Abstract:
Multiple public/private key pairs of varying levels of security are used to provide a high level of security while still allowing fast processing of encrypted information. The lower-security level includes keys which are small in length, which are changed relatively often, and which require less or fewer resources to implement their functions (130), (134). When it is required to change key pairs of low security, a key pair at a higher security level (i.e, longer length keys) than the lower-security level keys is used to transfer the new lower-security public keys to devices using those keys. The higher-security keys can, in turn, be changed at a frequency lower than the lower-security keys. The higher-security keys require a higher level of resources to perform their coding operations (120), (124). This approach of using keys of escalating levels of security to replace lower-security keys, where the higher-security keys require more resources, are more secure, and are replaced less often than the lower-security keys, can be followed as many times as is desired to create a hierarchy of public key uses with the result that the lower-security operations can be performed quickly while the overall system security is high.
Abstract:
A digital rights management architecture for securely delivering content to authorized consumers. The architecture includes a content provider (202) and a consumer system (216) for requesting content from the content provider. The content provider generates a session rights object (202B) having purchase options selected by the consumer. A KDC (204) thereafter provides authorization data to the consumer system. Also, a caching server (215) is provided for comparing the purchase options with the authorization data. The caching server (215) forwards the requested content to the consumer system (216) if the purchase options match the authorization data. Note that the caching (215) server employs real time streaming for securely forwarding the encrypted content, and the requested content is encrypted for forwarding to the consumer system (216). Further, the caching server (215) and the consumer system (216) exchange encrypted control messages (and authenticated) for supporting transfer of the requested content. In this manner, all interfaces between components are protected by encryption and/authenticated.
Abstract:
The present invention uses a secure processor (22) operating with a host processor (210) to perform a unitary decrypt/authenticate operation. The host processor (210) receives encrypted messages (12) that include authentication information. The host processor must submit each message (12) to the secure processor (22). The secure processor (22) then decrypts and authenticates the message. If the authentication operation (24) is not successful, the secure processor (22) does not return the fully-decrypted message back to the host (210). In a preferred embodiment, the host (210) will receive no part of the message upon failure.
Abstract:
PROBLEM TO BE SOLVED: To provide a means for error detection and recovery in the processing of isochronous data in a decoder. SOLUTION: An isochronous data transfer packet is monitored to retrieve an isochronous data presentation time stamp PTSs. In the presentation of the isochronous data from a reception buffer, timing information extracted from the stamp PTSs is used to be synchronized by a decoder 108 with a system time clock STC. When discontinuous error between isochronous data transfer packets is identified and discontinuity of one packet is identified, while keeping the synchronization of the presentation with respect to the STC, a write pointer in a buffer is advanced by a proper number of bits to compensate the discontinuity. As the additional error detection and recovery technology, e.g. PTS extension to ensure an output timing, use of a PTS offset, provision of a couple of PTS pointers, and use of count of packet elementary stream PES are used.
Abstract:
A conditional access subsystem is proved which is to reside with an end-user for receiving, decrypting and decoding all programs distributed by a content provider that the end user is entitled to access so that the decrypted and decoded programs are available for display on one or more display devices without use of a set-top terminal dedicated to each of the display devices. The subsystem includes a receiver for receiving and demodulating a multi-program transport (MPTS) stream distributed by the content provider. The MPTS includes a plurality of packets constituting a plurality of programs using one of N different encryption schemes each associated with one of N service tiers, wherein N is an integer greater than one. Each of the N different encryption schemes has a different encryption/decryption key associated therewith. The packet identifiers for the packets associated with programs in any given one of the service tiers are in a consecutive sequence. A decryptor is provided for decrypting each of the programs associated with each of the N service tiers that the end user is entitled to access. A decoder is also provided for decoding each of the decrypted programs.
Abstract:
According to one embodiment of the invention, a free preview of a program can be provided to client computers in a multicasting system. This can allow viewers in the multicasting system to view a first portion of the program before deciding whether to order the program content. According to another embodiment, various distribution methods can be accomplished using encyrption keys to distribute program content. According to yet another embodiment, an initial viewing period can be provided to allow negotiation of the encryption keys. According to another embodiment, rules and conditions for providing content in a multicasting environment can be utilized.
Abstract:
A system and method for secure delivery and playback of content at a theater complex domain. The domain receives encrypted and compressed content from a studio domain. The theater complex domain comprises at least a projection unit operable to render decompressed digital video content, and a security module removably coupled to the projection unit. The security module includes at least a decompression unit operable to produce decompressed digital video content. The security module further includes a decryption unit coupled to the decompression unit that is operable to produce unencrypted compressed digital video content that is then processed by the decompression unit. The security module further includes a watermark unit coupled to the decompression unit operable to produce the decompressed digital video content rendered by the projection unit that includes a watermark embedded therein. The watermark is used to uniquely identify the projection unit to which the security module is removably coupled, or alternatively, to uniquely identify the security module itself. The security module is physically locked in a tamper resistant container, and is preferably physically locked inside or onto the projection unit to which it is removably coupled. A receiver is coupled to the security module in order to receive the compressed digital video content from the content source or studio domain. The receiver is coupled to the security module, for example, by an internet protocol network. The receiver may receive the compressed digital video content from the studio domain in real-time, or alternatively, a file server may store the compressed digital video content and later provide it to the security module when it is to be rendered. A connection path to the content source may be provided in order to periodically report back to the content source.
Abstract:
According to one embodiment of the invention, a free preview of a program can be provided to client computers in a multicasting system. This can allow viewers in the multicasting system to view a first portion of the program before deciding whether to order the program content. According to another embodiment, various distribution methods can be accomplished using encryption keys to distribute program content. According to yet another embodiment, an initial viewing period can be provided to allow negotiation of the encryption keys. According to another embodiment, rules and conditions for providing content in a multicasting environment can be utilized.
Abstract:
A method for DTCP to HLS conversion is provided that starts with a standard DTCP Protected Content Packet (PCP) structure. The PCP payload data is chunked at defined chunk boundaries. Each chunk is then appended with a pad to be compatible with HLS. An HLS playlist is then provided using the PCP header with identification of the chunks and a keytag. The chunk is encrypted with a DTCP key calculated by the DTCP standard using: (a) copy control bits; (b) a nonce, and (c) an exchange key ID. Relevant PCP header fields are provided in the keytag for the HLS playlist supporting the transaction that enables calculation of the DTCP content key to enable later decryption of the chunks. The system further provides a revised HLS GET for DLNA to enable trick play seek operations to be performed on the converted HLS.
Abstract:
A method of generating a Personal Identification Number (PIN) between a first device and a second device in a network is provided. The method includes securely receiving information of input choices of the second device and random numbers assigned to the input choices at the first device. At the first device, the PIN is generated from the random numbers, and instructions are provided directing an entry of the input choices on the second device. At the second device, the input choices are entered. The second device is operable to generate the PIN from the input choices and the random numbers if the input choices are entered as instructed.