Control of enhanced application features via a conditional access system

A service provider provides conditional access to data that is decrypted by authorized set-top boxes (DHCTs). The encrypted programs include encrypted enhanced programs by adding a field to entitlement management messages and corresponding entitlement control messages.

CROSS-REFERENCE TO RELATED PATENT APPLICATIONS

The present application is related to U.S. Pat. No. 6,424,714, Wasilewski, et al., which was filed on Aug. 18, 1998 entitled “Conditional Access System,” the disclosure and teachings of which are incorporated by reference in its entirety.

FIELD OF THE INVENTION

The invention concerns systems for protecting information and more particularly concerns systems for protecting information that is transmitted by means of a wired or wireless medium against unauthorized access.

BACKGROUND OF THE INVENTION

One way of distributing information is to broadcast it, that is, to place the information on a medium from which it can be received by any device that is connected to the medium. Television and radio are well-known broadcast media. If one wishes to make money by distributing information on a broadcast medium, there are a couple of alternatives. A first is to find sponsors to pay for broadcasting the information. A second is to permit access to the broadcast information only to those who have paid for it. This is generally done by broadcasting the information in scrambled or encrypted form. Although any device that is connected to the medium can receive the scrambled or encrypted information, only the devices of those users who have paid to have access to the information are able to unscramble or decrypt the information.

A service distribution organization, for example a communications system or a satellite television company, provides its subscribers with information from a number of program sources. For example, the History Channel is a program source that provides television programs about history. Each program provided by the History Channel is an “instance” of that program source. When the service distribution organization broadcasts an instance of the program source, it encrypts or scrambles the instance to form an encrypted instance. An encrypted instance contains instance data, which is the encrypted information making up the program.

An encrypted instance is broadcast over a transmission medium. The transmission medium may be wireless or it may be “wired”, that is, provided via a wire, a coaxial cable, or a fiber optic cable. It is received in a large number of set-top boxes. The function of the set-top box is to determine whether an encrypted instance should be decrypted and, if so, to decrypt it to produce a decrypted instance comprising the information making up the program. This information is the delivered to a television set.

Subscribers generally purchase services by the month (though a service may be a one-time event), and after a subscriber has purchased a service, the service distribution organization sends the set-top box belonging to the subscriber messages required to provide the authorization information for the purchased services. Authorization information may be sent with the instance data or may be sent via a separate channel, for example, via an out-of-band RF link, to a set-top box. Various techniques have been employed to encrypt the authorization information. Authorization information may include a key for a service of the service distribution organization and an indication of what programs in the service the subscriber is entitled to watch. If the authorization information indicates that the subscriber is entitled to watch the program of an encrypted instance, the set-top box decrypts the encrypted instance. It will be appreciated that “encryption” and “scrambling” are similar processes and that “decryption” and “descrambling” are similar processes; a difference is that scrambling and descrambling are generally analog in nature, while encryption and description processes are usually digital.

The access restrictions are required in both analog and digital systems. In all systems, the continued technological improvements being used to overcome the access restrictions require more secure and flexible access restrictions. As more systems switch from an analog format to a digital format, or a hybrid system containing both analog and digital formats, flexible access restrictions will be required.

Restricting access to broadcast information is just as important for digital information, such as inserted advertising or enhanced applications and/or programs. For example, one approach is to insert advertising material as an overlay of a movie channel or a subscription channel. Without appropriate safeguards, some services may do this without the permission of the network operator or the owner of the instance. This use of both network bandwidth and instance content is undesirable from the viewpoint of the operators and the content owners. Thus, what is needed is a way to provide secure control of such “enhanced services.”

DETAILED DESCRIPTION OF A PREFERRED EMBODIMENT

The present invention is directed towards a method and apparatus for delivering enhanced services by cryptographically protecting the attributes of the services. The following Detailed Description will first provide a general introduction to a conditional access system and to encryption and decryption. Next, the Detailed Description will describe how the conditional access system can be used to dynamically add and remove access to enhanced services, such as applications, inserted advertising, or other enhanced services above the standard services offered the consumer, and the role of encryption and authentication in these operations.

Conditional Access System Overview

FIG. 1provides an overview of a system101for limiting access to broadcast information. Such systems will be termed herein as a “conditional access system.” A service provider103, for example, a communications company or a satellite television company, provides its subscribers with information from a number of services that are a collection of certain kinds of information. For example, the History Channel is a service that provides television programs about history. Each program provided by the History Channel is an “instance” of that service. When the service distributor broadcasts an instance of the service, it encrypts the instance to form an encrypted instance105. The encrypted instance105contains instance data109, which is the encrypted information making up the program and entitlement control messages (ECM)107. The entitlement control messages contain information needed to decrypt the encrypted portion of the associated instance data109. A given entitlement control message is sent many times per second, so that it is immediately available to any new viewer or a service. In order to make decryption of instance data109even more difficult for pirates, the content of the entitlement control message is changed every few seconds, or more frequently.

Encrypted instance105is broadcast over a transmission medium112. The medium may be wireless or it may be “wired,” that is, provided via a wire, a coaxial cable, or a fiber optic cable. It is received in a large number of set-top boxes113(0. . . n), each of which is attached to a television set. It is a function of set-top box113, referred to as a DHCT hereinafter, to determine whether the encrypted instance105should be decrypted and if so, to decrypt it to produce decrypted instance123, which is typically delivered to the television set or to a digital recorder either internal or external to the DHCT113. As shown in detail with regard to DHCT113(0), DHCT113includes a decryptor115, which uses a control word117as a key to decrypt the encrypted instance105. The control word117is produced by a control word extractor119from information contained in the entitlement control message107and information from authorization information121stored in DHCT113. For example, authorization information121may include a key for the service and an indication of what programs in the service the subscriber is entitled to watch. If the authorization information121indicates that the subscriber is entitled to watch the program of the encrypted instance105, the control word extractor119uses the key together with information from ECM107to generate the control word117. Of course, a new control word is generated for each new ECM107.

The authorization information used in a particular DHCT113(i) is obtained from one or more entitlement management messages111addressed to DHCT113(i). Subscribers generally purchase services by the month (though a service may be a one-time event), and after a subscriber has purchased a service, the service distributor103sends the DHCT113(i) belonging to the subscriber entitlement management messages (EMMs)111as required to provide the authorization information121required for the purchased services. EMMs may be sent interleaved with instance data109in the same fashion as ECMs107, or they may be sent via a separate channel, for example via an out-of-band RF link, to DHCT113(i), which stores the information from the entitlement management message (EMM)111in authorization information121. Of course, various techniques have been employed to encrypt entitlement management messages111.

The encryption and decryption techniques used for service instance encoding and decoding belong to two general classes: symmetrical key techniques and public key techniques. A symmetrical key encryption system is one in which each of the entities wishing to communicate has a copy of a key; the sending entity encrypts the message using its copy of the key and the receiving entity decrypts the message using its copy of the key. An example symmetrical key encryption-decryption system is the Digital Encryption Standard (DES) system. A public key encryption system is one in which each of the entities wishing to communicate has its own public key-private key pair. A message encrypted with the public key can only be decrypted with the private key and vice-versa. Thus, as long as a given entity keeps its private key secret, it can provide its public key to any other entity that wishes to communicate with it. The other entity simply encrypts the message it wishes to send to the given entity with the given entity's public key and the given entity uses its private key to decrypt the message. Where entities are exchanging messages using public key encryption, each entity must have the other's public key. The private key can also be used in digital signature operations, to provide authentication.

As an overview, the encryption system uses symmetrical key encryption techniques to encrypt and decrypt the service instance and public key encryption techniques to transport a copy of one of the keys used in the symmetrical key techniques of the key from the service provider to the DHCT113. InFIG. 2A, clear services such as the elementary digital bit streams that comprise MPEG programs are sent through a 1stlevel encryption called the program encrypt function201, which is preferably a symmetric cipher such as the well-known DES algorithm. Each elementary stream may be individually encrypted and the resulting encrypted streams are sent to multiplexer200to be combined with other elementary streams and private data, such as conditional access data. The key used in the program encrypt function201is called the control word (CW)202. The CW202is generated by control word generator203, which can be either a physically random number generator or can use a sequential counter with a suitable randomization algorithm to produce a stream of random CWs. A new CW is generated frequently, perhaps once every few seconds and is applied to each elementary stream on the same time scale. Each new CW is encrypted by Control Word Encrypt & Message Authenticate function204using a Multi-Session key (MSK)208provided by Multi-Session Key generator205. The CW is then combined into an ECM107with other service-related information. The ECM107is authenticated by Control Word Encrypt & Message Authenticate function204, which produces a message authentication code using a keyed-hash value derived from the message content combined with a secret that can be shared with the receiving DHCT113. This secret is preferably part or all of the MSK208. The message authentication code is appended to the rest of the ECM107. The CW202is always encrypted before being sent along with the other parts of the ECM to MUX200. This encryption is preferably a symmetric cipher such as the Triple-DES algorithm using two distinct 56-bit keys (which taken together comprise MSK208).

InFIG. 2B, the corresponding DHCT private key and associated DHCT public secure micro serial number are stored in memory232of decoder240. Public secure micro serial number is provided so that demultiplexer230can select an encrypted multi-session key addressed to decoder240from transport data stream (TDS). Encrypted multi-session key EKpr(MSK) is decrypted in decryptor234using DHCT private key from memory232to provide multi-session key MSK. Demultiplexer230also selects from transport data stream TDS encrypted control word (CW) EMSK(CW). The encrypted CW is processed in decryptor236using multi-session key MSK as the decryption key to provide the unencrypted CW. The unencrypted CW preferably changes at a high rate, for example, once every few seconds. Demultiplexer230also selects from transport data stream TDS encrypted service ECW(SERVICE). The encrypted service is processed in decryptor238using the CW as the decryption key to recover the unencrypted service.

FIG. 3is a schematic representation of an MPEG-2 transport stream301. An MPEG-2 transport stream is made up of a sequence of 188-byte long transport packets303. The packets303in the stream carry information that, when combined at a DHCT113, defines an instance of a service and the access rights of a given DHCT113to the service. There are two broad categories of information: program309, which is the information needed to produce the actual pictures and sound; and program specific information (PSI)311, which is information concerning matters such as how the transport stream is to be sent across the network, how the program309is packetized, and what data is used to limit access to the program309. Each of these broad categories has a number of subcategories. For example, program309may include video information and several channels of audio information.

Each transport packet303has a packet identifier, or PID, and all of the packets303that are carrying information for a given subcategory will have the same PID. Thus, inFIG. 3, the packets carrying Video1all have PID (a), and the packets belonging to that subcategory are identified by305(a). Similarly, the packets carrying Audio1all have PID (b), and the packets belonging to that category are identified by305(b). A subcategory of information can thus be identified by the PID of its packets. As shown at output packets307, the output from multiplexer304is a sequence of contiguous individual packets from the various subcategories. Any part or all of MPEG-2 transport stream301may be encrypted, except that PSI packets, packet headers and adaptation fields are never encrypted. In the preferred embodiment, the sets of packets making up program309are encrypted according to the DES algorithm, with the control word as a key.

Two of the subcategories are special: those identified by PID0(305(e)) and PID1(305(c)) list the PIDs of the other packets associated with the service(s) and thus can be used to find all of the information associated with any service. The packets in PID1305(c) have as their contents a conditional access table (CAT)310, which lists the PIDs of other packets that contain EMMs. One set of such packets appears as EMM packets305(d), as indicated by the arrow from CAT310to packets305(d). Each packet303in packets305(d) contains private information, that is, information which is private to a conditional access system. Private information313, for the purposes of this invention, is a sequence of CA messages, each of which contains an EMM, and private information319, is a sequence of messages, each of which contains an ECM.

The packets in PID0305(e) contain a program association table (PAT) that lists PIDs of packets that are associated with a particular instance of a service. One such set of packets is program maps packets305(f), which contain a program map table (PMT)317that lists, amongst other things, the PIDs of transport packets303containing ECMs for the program. One such set of packets is shown at305(g). Each of the transport packets contains private information319, which in this case is a sequence of CA messages, each of which contains an ECM.

In a conditional access (CA) system, the messages have a common format, namely a header, the message itself, and a message authentication code, or MAC. The header contains the following information:the type of the message, i.e., whether it is an ECM, EMM, or some other type;the length of the message;an identifier for the conditional access system;an identifier for the type of security algorithm used with the message, including encryption of the message and authentication of its contents; andthe length of the message content.

The header is followed by the encrypted message and the MAC, which, depending on the message type, may be a sealed digest or a digest made with some or all of the MSK together with the message. For further information regarding a conditional access system and its details, refer to U.S. Pat. No. 6,424,714, Wasilewski, et al., entitled “Conditional Access System,” the disclosure and teachings of which are incorporated by reference in its entirety.

The present invention extends this conditional access system encryption and decryption approach to include additional data fields granting access to enhanced programs or services, such as games, a music jukebox, higher memory, high definition resolution, or advertising insertion, for example. The enhanced programs or services can be requested via a DHCT113or alternatively can be authorized at the service provider103of the communications system. In accordance with the present invention, appropriate safeguards are in place to control and provide security to services by including them as cryptographically protected attributes of the programs themselves.

FIG. 4is a block diagram of a conditional access system providing enhanced features. In accordance with the present invention, EMMs405granting entitlements may also include enhanced application or service entitlements (AppENTITLEMENTs)410that are provided to an authorized DHCT113typically via an out-of-band channel.FIG. 5is a diagram of a portion of an EMM entitling a program and an enhanced service. The application entitlement410indicates the header information500and the program that is granted to the DHCT505. Additionally, field510grants entitlement to an enhanced service. Other information included in the application entitlement410is the event time515, an expiration date520, or maybe a flag indicating that there is no expiration date525, among other data530. The actual form of the data fields may be text, bit maps, or other representations; however, the content of each data field corresponds to entitlement identifiers (EIDs) that are in turn associated by the system with specific instances (e.g., programs, movies, etc.) that are transmitted over the network.

Each AppENTITLEMENT410is directly linked to a corresponding ECM415, which includes application identifiers (AppIDs)420, application methods (AppMETHODs)425, and application attributes (AppATTRIBUTEs)430. It will be appreciated that the AppENTITLEMENT410and the corresponding ECM415do not have to be provided to the DHCT113concurrently. For example, the AppENTITLEMENT410may be provided to the DHCT113two weeks or two days prior to the ECM415being received. ECMs415are typically sent in-band with the services and are used to deliver the keys to decrypt the service.

The AppID420is a unique identifier identifying the authorized application. The AppATTRIBUTE430and AppMETHOD425are essentially application controls (AppCONTROLs)435. The application attribute430comprises parameters and confidential data that characterize the application. By way of example, application attributes430may include parameters affecting the display, sound, resolution, and alphablend. The application method425includes functions that an application can perform. For example, the application method425may enable or disable the return path, overlay graphics, or affect keyboard input. Also, the application method425may link to application source code and show, for example, program bloopers or actor interviews.

There are typically three classes of applications: a natively registered application; a securely downloaded application; and a wild or rogue application. A natively registered application (class1) is trusted because it was loaded at manufacture time in such a way that they cannot be altered or subverted. A real-time operating system (RTOS) that is programmed in memory is an example. Another example is a conditional access program in a tamper-proof hardware module. Securely downloaded applications (class2) are trusted because both their source of origin and integrity of content have been verified by secure means, for example, by digital signature, under the direction of a class1application. Thus, their behavior will follow the direction of the AppCONTROLs435because they have been certified to do so before their downloading was permitted. Wild or rogue applications (class3) are not trusted and can be controlled only by allowing access to a safe profile of system functions. In some cases, the safe profile may be the null set and a class3application would not be allowed to execute at all. A class1or class2application running on the terminal would be required to enforce this profile. A native RTOS could perform this function, for example.

In accordance with the present invention, it is assumed that the enhanced application is well-behaved or in some other way a controlled entity. Thus, by including application controls435(i.e., application methods425and application attributes430) within ECMs415that carry both EIDs and keys that permit access to the enhanced application or service, the behavior of applications associated with the service or that try to execute while a service is being displayed at the DHCT113can also be controlled.

In accordance with the present invention, AppENTITLEMENTs410are delivered via secure EMMs405to a secure processor in the DHCT113or are implanted into class1or class2application codes when they are created. Corresponding AppCONTROLs435are placed within ECMs415associated with specific services as desired to limit access to AppMETHODs425. Before class1or class2applications execute instructions associated with an AppMETHOD425, the entitlement410for the AppMETHOD425is checked. If the entitlement410has been granted, the AppMETHOD425is executed. If the entitlement410has not been granted, it is not executed.

Additionally, in accordance with the present invention, class1applications can be programmed to allow selective access to their AppMETHODs425. For example, an RTOS could be programmed to disallow access to a channel tuning or graphics overlay function. Thus, some AppMETHODs425could be accessible to all classes of applications while others could be restricted to certain classes. For instance, a class1RTOS may allow all class3applications to have access to a keyboard input function, but would not allow any display functions to be executed by the class3applications. The same RTOS could be programmed to allow certain class2applications that present appropriate credentials to have access to a specified subset of its AppMETHODs425.

Furthermore, in accordance with the present invention, the AppCONTROLs435may be varied dynamically during the transmission of the service. The AppCONTROL field435within the ECMs415can be changed either by manual or automated (e.g., prescheduled) intervention. The AppCONTROLs435may also be activated by the subscriber locally at the terminal. Thus, an application running in conjunction with a service may, for example, by default display its graphics only in low resolution mode. By request of the subscriber, an entitlement to a higher resolution mode, where the entitlement is provided as the AppENTITLEMENT410, may be purchased and stored in secure non-volatile memory in the DHCT113for either immediate or delayed uploading to the service provider103. In either case, the AppCONTROI,435is activated as soon as the application and specified AppCONTROL435become available to the DHCT113. The AppCONTROL activation may also be purchased by the subscriber in an advanced reservation mode. In this case, the entitlement for the AppCONTROL435is loaded by an EMM405addressed to the DHCT113of the subscriber in advance of the time of activation of the application, availability of the AppCONTROL435, or both.

The Detailed Description of a Preferred Embodiment set forth above is to be regarded as exemplary and not restrictive, and the breadth of the invention disclosed herein is to be determined from the claims as interpreted with the full breadth permitted by the patent laws.