 403) to the access controller 312. After optionally verifying the service bitmap 400 using the signature 402, the access controller uses the value of the service bitmap identified by the index 401 received from the ECM 264 (and optionally, the expiration date 403) to determine whether the subscriber 112 should be permitted to view the media program (M). If the subscriber 112 is permitted to do so, the access controller 312 transmits command to instruct the decryptor 610 to decrypt the encrypted media program ECW[M]. If the access controller 312 determines that the subscriber 112 is not permitted to access the program, the command is either not transmitted, or a command to prevent the decryptor 610 from decrypting the encrypted media program ECW[M] is transmitted.
The control word CWi is encrypted by encryptor 622 using the third key (K3) to produce the encrypted control word EK3[CWi]. The resulting encrypted control word EK3[CWi] is combined with the second control value CV2, the index 401, and other optional information, and the result is optionally encoded by encoding processor 616 and transmitted to the receiving station 104 as the ECM 264. In one embodiment, the second control value CV2, the encrypted control word Ek3[CWi], the index 401 and the other information are combined by concatenation before being hashed.
The control word CWi is then used to encrypt the media program (M) using second encryptor 606. The encrypted media program ECW[M] is transmitted to the receiver station 104.
The receiver station 104 receives the EMM 262, and temporarily stores the EMI in NVM 507. Upon receipt of the ECM and using processes complementary to those used by the key generator 605, the information processor 509 recovers the subscriber unique information (the service bitmap 400 and optional signature 402 and expiration date 403), key (K) and second key (K2). The subscriber unique information is provided to the access controller 312, the key (K) is provided to hashing processor 508, and the second key (K2) is provided to combiner 608.
The hashing processor 508 hashes the key (K), and the result is combined with the second key (K2) by combiner 608 to reproduce the first control variable CV1.
The receiving station 104 receives the ECM 264, and uses decoding processor 618 to recover the index 401, encrypted control word EK3[CWi] and other information. The index 401 is provided to the access controller 312, the second control value CV2 is provided to a second combiner 614, and the encrypted control word EK3[CWi] is provided to decryptor 620.
The receiving station 104 recovers the third key (K3) by combining the first control value CV1 and the second control value CV2 with combiner 614, and provides the recovered third key (K3) to decryptor 620. The decryptor 620 decrypts the encrypted control word EK3[CWi] to recover the control word CWi, which is provided to second decryptor 610. The second decryptor then decrypts the encrypted media program ECW[M] to produce the media program (M).
The access controller 312 controls the operation of the first decryptor 620 and/or the second decryptor 610 so that the media program (M) is only decrypted when indicated by the indexed value of the service bitmap 400 and optionally, the expiration date 403.
Each of the embodiments illustrated in
The broadcasters segment 701 includes a broadcast headend 516 that is communicatively coupled to a program guide module 704, a broadcast security server 706, and a subscriber administration module 708 to control subscriber 112 access to the media programs 722.
The subscriber administration module (SAM) 708 generates the service bitmap 400 as described above, and provides it to the broadcast headend 516 for assembly into the broadcast data stream transmitted to the receiver station 104. The SAM 708 also controls the rate at which EMMs 262 are inserted into the broadcast stream. The SAM 708 also adds, deletes, and modifies authorized programming for the subscriber 112, controls the subscriptions, and handles service renewal requests. Subscriptions include pay-per-view events such as order ahead pay-per-view (OPPV) and impulse pay-per-view (IPPV) events. Unlike OPPV events, IPPV events do not require transmission of individual authorization messages.
The broadcast security server (BSS) 706 generates the ECM 264, and performs the hashing, combining, and/or encrypting operations required to generate both the EMM 262 and the ECM 264.
The broadcaster segment transmits EMM 262 and ECM 264 messages to the receiver segment 703 to the STB application 718 and media kernel 720, where processing is performed to determine which services should be provided to the subscriber.
The receiver segment 703 includes a receiver station 104 having an STB 110. The STB 110 includes a transport module 202, which handles the flow of the received broadcast data stream within the STB 110. The transport module 202 also includes an STB application 718 interfacing with a conditional access module 206 via a media kernel 720 and a security module 204. In one embodiment, the conditional access module 206 is a smart card having a security chip that can be removably inserted into the STB 110.
As described above with respect to
Users subscribe to the media service by providing STB identifying information to the conditional access system 700. This can be accomplished via a computer 716 at the receiver station. In one embodiment, the user uses an Internet browser executing on the computer 716 to enter STB 110 identifying information. The information is transmitted to the broadcaster 102 via the Internet 712. This can also be accomplished by calling a broadcaster customer service representative, or by any other means known in the art. Web-based authorization is the preferred method of accepting service requests because it requires little or no human intervention between the transaction server 710 and the subscriber 112. The subscriber 112 can subscribe to a wide variety of services, including ordinary subscription services, pay-per-view (PPV) media programs, select any order ahead pay-per-view (OPPV) media programs, and impulse pay-per-view (IPPV) media programs. Billing for those services can be accomplished via a third party 714 such as PAYPAL or a credit card agency. The subscriber 112 can also pre-authorize a credit that can be sent to the conditional access module 206. The subscriber 112 can repeat this process for each media program or group of media programs that they would like to receive.
The conditional access transaction server 710 accepts this information and initiates activation of the service by providing the information to the subscriber administration module 708. An activation component controls the activation of the conditional access module 206/STB 110 pairs, and keeps track of such pairings to assure integrity.
In one embodiment, the present invention also allows efficient distribution of EMMs 262 to deployed CAMs 206 (already provided to subscribers 112 and installed into STBs 110). This is accomplished by defining “virtual groups” of CAMs 206 that should receive the EMMs 262. Data defining virtual groups can be pre-loaded into the CAMs 206 provided to new subscribers 112, or can be loaded into the CAM 206 by a data packet in a manner similar to that which is used to transmit EMMs 262 to the CAM 206. Once the group data is stored in the CAM 206, it can be sent to the media kernel 720. Upon power up (or insertion of the CAM 206 into the STB 110), the group identifier and the CAM 206 identifier are passed from the CAM 206 to the media kernel 720 and the media kernel 720 uses that information to determine whether an EMM 262 transmitted in the program stream should be provided to the CAM 206. The EMM's header 324 can be used to identify the EMM 262 so that the media kernel 720 can identify the EMM 262 as a “group” EMM 262 that should be provided to the CAM 206. Virtual groups can therefore be used to efficiently distribute group EMMs, thus saving bandwidth within the broadcast infrastructure because individually addressed EMMS are not required. Broadcasting to legacy groups become less effective as the card population ages and legacy groups be come more sparse. Legacy groups become sparse because subscribers chum out and cards fail or become damaged. Since the broadcaster 102 has knowledge of which CAMs 206 belong to which groups, the broadcaster 102 can optimally define the virtual groups to minimize transmission and memory requirements.
Generally, the computer 802 operates under control of an operating system 808 stored in the memory 806, and interfaces with the user to accept inputs and commands and to present results through a graphical user interface (GUI) module 818A. Although the GUI module 818A is depicted as a separate module, the instructions performing the GUI functions can be resident or distributed in the operating system 808, the computer program 810, or implemented with special purpose memory and processors. The computer 802 also implements a compiler 812 which allows an application program 810 written in a programming language such as COBOL, C++, FORTRAN, or other language to be translated into processor 804 readable code. After completion, the application 810 accesses and manipulates data stored in the memory 806 of the computer 802 using the relationships and logic that was generated using the compiler 812. The computer 802 also optionally comprises an external communication device such as a modem, satellite link, Ethernet card, or other device for communicating with other computers.
In one embodiment, instructions implementing the operating system 808, the computer program 810, and the compiler 812 are tangibly embodied in a computer-readable medium, e.g., data storage device 820, which could include one or more fixed or removable data storage devices, such as a zip drive, floppy disc drive 824, hard drive, CD-ROM drive, tape drive, etc. Further, the operating system 808 and the computer program 810 are comprised of instructions which, when read and executed by the computer 802, causes the computer 802 to perform the steps necessary to implement and/or use the present invention. Computer program 810 and/or operating instructions may also be tangibly embodied in memory 806 and/or data communications devices 830, thereby making a computer program product or article of manufacture according to the invention. As such, the terms “article of manufacture,” “program storage device” and “computer program product” as used herein are intended to encompass a computer program accessible from any computer readable device or media.
Those skilled in the art will recognize many modifications may be made to this configuration without departing from the scope of the present invention. For example, those skilled in the art will recognize that any combination of the above components, or any number of different components, peripherals, and other devices, may be used with the present invention.
This concludes the description of the preferred embodiments of the present invention. The foregoing description of the preferred embodiment of the invention has been presented for the purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise form disclosed. Many modifications and variations are possible in light of the above teaching. It is intended that the scope of the invention be limited not by this detailed description, but rather by the claims appended hereto. The above specification, examples and data provide a complete description of the manufacture and use of the composition of the invention. Since many embodiments of the invention can be made without departing from the spirit and scope of the invention, the invention resides in the claims hereinafter appended.
This application is related to U.S. Patent Application US2005/037197, entitled METHOD AND APPARATUS FOR SUPPORTING MULTIPLE BROADCASTERS INDEPENDENTLY USING A SINGLE CONDITIONAL ACCESS SYSTEM,” by Ronald P. Cocchi, Gregory J. Gagnon, and Dennis R. Flaharty, and filed Oct. 18, 2005, which claims benefit of U.S. Provisional Patent Application No. 60/619,663, entitled “METHOD OF SUPPORTING MULTIPLE BROADCASTERS INDEPENDENTLY USING A SINGLE CONDITIONAL ACCESS SYSTEM,” by Ronald P. Cocchi, Gregory J. Gagnon, and Dennis R. Flaharty, filed Oct. 18, 2004, which application is hereby incorporated by reference herein.
| Number | Date | Country | |
|---|---|---|---|
| Parent | 11441888 | May 2006 | US |
| Child | 13100565 | US |
