Patent Publication Number: US-2007104104-A1

Title: Method for managing security keys utilized by media devices in a local area network

Description:
CROSS REFERENCE TO RELATED APPLICATIONS  
      The present application relates to co-pending and commonly assigned U.S. application Ser. No. 11/239,261, filed on Sep. 29, 2005, from which benefits under 35 USC 120 is hereby claimed and the contents of which are incorporated herein by reference.  
     FIELD OF THE INVENTION  
      The present invention relates generally to the field of security schemes for protecting content delivered to media devices. More particularly, the present invention relates to a digital rights management scheme for managing security keys utilized by media devices of a local area network.  
     BACKGROUND OF THE INVENTION  
      Digital content providers, including record labels and book publishers, lose a lot of money to piracy. Copyright protection technologies such as Digital Rights Management (“DRM”) of the Open Mobile Alliance (“OMA”) are safeguards to drive out content thieves in the digital era. DRM plays a role to take care of digital content from its birth throughout its life cycle by preventing illegal reproduction of the content.  
      DRM is a set of technologies that provide the means to control the distribution and consumption of the digital media objects. In typical implementations of DRM, a rights issuer (“RI”) grants a digital license, called a Rights Object (“RO”), to a device to consume a digital media content object (“CO”) according to a specific set of permissions. The permissions usually are specified by using a document specification language like XrML or other similar languages. Due to the extensive protection provided by DRM, it is utilized for various types of local area networks.  
      One type of local area network, namely a home network, is under one administrative domain. More particular, a home network is a collection of devices and sub-networks operated by a single organization or administrative authority. The components of the domain are assumed to interoperate with mutual trust among themselves, but interoperate with other domains in a less-trusted manner. This is to be contrasted with the network domain models, which maybe under multiple administrative domains.  
      A home network utilizes any technology or service that makes it possible to connect home devices to each other or automate them. A home networking device may be stationary or mobile, i.e., can leave or join the network at arbitrary times. Each device may also be turned on or off at various time. A more specific definition of a home network includes linking consumer electronic devices, computers, and peripherals within a home to form a connected environment. Home networking enables a family&#39;s electronic devices and household appliances to be connected to each other. These devices can also be seamlessly connected to the Internet, offering the advantage of an added content source. Internet access also provides this application&#39;s greatest threat, however, at least from the entertainment companies&#39; viewpoint.  
      Some home networking applications rely on the existence of a home networking server to provide security for home networks. The server is responsible for storing content, managing keys for secure distribution of content to home devices, authenticating the home networking to content rights issuers, and managing and enforcing permissions. The server is usually a centralized device separate from other home devices. Servers are usually unwieldy devices that require complex configuration and setup. Further, being a centralized device, a server represents a possible single point of failure. If it fails, then the home networking cannot access any protected content. Further, consumers would be required to pay a significant amount for a device whose sole function is to manage other devices. Given these difficulties, a solution is needed that avoids the use of centralized servers.  
      Other home networking applications, such as the OMA DRM, require each home networking device to create a separate security association with media providers, i.e., entities that provide CO&#39;s and RO&#39;s. Thus, contacting media providers to obtain content incurs a storm of communication between the home network and the media provider. This storm needs to be repeated for every media server that the home network wants to access. Network servers are not required in the home network for these applications, and the applications use the ubiquitous public key infrastructure (“PKI”). However, the media provider would offer the services of a network server to the home network. The home networking devices must use these services, with the attendant loss of privacy for the home network.  
      Still other home networking applications use smart cards to enable home networking to interwork with any DRM scheme. For these applications, two cards are required: a Converter Card and a Terminal Card. The Converter Card decrypts RO&#39;s from RI&#39;s, translates the received permissions into a defined permission, re-encrypts the content encryption key by using a key that the Converter Card creates, sends the key securely to the Terminal Card, and sends the re-encrypted content encryption key to the Terminal Card. The Terminal Card decrypts the key and uses it to decrypt the content encryption key. Depending on the permissions, the Terminal Card may also need to issue challenges to the terminal on which the card resides.  
      Unfortunately, smart card-based applications have many weaknesses. All devices must have the capability to interface with smart cards, so there is no facility to include devices that do not support smart cards. The solution also assumes that all devices are fixed, so no extension is provided for wireless devices. Thus, there is no support for group management and no mechanism for authentication or authorization in remote domains. In addition, from a permissions point of view, these smart card-based applications are very limited. All permissions are mapped to a limited set of defined permissions, so RI&#39;s are limited in specifying the types of permissions offered to users.  
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       FIG. 1  is a diagrammatic view illustrating a digital security system for a media content distribution system in accordance with the present invention.  
       FIG. 2  is a diagrammatic diagram representing important components of a digital security system in accordance with the present invention.  
       FIG. 3  is another diagrammatic view illustrating the digital security system of  FIG. 1 .  
       FIG. 4  is a process diagram illustrating interaction between the communication device and the issuers in accordance with the present invention.  
       FIG. 5  is a diagrammatic view illustrating another digital security system for a media content distribution system in accordance with the present invention.  
       FIG. 6  is another diagrammatic view illustrating certain functions of the media content distribution system of  FIG. 5 .  
       FIG. 7  is a process diagram illustrating the rights issuer and the media devices in accordance with the present invention.  
       FIG. 8  is a diagrammatic view illustrating a digital security system for managing security keys utilized by networked media device in accordance with the present invention.  
       FIG. 9  is a block diagram illustrating exemplary components of the media devices of  FIG. 8 .  
       FIG. 10  is a flow diagram illustrating an exemplary operation for distribution of a security key for the digital security system of  FIG. 8 .  
       FIG. 11  is a flow diagram illustrating an exemplary operation for revocation of a security key for the digital security system of  FIG. 8 .  
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS  
      The present invention defines a framework and protocols for security management for local area networks. For example, the framework and protocols are applicable to digital rights management (“DRM”) for home networking applications. Devices are used as logical, distributed, limited functionality servers that cooperatively emulate the function of network servers. The server function is value added service in the devices, not the main function for the devices. The server function is only responsible for key management and authentication.  
      Unlike other solutions for security management in local area networks, our solution uses media devices as logical, distributed, limited functionality network servers. By adding two main components, namely key management and distributed coordination, to media devices, the devices address the problems associated with security management in local area networks in a distributed, cooperative way without the need for a separate, dedicated, centralized server.  
      The framework and protocol balances the requirements of provider control and owner privacy. Also, the framework and protocol is based on a distributed system and method that avoids the use of dedicated servers. In addition, the framework and protocol permits the mobile phones to be powered off when the home networking receives content. Further, the framework and protocol does not require involvement from the user other than to select content from a Media Provider. All interactions occur in the background and automatically. In particular, the user does not need to configure the network or program any of the media devices.  
      One aspect of the present invention is a method of a particular media device of a local area network for distributing a media key to a new media device joining the local area network, in which the local area network includes media devices. A set of key generation counter (“KGC”) values are received from the media devices. The KGC values correspond to network keys utilized by the media devices. Each KGC value of the set of KGC values is then voted on based on the network keys utilized by the particular media device. Next, all votes for each KGC value of the set of KGC values are gathered from the media devices. One or more popular KGC values are determined from the set of KGC values. Thereafter, the particular media device ensures that the new media device is informed of the popular KGC value or values.  
      Another aspect of the present invention is a method of a particular media device of a local area network for revoking a network key utilized by one or more media devices of the local area network. A NONCE is encrypted with the network key. The encrypted NONCE is then distributed to media devices of the local area network. Next, votes are gathered from the media devices of the local area network. All votes are received from media devices that are able to decrypt the NONCE using the media key. Thereafter, each media device determines whether to revoke the network key based on the gathered votes.  
      Referring to  FIG. 1 , there is shown an exemplary digital security system  100  in accordance with the present invention. The system  100  includes a wide-area network (“WAN”)  102  interconnected for communication with a local area network (“LAN”)  104 . The WAN  102  is typically public and Internet Protocol (“IP”) based, and the WAN has some mechanism to connect to the LAN  104 . The LAN  014  is not necessarily IP-based. An example of a LAN  104  is a home network as described above. The details of the mechanism to connect the WAN  102  to the LAN  104  are not relevant to this invention, but we assume that the WAN  102  may communicate with at least one public IP address of the mechanism. For one embodiment, as shown in  FIG. 1 , the WAN  102  includes multiple communication networks, wired and wireless, communicating data over the Internet, and the LAN  104  is a home network having media devices that may communicate via the Internet.  
      The WAN  102  includes a media provider or, more particularly, a digital media server  106  of the media provider. Media content and creative work are available from digital media servers  106  that customers can access by using WAN  102 . Prospective customers may use a remote agent or communication devices  108 , such as mobile phones or Personal Digital Assistants (“PDA&#39;s”), to browse through content offered by the media providers and their digital media servers. The remote agent  108  may be a wired device, but a wireless device would be much more convenient for purposes of the present invention. Examples of wireless communication devices include, but are not limited to, cellular telephones, PDA&#39;s and computing devices that utilize one or more the following technologies: analog communications (using AMPS), digital communications (using CDMA, TDMA, GSM, iDEN, GPRS, or EDGE), and next generation communications (using UMTS or WCDMA) and their variants; a peer-to-peer or ad hoc communications such as HomeRF, Bluetooth and IEEE 802.11 (a, b or g); and other forms of wireless communication.  
      A user with a mobile device  108 , labeled Majordomo in the figure, may be away from the user&#39;s LAN  104  and may browse through a catalogue of media offerings from a media provider, i.e., at the digital media server  106 . The user may decide to purchase multimedia content, such as a movie, to be played at a specific time after the user goes home, but the user may want to direct different portions of the multimedia content to different media devices of the LAN  104 . For example, the user may want a video portion to be shown on a video media device  110 , such as a flat screen television; an audio portion to play on an audio media device  112 , such as a stereo; and a text to appear on a text media device  114 , such as a computer. Further, the user may want to capture the audio portion in a recording media device  116 , such as a digital video recorder (“DVR”), after it plays on the audio media device  112 .  
      The particular steps for accomplishing the above operation by a user for distributing media content to a LAN  104  may be illustrated in reference to  FIG. 1 . A user may use the communication device  108  to communicate with the digital media server  106  and browse various media content or content objects available from the Media Provider. The communication device  108  may then send a request to the digital media server  106  to purchase a selected content object (“CO”), such as a movie, from the Media Provider. The content object may include several components, such as a video component, an audio component, and a text component at step  118 . Also, the request may include a requested time for providing the content object to the LAN  104  of the user. The Media Provider may then confirm the acceptance of the order by sending a confirmation from the digital media server  106  to the communication device  108  at step  120 . At the requested time, the Media Provider provides three separate objects or streams from the digital media server  106  to the LAN  104  at steps  122 - 126 , which may occur within a same frame or otherwise synchronized with each other. For example, the Media Provider may send the video component to the video media device  110  at step  122 , the audio component to the audio media device  112  at step  124 , and the text component to the text media device  114  at step  126 . If the user of the communication device  108  desires to store one or more of these objects or streams, the LAN  104  may include a recording media device  116  that receives them at the same time, or subsequent to, the other media devices  110 - 114 . For example, at a time subsequent to the requested time, the audio media device  112  may forward the audio component to the recording media device  116  for recording at step  128 .  
      In  FIG. 1 , the devices associated with the user may be sorted into three categories: Majordomos, Recluses, and Hermits. A Majordomo, namely the communication device  108 , is a user device that has the components necessary to access directly the communication infrastructure of the LAN  104 , is enabled by the administrator of the LAN to access the LAN infrastructure, has the components necessary to access the WAN  102 , is enabled by the administrator of the LAN to access the WAN, and has a digital encryption certificate. A Recluse, such as text media device  114 , has the same characteristics as a Majordomo except that a Recluse is allowed to receive and send security keys to devices in the LAN  104  only. A hermit, such as devices  110 ,  112  &amp;  116 , is a media device of the LAN  104  that does not have a digital encryption certificate.  
      The embodiments of the present invention balance two potentially conflicting requirements: the Provider Control requirement and the Owner Privacy requirement. For the Provider Control requirement, the Media Provider must be able to control which device consumes the protected content. This requirement is needed because some devices may be known to have security flaws, and the Media Provider may not want the content to be consumed by these devices. For the Owner Privacy requirement, the home networking owner should not have to disclose to the Media Provider details of what devices belong to the home networking. This requirement is needed to ensure privacy for the home networking owner.  
      Referring to  FIG. 2 , there is shown an exemplary digital security system  200  in accordance with the present invention. The content owner  202  creates media content and provides the media content to a content packager and/or distributor  204 . It is to be understood that, even though the content packager and/or distributor  204  is shown in  FIG. 2  to be a single entity, the functions of the content packager and/or distributor may be shared by more than one entity. The content packager and/or distributor  204  provides the media content to the LAN  206  and a license location associated with the media content to a communication device  208 . The media devices of the LAN  206  will not be able to make use of the received media content without an appropriate license  210  for the media content. Thus, the communication device  208  retrieves the license  210  at the license location and provides the license to the LAN  206  so that the media devices at the LAN may utilize the media content received from the content packager and/or distributor.  
      In particular, the content owner  202  creates or otherwise obtains digital files  212 . The content owner  202  then uses an encoder  214  to encode the digital files  212  into a format that media players can render, i.e., a player-ready file  216 . The content owner  202  provides the player-ready file  216  to the content packager and/or distributor  204 . The content packager and/or distributor  204  uses an encryption device  218  to encrypt the formatted files by using a content encryption key or object encryption key, thus forming a content encrypted file  220 . The content encrypted file is provided to the LAN  206  or, more particularly, the media devices of the LAN. The content packager and/or distributor  204  also determines an address  222  identifying one or more locations where a license  210  associated with the content encrypted files may be found and provides the address to the communication device  208 . For example, the address may be a URL (“uniform resource locator”) that specifies locations where a license that includes the content decryption key may be purchased.  
      If a license  210  is not found for the content encrypted files  220 , then the communication device  208  request a license by following the license address  222 . A license  210  includes a set of permissions  224 , i.e. the type of use that the content owner allows, and a content decryption key  226 . The communication device  208  may then encrypt the content decryption key  226  with a network privacy key known to one or more components of the LAN  206 , and provide the encrypted key to the LAN. Upon receiving the encrypted key from the communication device  208 , the media devices of the LAN  206  may use the network privacy key to decrypt the encrypted content decryption key and consume the media content according to the permissions  224  of the license  210 .  
      Regarding the communication device  208 , the communication device comprises a memory  228 , a transceiver  230  and a processor  232  coupled to the memory and the transceiver. The memory  228  stores a digital security certificate associated with the communication device, certificate information associated with the media devices, and a network privacy key to provide access to the media devices. The transceiver  230  communicates the digital security certificate and the certificate information to the media provider, and receives a content key associated with the media content from the media provider. The processor  232  encrypts the content key based on the network privacy key and instructs the transceiver to provide the encrypted content key to the media devices.  
      Referring to  FIG. 3 , the digital security system  300  of the present invention includes a WAN  302  and a LAN  304  and is based on public/private key encryption. The WAN  302  includes a media provider or, more particularly, a digital media server  306  of the media provider. A communication device  308 , i.e., Majordomo, and media devices  310 - 316  of the LAN  304  share one network privacy key, such as the LAN decryption key or a Home Network Group Key (“HNGK”). The group key acts as a privacy key that is shared among the media devices  310 - 316 . The Rights Issuer (“RI”) and the content issuer (“CI”) need to authenticate only one security agent, such as communication device  308 , even though there are multiple individual physical devices  310 - 316  internal to the LAN  304 . The communication device&#39;s interactions with the issuers are solely to authenticate the LAN  304 , specify the addresses of the target LAN media devices  310 - 316 , and obtain a content decryption key from the RI. The communication device  302  does not need to store any Rights Object (“RO”) or Content Object (“CO”) items. It should be noted that the CI is represented by the Media Provider, but the RI may be represented by the Media Provider or a 3rd party associated with the Media Provider.  
      Still referring to  FIG. 3 , the communication device or Majordomo  308  sends a request for a content object to the digital media server  306  at step  318 , in which the request may include a requested time for content delivery. In response, the digital media server  306  returns a confirmation of acceptance of the order to the communication device  308  at step  320 . Next, the communication device  308  creates a security association with the digital media server  306  and obtains a content decryption key from the digital media server at step  322 . The communication device  308  obtains a content decryption key associated with the media content, encrypts the content decryption key using a network privacy key associated with the media devices of the LAN  304 , and sends the encrypted content decryption key to one or more devices of the LAN at step  324 . At the requested time, the digital media server  306  may send the encrypted media content to the media devices  310 - 316 . For example, the digital media server  306  sends an encrypted video portion to the video media device  310 , encrypted audio portion to the audio media device  312 , and encrypted text portion to the text media device  314 . One or more portions may also be recorded by recording media device  316 .  
      Referring to  FIG. 4 , there is provided an exemplary timing diagram  400  illustrating the signaling that may occur between the communication device or majordomo  402  and the issuers  404 ,  406  of the present invention. As stated above, the CI is represented by the Media Provider, but the RI may be represented by the Media Provider or a 3rd party associated with the Media Provider. The communication device  402  sends a content object identification (“CO ID”), generic device names and a LAN address to the content issuer at step  408 . The CO ID identifies the particular media content desired by the communication device  402 , since the device may be selecting from a plurality of media content. The generic device names identify the target media devices for delivery of the selected media content, such as flat screen TV, stereo, and laptop. The LAN address identifies the delivery address for the LAN and its associated media devices, such as an IP address. In response to the request, CI  404  returns an order identification to confirm the order at step  410 .  
      After receiving confirmation from the CI, the communication device  402  obtains a license associated with the media content for the LAN. In addition to the generic device names and LAN address, the communication device  402  also provides a certificate associated with itself and certificate information associated with each one of the media devices to authenticate itself and these devices to the RI  406  at step  412 . Thus, the communication device  402  also provides the certificate information of media devices to the RI  406 . The certificate information associated with the media devices is either a list identifying the digital security certificates of the plurality of media devices or the digital security certificates themselves. This allows the RI  406  to check the credentials of the media devices. Note that this step maintains privacy for the LAN owner because the communication device  402  does not reveal what networking devices associated with the certificates. If the RI  406  determines that all certificates associated with the communication device  402  and the media devices are valid, then the RI returns security association acceptance at step  414 . If, on the other hand, the RI  406  fails to determine that the certificate associated with the communication device  402  is valid, then the security association between the communication device and RI fails. Even if the certificate associated with the communication device  402  is valid, the RI  406  may determine that the security association fails if the certificate of one or more media devices is found to be invalid, depending upon the way that the RI is configured.  
      Once the RI  406  authenticates the communication device certificate and media device certificates, the communication device  402  requests the object key from the RI  406  at step  416 . The RI  406  sends the object key, such as the content decryption key, to the communication device  402  at step  418 , and it is not necessary to send the RO to the communication device. The communication device  402 , then, encrypts the content decryption key by using the network privacy key and sends it, along with a Transaction ID, to the media devices of the LAN.  
      Referring to  FIG. 5 , there is provided another digital security system  500  for a media content distribution system in accordance with the present invention. The digital security system  500  of the present invention includes a WAN  502  and a LAN  504  and is based on public/private key encryption. The WAN  502  includes a media provider or, more particularly, a digital media server  506  of the media provider. A communication device  508 , i.e., Majordomo, and media devices  510 - 516  of the LAN  504  share one network privacy key. The Rights Issuer (“RI”) and the content issuer (“CI”) need to authenticate only one security agent, such as communication device  508 , even though there are multiple individual physical devices  510 - 516  internal to the LAN  504 . The communication device&#39;s interactions with the issuers are solely to authenticate the LAN  504 , specify the addresses of the target LAN media devices  510 - 516 , and obtain a content decryption key from the RI.  
      For example, the communication device  508  makes request for a content object (“CO”), such as a movie, at step  518 . The communication device  508  sends generic device names, such as α, β, and δ, to the digital media server  506  of the Media Provider. The Media Provider and its digital media server  506  do not know the capabilities of media devices α, β, and δ and, thus, privacy for the owner of the LAN  504  is maximized. The communication device  508  also provides the certificate information of media devices  504 - 516  to the RI. This allows the RI to check the credentials of the media devices  504 - 516 . The certificate information of the media devices is either a list identifying the digital security certificates of the plurality of media devices or the digital security certificates themselves. In response to the request, the digital media server  506  of the Media Provider confirms the acceptance of the order to the communication device  508  at step  520 .  
      The communication device  508  then creates a security association with the digital media server  506  at step  522 . Next, the communication device  508  obtains an object encryption key or, more particularly, a content decryption key, from the digital media server  506  at step  524 . Also, during step  524 , the communication device  508  encrypts the object encryption key by using a network privacy key, such as a home networking group key (“HNGK”), and sends it to authorized media devices in the LAN  504 . Thereafter, the digital media server  506  of the Media Provider sends the encrypted media content to the media devices  510 - 516  at the requested time, as represented by step  526 . For example, the digital media server  506  may send an encrypted video portion to the video media device  510 , encrypted audio portion to the audio media device  512 , and encrypted text portion to the text media device  514 .  
      The digital security system  500  shown in  FIG. 5  differs from the systems shown by the previous figures in several ways. Of particular interest is a module  528  called a Proxy Network Access Translator (“Proxy NAT”). The module  528  resides in a gateway or router that exists in the LAN  504 . It should be noted that the LAN  504  may be one of three types of networks: (1) IP-based and uses public IP addresses for the devices, (2) IP-based and uses private IP addresses for the devices, or (3) not IP-based. It should also be noted that the WAN  502  is preferably IP-based. For a LAN  504  of type (2) or (3), the LAN must have a gateway or router that connects it to the WAN  502 . For type (2), the gateway or router translates between the LAN private IP addresses and the WAN public IP addresses. For type (3), the gateway or router interconnects the IP-based WAN to the technology used in the LAN. Therefore, the Proxy NAT module can  528  may be added to the existing gateway and router for LAN  504  that use the configurations of network types (2) or (3). Only in type (1) it is possible that the LAN has no router or gateway. Hence, a LAN having the configuration of type (1) needs to add a router or gateway to support the Proxy NAT module  528 .  
      Referring to  FIG. 6 , the functionality of the Proxy NAT module  528 ,  628  may be understood with reference to this figure. As stated above, the communication device  608  sends generic device names, such as α, β, and δ, to the digital media server  606  of the Media Provider. The Media Provider does not know the addresses of these media devices  610 - 614  but knows the address of the LAN  604  where they are located. Therefore, the Media Provider may concatenate the network address with the generic device names and rely on the Proxy NAT module  628  in the LAN  604  to translate the addresses to physical device addresses. The Proxy NAT module  628  then translates the generic device names α, β, and δ, to physical addresses and relays messages from the digital media server  606  of the Media Provider to the media devices  610 - 614 . This process hides the internal structure of the LAN  604  from the Media Provider and its digital media server  606  and allows users to name their media devices without regard to the Media Provider.  
      For example, the communication device or Majordomo  608  sends generic device names, such as α, β, and δ, to the digital media server  606  of the Media Provider at step  618 . At this time, the Media Provider does not know the capabilities of media devices α, β, and δ. The digital media server  606  of the Media Provider then sends a query to the LAN  604  asking for the capabilities of media devices α, β, and δ at step  620 . Next, each media device responds to the digital media server  606  with its capabilities at step  622 . For example, media device a  610  may respond by stating its capabilities as being a device capable of supporting analog video only. Thereafter, the digital media server  606  of the Media Provider customizes the content object (“CO”) to the capabilities of each media device  610 - 614  before sending the appropriate CO&#39;s to the corresponding media devices at step  624 .  
      Referring to  FIG. 7 , when the rights issuer (“RI”)  702  is ready to send the rights object (“RO”) to the media devices  706 , the RI queries the media devices for their capabilities. Note that, because all media devices  706  and the communication device share the same network privacy key, there is no need for the devices to authenticate themselves with the RI  702 . Thus, the RI  702  sends a trigger message to each of the media devices  706 , where the trigger message includes a Transaction ID at step  708 ,  710 . The Transaction ID relates the communication to a particular object encryption key. The Transaction ID is the same one that the RI  406  sent to the Majordomo  402  in step  418  of  FIG. 4 . Once a media device  706  locates the Transaction ID, the media device responds to the RI  702  with a description of the capabilities of the media device at step  712 ,  714 . This description allows the RI  702  to customize the CO to the media device  706 . The RI  702  then encrypts the RO&#39;s and sends them to the media devices  706  at step  716 ,  718 .  
      For other embodiments, the Proxy NAT module  528 ,  628  may include a table for correlating a media device with a particular address and/or capability. For example, the Proxy NAT module  528 ,  628  may include table that correlates a media device identification to an address corresponding to the media device. Thus, the Media Provider may only know the device identification for each media device of the LAN and will not know the full identity or capabilities of each media device. However, the Proxy NAT module  528 ,  628  will be able to associate each device identification queried by the Media Provider with the address of the media device by looking-up the device identity in the table, thus routing communication to the appropriate devices.  
      The Proxy NAT module  528 ,  628  may include a table that includes the capabilities of each media device, thus eliminating the need to query each media device when requested by the Media Provider. For example, when the digital media server of the Media Provider requests the capabilities of a particular media device, the Proxy NAT module  528 ,  628  may merely lookup the device identity in the table to find the corresponding capabilities of the media device. Referring to  FIG. 7  again, for this embodiment, portions  710 ,  714  and  718  of the steps become unnecessary since the Proxy NAT module  528 ,  628  will not need to contact the media devices. Of course, in order to function properly, the table relies upon by the Proxy NAT module  528 ,  628  will need to be populated in advance and/or updated on a periodic basis with the capabilities of each media device.  
      Examples of the capabilities of the media devices include, but are not limited to, video, image, audio and text capabilities. In each case, for example, the capabilities include the media format that the device can render. Examples of video formats include analog only, MPEG-2, MPEG-4, DivX, MJPEG, MJPEG2000, H.263, H.264, Sorenson, and the like. Examples of audio formats include mono, stereo, surround-sound, MP3, AAC, Ogg Vorbis, and the like. Examples of text formats include language, closed-captioning, commentary, and the like.  
      The present invention provides benefits to users, content providers, and device manufacturers. Users may benefit from simplicity of use and configuration. Each user needs to configure the Majordomo only and not other devices the user may add to the home networking. All other interactions among CI or RI and home networking are done by the components implementing our solution. Each user may also enjoy the multimedia experience. The user can buy any devices and name them any way the user wishes, and the user can buy applications and play them on variety of home networking devices without active involvement on the user&#39;s part.  
      The copyright of content providers is protected by ensuring that rights objects and content objects are encrypted with the home networking keys, that the home networks are authenticated, that the issuers are authenticated, and that the permissions for the content are obeyed. Content providers continue to control content, in a sense, even when it physically resides in users&#39; devices. The DRM agents in the home networking track actual consumption of the media and enforce the permissions specified by the copyright owners.  
      Content providers may also provide multi-media content where they charge for each part of the content separately. They can charge for the audio, video, and text portions if used on separate devices. In a sense, the providers can charge a la carte as opposed to one charge for the whole of the content. Other examples include subscription business models, where users need to pay periodically to keep the content in their homes.  
      Device manufactures also benefit because, the simple protocols for the home devices provide low processing and memory overhead, thus providing lower cost for the devices. The simple configuration required for the devices to access content leads to wide acceptance of the products among users and content providers.  
      Referring to  FIG. 8 , there is provided a digital security system  800  for managing security keys utilized by networked media device in accordance with the present invention. The digital security system  800  includes a local area network (“LAN”)  802 . The LAN  802  may include a variety of media devices, such as a video media device  804  for consuming video content, such as a flat screen television; an audio media device  806  for consuming audio content, such as a stereo; and a text media device  808  for consuming textual content, such as a computer. The LAN  802  may further include a recording media device  810 , such as a digital video recorder (“DVR”).  
      When a new device  812  joins the LAN  802 , the new device detects its neighbors, such as video media device  804  and text media device  808 , and attempts to communicate with them to obtain a network key. The new device  812  requires the network key in order to access or otherwise consume media content available to other media devices  804 - 810  of the LAN  802 . Each neighboring device  804 ,  808  sends a key generation counter (“KGC”) value corresponding to each known network key to the new device  812 . Each network device may utilize multiple network keys and multiple versions of each network key. The KGC value provides a way to identify and differentiate among these various networks keys and versions without revealing the network keys themselves.  
      Some neighboring devices  804 ,  808  may have out-of-date network keys because, for example, they were turned off at various times in the past. So, upon receiving the network keys, the new device  812  verifies the keys with other devices in the LAN, such as the audio media device  806  and the recording media device  810 . To reach the other devices  806 ,  810 , the new device  812  may request its neighbors  804 ,  808  to forward its messages to their neighboring devices in the LAN  802 . The other devices  806 ,  810  in the LAN  802  then respond back with their own KGC values. For each received KGC value, the new device  812  verifies the KGC value with the rest of the LAN  802 . Finally, a secure consensus algorithm, such as a Byzantine Agreement, is then executed by the media devices  804 - 810  of the LAN  802  to select the most appropriate network key. This algorithm must work correctly for LAN&#39;s with arbitrary topology, where the media devices start the algorithm at arbitrary times, the device clocks may drift from real-time, and the devices may be mobile. An example of such an algorithm is discussed in U.S. application Ser. No. 11/239,261, filed on Sep. 29, 2005, the contents of which are incorporated herein by reference.  
      During the execution of the above process, it is likely that the new device  812  will receive several different KGC values. To determine which KGC value to use, the new device  812  checks with the other media devices  804 - 810  of the LAN  802  to determine which KGC values correspond to revoked network keys. The new device  812  then discards the revoked KGC values. Among the KGC values that have not been revoked, the new device  812  and the other media devices  804 - 810  choose a particular value and, then, execute a secure consensus algorithm to agree on the network key to use.  
       FIG. 9  is a block diagram illustrating exemplary components  900  of the media devices  804 - 812 . The exemplary components  900  include one or more wired or wireless transceivers  902  for network communication within the LAN  802 , a processor  904 , a memory  906 , and a user interface that includes one or more input/output devices  908 . The input/output devices  908  of the components  900  may include a variety of video, audio and/or mechanical outputs. For example, the input/output devices  908  may include a video output device such as a liquid crystal display and light emitting diode indicator, an audio output device such as a speaker, alarm and/or buzzer, and/or a mechanical output device such as a vibrating mechanism. In addition, by example, the input/output devices  908  may further include a video input device such as an optical sensor (for example, a camera), an audio input device such as a microphone, and a mechanical input device such as a flip sensor, keyboard, keypad, selection button, touch pad, touch screen, capacitive sensor, motion sensor, and switch.  
      The memory  906  of the components  900  may be used by the processor  904  to store and retrieve information. The information that may be stored by the memory  906  include, but is not limited to, operating systems, applications, and data. In particular, the memory  906  stores specific data including network keys and KCG values  910 , and a list of KCG values  912 . For each media device, the portion  910  of the memory  906  identified as “network keys and KCG values” stores the network keys utilized by the media device and the KCG values corresponding to each network key. The portion  912  of the memory  906  identified as “list of KCG values” stores a list of KCG values identified all media devices  804 - 812  of the LAN  802 .  
      It is to be understood that  FIG. 9  is for illustrative purposes only and is for illustrating components of a media device in accordance with the present invention, and is not intended to be a complete schematic diagram of the various components required for the controller. Therefore, the media device may include various other components not shown in  FIG. 9  and still be within the scope of the present invention.  
      Referring to  FIG. 10 , there is shown an exemplary operation  1000  for distribution of a security key for the digital security system. The operation  1000  is initiated at step  1002 , such as when the new device  812  powers-up or otherwise joins the LAN  802 . The new device  812  then detects one or more neighboring media devices and attempts to communicate with them at step  1004 . In doing so, the new device  812  sends an inquiry to each neighboring device, requesting information about network keys utilized by the neighboring device. In response to the new device&#39;s inquiry, each neighboring device sends KGC values of network keys known to the neighboring device to the new device at step  1006 . Having information received from its neighboring devices, the new device  812  forwards the information to other media devices in the LAN  802  at step  1008 . Thus, the new device  812  may need to be routed through its neighboring devices in order to reach the other media devices in the LAN  802 .  
      Upon receiving KGC values from all available media devices in the LAN  802 , each media device determines a set of possible KGC values by combining all received KGC values at step  1010 . It should be noted that not all media devices in the LAN  802  may be available, such as those media devices that are powered-down. Also, each media device in the LAN  802  may execute a secure consensus algorithm to gather the set of possible KCG values. Next, each media device votes on a status of each KGC value and gathers votes of other media devices at step  1012 . For example, a vote may be collected for each media device that utilizing a particular KGC value, so that the quantity of votes for each KGC value corresponds to the number of media devices utilizing the network key corresponding to the KGC value. Each media device may execute the secure consensus algorithm a second time to gather votes from all media devices of the LAN  802 .  
      Each media device determines an interim status of each KGC value. If a network key is to be revoked, then the KGC value is discarded from the set. Otherwise, the network key is placed in a final set of non-revoked KGC values. For the set of non-revoked KGC values, each media device selects a KGC value from the set. Thus, each device selects the most popular network keys at step  1014 . For example, each media device may identify one or more popular KGC values as having the greatest quantity of votes from the available media devices.  
      Each media device may determined that more than one network key is popular, i.e., two or more network keys are tied for having the greatest quantity of votes. If the media device determines that more than one KGC value is popular at step  1016 , then the media device selects the KGC value corresponding to the most recently created network key at step  1018 . Next, each media device takes the appropriate steps to make sure that the new device is informed of the selected network key at step  1020 . On the other hand, if the media device determines that only one KGC value is popular at step  1016 , then the media device merely makes sure that the new media device is informed of the selected network key at step  1020 . The new device  812  then executes the secure consensus algorithm a third time to find the network key corresponding to the selected KGC value. Thereafter, the operation  1000  terminates at step  1022 .  
       FIG. 11  is a flow diagram illustrating an exemplary operation  1100  for revocation of a security key for the digital security system. When a network key is to be revoked by a particular media device, then the particular media device detects one or more neighboring media devices and attempts to communicate with them to inform them of the key revocation. Each neighboring device decides to agree or disagree with the revocation and sends its response to the particular media device. So, upon receiving the decisions from the neighboring media devices, the particular media devices query the other devices in the LAN  802  to determine whether to revoke the key. To reach the other media devices, the particular media device may request its neighboring media devices to forward its messages to their neighboring media devices in the LAN  802 . The other media devices in the LAN  802  then respond back with their decisions. For each received decision, the particular media device may forward the received decisions to other media devices in the LAN  802 . Finally, a secure consensus algorithm is then executed in the LAN  802  to determine whether to revoke the network key.  
      The operation  1100  is initiated at step  1102 , and an initiating device may encrypt a NONCE or some type of random number with the network key proposed to be revoked at step  1104 . The initiating device then detects neighboring media devices and sends the encrypted NONCE to them at step  1106 . In turn, the neighboring devices forward the encrypted NONCE to other devices in the LAN  802  at step  1108 . Next, one or more media devices vote on the status of the network key and gather the votes of the other media devices at step  1110 . It should be noted that the media devices that are capable of decrypting the NONCE, i.e., those having the network key proposed to be revoked, are the only ones who will be able to vote. Thereafter, each media device determines whether to revoke the network key at step  1112 , and the operation  1100  terminates at step  1114 .  
      While the preferred embodiments of the invention have been illustrated and described, it is to be understood that the invention is not so limited. Numerous modifications, changes, variations, substitutions and equivalents will occur to those skilled in the art without departing from the spirit and scope of the present invention as defined by the appended claims.