Abstract:
A local device associated with a communication network is tested for signs of tampering by downloading from a remote device, via the network, a policing code object into the local device. The policing code object is executed within the local device and a message including the results of tests performed by the policing code object are evaluated to determine whether corrective action is required.

Description:
BACKGROUND OF THE INVENTION  
         [0001]    1. Field of the Invention  
           [0002]    The present invention generally relates to testing the validity of code or configuration data residing in a local device.  
           [0003]    2. Background Information  
           [0004]    Almost since the inception of Pay TV cable networks, many unauthorized users of Pay TV services have been taking advantage of different ways to receive Pay TV services, without paying for a portion or all of the services that they receive. With the expansion of Pay TV services to include applications comprised of software objects (code) and data, unauthorized use of these services has continued to present a significant and complex problem for Pay TV service providers. A typical Pay TV cable system consists of a hybrid-fiber coax (HFC) network connecting a headend office or a distribution center, to fiber nodes and subscriber devices (e.g., set-top terminals or cable modems).  
           [0005]    “Hacks” pose a major problem for the Pay TV industry. A “hack” occurs when a “pirate” or “hacker” modifies a software program in an unauthorized manner, by changing the code itself. Another problem for Pay TV service providers is the use of illegal Pay TV service decoders by subscribers. Such decoders allow subscribers to avoid paying their cable TV company for premium channels by decoding the signals. Such decoders have cost the Pay TV industry millions of dollars in lost revenues on an annual basis.  
           [0006]    Most hackers do not try to build decoders from scratch. Instead, the hackers try to modify existing subscriber decoders by enabling optional services without being billed for them, or reconfiguring decoders in such a way that they do not have to pay at all.  
           [0007]    As digital set-top terminals for cable and satellite television incorporate the capability to download different operating systems (e.g., Microsoft&#39;s WinCE), DLLs, JVMs, multiple system cable operators (MSOs) need a mechanism that will allow them to maintain control of the features, applications, and software objects in general that run or are utilized within these set-top terminals. More specifically, MSOs want the ability to access control services and associated usage of software objects in set-top terminals.  
           [0008]    Commonly assigned, co-pending U.S. patent application Ser. No. 09/389,107, filed on Sep. 2, 1999, entitled “DETECTION OF SUSPECT SOFTWARE OBJECTS AND SIGNATURES AFTER FAILED AUTHENTICATION,” which has been incorporated by reference in its entirety herein, discloses methods and apparatus for analyzing a failed software object authentication to determine whether the software object or a signature for the software object is suspect.  
           [0009]    “OpenCable” represents an industry effort to standardize cable system interfaces. “Open” is defined as the adherence to either international, North American, or published de facto industry standards. The OpenCable specifications allow for the separation of decoding functions performed by a host, and security functions performed by a point-of-deployment (POD) module. This separation supports portability of hosts from one system to another using the POD module corresponding to that system.  
           [0010]    Any local devices (e.g., set-top boxes, hosts, PODs) accessible to subscribers of Pay TV cable services are especially prone to tampering for fraudulent or malicious purposes. Timely detection of tampering, as well as prosecution of offenders, have both proven to be difficult in typical analog systems. Protection against such scenarios is just as critical in digital cable systems.  
           [0011]    While there have been prior approaches to address security of code objects and authentication of such objects, the present invention complements these approaches by seeking to ensure the integrity of these objects after being downloaded.  
         SUMMARY OF THE INVENTION  
         [0012]    The present invention determines, over a communication network, the condition of code or configuration data residing in a local device. In a CATV system, a policing code object is downloaded from a remote device, via the communication network, into the local device. The policing code object is then executed in the local device. The remote device receives, from the local device, a message including a summary of the results of one or more tests performed by the policing code object.  
           [0013]    The communication network may be an HFC network. The code or configuration data may be stored in memory in the local device. The local device may be one of a set-top terminal, a cable modem, or both (integrated in one device). Alternatively, the local device may be at least one of a POD module and a host. The remote device may be a remotely located access controller.  
           [0014]    In a first embodiment of the present invention, the policing code object is downloaded from the remote device into the set-top terminal. Once the policing code object determines the results, these results are sent in a message to the remote device for further processing.  
           [0015]    In a second embodiment of the present invention, and particularly in an OpenCable environment, the policing code object is downloaded directly into the host or the POD to perform similar checking. Additionally, the policing code object may be indirectly downloaded to the host via the POD. Irrespective of the direct versus indirect downloading, once the code object determines the results of tests performed by the policing code object, these results are sent in a message to the remote device for further processing.  
           [0016]    The message may be an acknowledgement message that includes a confirmation of the authenticity of the test results. The acknowledgement message may be a signed acknowledgement message.  
           [0017]    The tests may determine whether the code or configuration data is one or more of the following:  
           [0018]    (1) Valid or authorized code or configuration data previously loaded into the local device.  
           [0019]    (2) Unauthorized code or configuration data previously loaded into the local device for fraudulent or mischievous purposes.  
           [0020]    The remote device may take corrective action in response to one of the following conditions:  
           [0021]    (1) The message indicates that valid or authorized code or configuration data is not present in the local device.  
           [0022]    (2) The message indicates that unauthorized code or configuration data is present in the local device.  
           [0023]    (3) The remote device does not receive a message comprising a summary of the test results within a predetermined period of time.  
           [0024]    The corrective action may consist of altering the condition of the local device, denying service to a user of the local device, and/or alerting a system operator. 
       
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0025]    The following detailed description of preferred embodiments of the present invention would be better understood when read in conjunction with the appended drawings. For the purpose of illustrating the present invention, there are shown in the drawings embodiments which are presently preferred. However, the present invention is not limited to the precise arrangements and instrumentalities shown. In the drawings:  
         [0026]    [0026]FIG. 1 shows a block diagram of a CATV system implementing an HFC network in accordance with the present invention;  
         [0027]    [0027]FIG. 2 shows a flow diagram in accordance with the present invention;  
         [0028]    [0028]FIG. 3 shows a block diagram of a system with POD/host devices in accordance with a first embodiment of the present invention; and  
         [0029]    [0029]FIG. 4 shows a block diagram of a system with POD/host devices in accordance with a second embodiment of the present invention. 
     
    
     DETAILED DESCRIPTION OF THE INVENTION  
       [0030]    Certain terminology is used herein for convenience only and is not to be taken as a limitation on the present invention. A “code object” is an application, an applet, or other software used by a central processor to perform instructions.  
         [0031]    [0031]FIG. 1 shows a CATV system  100  communicating over an HFC network in accordance with the present invention. A remote access controller  10  is remotely located from a local device  20  in a cable subscriber&#39;s home. The local device  20  may be a set-top terminal/box or a cable modem. The remote access controller  10  and the local device  20  communicate with each other via communication network  30 .  
         [0032]    [0032]FIG. 2 shows a flow diagram illustrating a method of determining the condition of code or configuration data residing in local device  20 . A policing code object  15  is downloaded from the remote access controller  10  into the local device  20  via HFC network  30  (step  35 ). The policing code object  15  is then executed in the local device  20  (step  40 ) immediately after being downloaded or when instructed by the remote access controller  10 . The policing code object  15  determines if valid or authorized code or configuration data previously loaded into the local device  20  is present. The policing code object  15  can also determine the presence of unauthorized code or configuration data previously loaded into the local device  20  for fraudulent or mischievous purposes. There are several methods of achieving this function. These are known to those skilled in the art. For example, one of such methods would entail re-authenticating and checking the integrity of the object by any suitable algorithm. A message is then sent from the local device  20  to the remote access controller  10  via the HFC network  30 . If the message is not received after waiting a predetermined period of time (step  45  “NO”), corrective action is taken (step  50 ). If the message is received (step  45  “YES”), the remote access controller  10  authenticates the message and then analyzes a summary of test results performed by the policing code object  15  that is included in the message. If it is determined that tampering of the local device  20  occurred (step  55  “YES”), corrective action is taken (step  50 ).  
         [0033]    The message may be an acknowledgement message that includes a confirmation of the authenticity of the test results. The acknowledgement message may be a signed acknowledgement message.  
         [0034]    The corrective action may consist of altering the condition of the local device  20 , denying service to a user of the local device  20 , and/or alerting a system operator.  
         [0035]    [0035]FIG. 3 shows an OpenCable system  200  in accordance with a first OpenCable system embodiment of the present invention. A remote access controller  10  is remotely located from a host  60  and a POD module  70  in a cable subscriber&#39;s home. The host  60  and POD module  70  communicate with each other via interface  65 . The remote access controller  10  and the host  60  communicate with each other via OpenCable network  75 . A policing code object  15 ′ is downloaded from the remote access controller  10  into the host  60  via OpenCable network  75 . The policing code object  15 ′ is then executed in the host  60 . The policing code object  15 ′ determines if valid or authorized code or configuration data previously loaded into the host  60  is present. The policing code object  15 ′ can also determine whether unauthorized code or configuration data previously loaded into the host  60  for fraudulent or mischievous purposes is present. A message including a summary of test results performed by the policing code object  15 ′ is then sent from the host  60  to the remote access controller  10  via the OpenCable network  75 . In a slightly alternate embodiment, the host receives the policing application via the POD from the remote device (not shown). All other steps remain the same.  
         [0036]    [0036]FIG. 4 shows an OpenCable system  300  in accordance with a second OpenCable system embodiment of the present invention. A remote access controller  10  is remotely located from a host  60  and a POD module  70  in a cable subscriber&#39;s home. The host  60  and POD module  70  communicate with each other via interface  65 . The remote access controller  10  and the host  60  communicate with each other via OpenCable network  75 . A policing code object  15 ″ is downloaded from the remote access controller  10  into the POD module  70  via OpenCable network  75 , host  60 , and interface  65 . The policing code object  15 ″ is then executed in the POD module  70 . The policing code object  15 ″ determines if valid or authorized code or configuration data previously loaded into the POD module  70  is present. The policing code object  15 ″ can also determine whether unauthorized code or configuration data previously loaded into the POD module  70  for fraudulent or mischievous purposes is present. A message including a summary of test results performed by the policing code object  15 ″ is then sent from the POD module  70  to the remote access controller  10  via the interface  65 , host  60  and OpenCable network  75 . For additional protection and security, once the policing object generates the results, it may be deleted and loaded again as determined by the remote controller.  
         [0037]    The present invention may be implemented with any combination of hardware and software. If implemented as a computer-implemented apparatus, the present invention is implemented using means for performing all of the steps and functions described above.  
         [0038]    The present invention can be included in an article of manufacture (e.g., one or more computer program products) having, for instance, computer useable media. The media has embodied therein, for instance, computer readable program code means for providing and facilitating the mechanisms of the present invention. The article of manufacture can be included as part of a computer system or sold separately.  
         [0039]    It will be appreciated by those skilled in the art that changes could be made to the embodiments described above without departing from the broad inventive concept thereof. It is understood, therefore, that this invention is not limited to the particular embodiments disclosed, but it is intended to cover modifications within the spirit and scope of the present invention as defined by the appended claims.