# US 2021/0243484 A1 · Systems and methods for secure communications between media devices

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0243484 A1
- Document ID: US20210243484A1
- Status: Published application
- Kind: A1
- Application number: 17/239,052
- Filed: 2021-04-23
- Published: 2021-08-05
- Earliest claimed: 2019-03-15
- Assignees: DISH Network L.L.C.
- Applicants: Dish Network L.L.C.
- Inventors: John D. Hamrick, JR.; Geoffrey C. Kemp
- Web page: https://patentgrep.com/patent/US20210243484A1

## CPC

- H04N 21/2347: involving video stream encryption
- H04N 21/43615: {Interfacing a Home Network, e.g. for connecting the client to a plurality of peripherals (home Audio Video Interoperability [HAVI] data switching networks H04L12/2805)}
- H04L 12/28: characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks] (wireless communication networks H04W {; arrangements for dividing the transmission path H04W40/00})
- H04L 63/0272: {Virtual private networks}
- H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)}
- H04L 63/0869: {for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273)}
- H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
- H04N 21/411: {having similar hardware or software capabilities as the client device itself, e.g. a first STB connected to a second STB}
- H04N 21/43632: {involving a wired protocol, e.g. IEEE 1394 (high-speed IEEE 1394 serial bus H04L12/40052)}
- H04N 21/4367: Establishing a secure communication between the client and a peripheral device or smart card
- H04N 21/64322: {IP}
- H04N: PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

An Internet Layer end-to-end security connection (an Internet protocol (IP) encrypted tunnel) is established between a television receiving device and each player device on a home local area network (LAN) as part of the initial pairing process between each player device and the television receiving device. Traffic between the television receiving device and the player device is communicated via IP on the LAN, such that data between the two devices is securely encrypted at the Internet Layer, thus reducing potential security issues related to managing security and encryption at the application layer. This results in a secure virtual private network (VPN) between each player device and the television receiving device.

## Claims

### Claim 1

A method for secure communications between media devices, the method comprising:
receiving network data, by a first computing device;
performing, by the first computing device, a pairing between the first computing device and a second computing device over a local area network (LAN), the performing of the pairing including:
establishing, by the first computing device, an Internet Protocol Suite Internet Layer (Internet Layer) end-to-end security connection over the LAN between the first computing device and the second computing device; and
in response to establishing the Internet Layer end-to-end security connection, storing, by the first computing device, an association between the first computing device and the second computing device indicating a pairing of the first computing device and the second computing device over the LAN; and
transmitting, by the first computing device, requested network data of the received network data from the first computing device to the second computing device in a secure manner by using the Internet Layer end-to-end security connection over the LAN that was established as part of pairing of the first computing device to the second computing device.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
for each application of a plurality of different applications of the first computing device that is communicating at an Internet Protocol Suite Application Layer with the second computing device, transmitting, by the first computing device, requested media network data of the received media network data for the application from the first computing device to the second computing device in a secure manner by using the Internet Layer end-to-end security connection over the LAN that was established as part of pairing of the first computing device to the second computing device.

### Claim 3 (depends on 2)

The method of claim 2 wherein the Internet Layer end-to-end security connection is an Internet Protocol Security (IPsec) connection over which requested media network data for each of the plurality of different applications is communicated.

### Claim 4 (depends on 2)

The method of claim 2 wherein the Internet Layer end-to-end security connection is an IP-over-SSH connection over which requested media network data for each of the plurality of different applications is communicated from the first computing device to the second computing device.

### Claim 5 (depends on 2)

The method of claim 2 wherein the establishing of the Internet Layer end-to-end security connection includes establishing a virtual private network between the first computing device and the second computing device over which requested media network data for each of the plurality of different applications will be communicated from the first computing device to the second computing device.

### Claim 6 (depends on 1)

The method of claim 1 wherein the establishing of the Internet Layer end-to-end security connection includes performing network tunneling between the first computing device to the second computing device.

### Claim 7 (depends on 1)

The method of claim 1 wherein all network traffic between the first computing device and the second computing device is communicated using Internet Protocol (IP) and securely encrypted by using the Internet Layer end-to-end security connection over the LAN that was established as part of pairing of the first computing device to the second computing device.

### Claim 8 (depends on 1)

The method of claim 1, further comprising:
for each second computing device of a plurality of second computing devices:
performing, by the first computing device, a pairing between the first computing device and the second computing device over the LAN, the performing of the pairing including:
in response to power-up of the second computing device, establishing, by the first computing device, an Internet Layer end-to-end security connection over the LAN between the first computing device and the second computing device; and
in response to establishing the Internet Layer end-to-end security connection, storing, by the first computing device, an association between the first computing device and the second computing device indicating a pairing of the first computing device and the second computing device over the LAN; and
transmitting, by the first computing device, requested media network data of the received media network data from the first computing device to the second computing device in a secure manner by using the Internet Layer end-to-end security connection over the LAN that was established as part of pairing of the first computing device to the second computing device.

### Claim 9 (depends on 1)

The method of claim 1 wherein establishing the Internet Layer end-to-end security connection over the LAN between the first computing device and the second computing device includes:
at initial pairing between the first computing device and the second computing device:
receiving, by the first computing device over the LAN from the second computing device, a public key of the second computing device using a public key infrastructure (PKI) for the first computing device to encrypt data to send to the second computing device using the public key of the second computing device; and
sending, by the first computing device over the LAN to the second computing device, a public key of the first computing device using the PKI for the second computing device to encrypt data to send to the first computing device using the public key of the first computing device.

### Claim 10 (depends on 9)

The method of claim 9 wherein the using the PKI for the first computing device to encrypt data to send to the second computing device includes using an X.509 certificate to perform authentication between the first computing device and the second computing device at initial pairing between the receiving device and the second computing device.

### Claim 11 (depends on 9)

The method of claim 9, further comprising:
receiving, by the first computing device, a plurality of public keys using the PKI, wherein each public key of the plurality of public keys is a respective different public key of a different second computing device of a plurality of second computing devices associated with the first computing device for the first computing device to encrypt data at the Internet Layer to send to the plurality of second computing devices over the LAN; and
for each second computing device of the plurality of second computing devices, used by the first computing device, the respective different public key of the second computing device at initial pairing of the first computing device with the second computing device to generate a secure Internet Layer tunnel between the first computing device with the second computing device for encryption at the Internet Layer of data sent between the first computing device and the second computing device.

### Claim 12 (depends on 11)

The method of claim 11 wherein the receiving the plurality of public keys includes receiving the plurality of public keys from a cellular telephone system.

### Claim 13 (depends on 11)

The method of claim 11 wherein the first computing device is a router and the receiving the plurality of public keys includes receiving the plurality of public keys via a secure connection to a cellular telephone system.

### Claim 14 (depends on 11)

The method of claim 11 wherein the receiving the plurality of public keys includes obtaining the plurality of public keys from a secure smartcard associated with a satellite or cable television service provider and associated with and inserted into the first computing device.

### Claim 15 (depends on 11)

The method of claim 11 wherein each public key of the plurality of public keys received by the first computing device is signed by a private key of a satellite or cable television service provider and the using of the respective different public key of the second computing device at initial pairing of the first computing device with the second computing device to generate a secure Internet Layer tunnel between the first computing device with the second computing device includes:
verifying, by the first computing device, that the respective different public key of the second computing device has been signed by the private key of the satellite or cable television service provider; and
based on the verification that the respective different public key of the second computing device has been signed by the private key of the of the satellite or cable television service provider, initiating the sending, by the first computing device over the LAN to the second computing device, the public key of the first computing device encrypted with the respective different public key of the second computing device.

### Claim 16 (depends on 1)

The method of claim 1 wherein establishing the Internet Layer end-to-end security connection over the LAN between the first computing device and the second computing device includes:
at initial pairing between the first computing device and the second computing device:
generating, by the first computing device, a symmetric cryptographic key associated with and unique to the second computing device; and
communicating, by the first computing device, the symmetric cryptographic key to the second computing device for the first computing device and second computing device to use to encrypt and decrypt all Internet Layer data sent between the first computing device and second computing device over the LAN.

### Claim 17 (depends on 16)

The method of claim 16, further comprising:
for each second computing device of a plurality of second computing devices, at initial pairing between the first computing device and the second computing device:
generating, by the first computing device, a symmetric cryptographic key associated with and unique to the second computing device; and
communicating, by the first computing device, the symmetric cryptographic key to the second computing device for the first computing device and second computing device to use to encrypt and decrypt all Internet Layer data sent between the first computing device and second computing device over the LAN.

### Claim 18

A system for secure communications between media devices comprising:
at least one processor; and
at least one memory coupled to the at least one processor, the at least one memory having instructions thereon that, when executed by the at least one processor, cause the following to be performed:
for each second computing device of a plurality of second computing devices:
performing a pairing between the first computing device and the second computing device over a local area network (LAN), the performing of the pairing including:
in response to power-up of the second computing device, establishing, by the first computing device, an Internet Layer end-to-end security connection over the LAN between the first computing device and the second computing device; and
in response to establishing the Internet Layer end-to-end security connection, storing an association between the first computing device and the second computing device indicating a pairing of the first computing device and the second computing device over the LAN; and
transmitting requested media network data of the received media network data from the first computing device to the second computing device in a secure manner by using the Internet Layer end-to-end security connection over the LAN that was established as part of pairing of the first computing device to the second computing device.

### Claim 19 (depends on 18)

The media network data transmission system of claim 18 wherein the Internet Layer end-to-end security connection is either an Internet Protocol Security (IPsec) connection or an IP-over-SSH connection, over which the requested media network data is communicated.

### Claim 20

A non-transitory computer-readable storage medium having computer-executable instructions stored thereon that, when executed, cause the following to be performed:
performing a pairing between a first computing device and a second computing device over a local area network (LAN), the performing of the pairing including:
in response to power-up of the second computing device, establishing an Internet Protocol Suite Internet Layer (Internet Layer) end-to-end security connection over the LAN between the first computing device and the second computing device; and
in response to establishing the Internet Layer end-to-end security connection, storing an association between the first computing device and the second computing device indicating a pairing of the first computing device and the second computing device over the LAN;
sending a request to the first computing device for media network data that was received by the first computing device; and
in response to the request, receiving, by second computing device, the requested media network data from the first computing device in a secure manner by using the Internet Layer end-to-end security connection over the LAN that was established as part of pairing of the first computing device to the second computing device.

### Claim at position 21

21-28. (canceled)