Apparatus and methods for provisioning in a download-enabled system

In a cable television network, a method of provisioning, for operation within said network, a client device having a security device substantially unique to said client device, the method comprising:

• acquiring a network address for said client device;
• placing an authentication entity in contact with said security device;
• authenticating said security device to said entity;
• obtaining personalization information associated with said security device based at least in part on said authenticating, said personalization information comprising a physically identical replication of at least a portion of a microprocessor associated to said client device;
• sending said personalization information to said security device over said network;
• obtaining a software image common to only those ones of a plurality of client devices having a common configuration and disposed within the network;
• sending said common software image to said security device over said network;
• and
• processing one or more messages at said client device in order to determine conditional access privileges.

A method of doing business over a content-based network, comprising:

• selectively configuring at least one network client device based at least in part on a service request from a subscriber associated with said at least one device, said selective configuration comprising:
• entering information associated with said at least one device into a digital network control system (DNCS) of said network;
• generating a personalization image specific to said at least one client device when said at least one device is coupled into communication with said network, said personalization image comprising at least an identical replication of at least a portion of a microprocessor associated with said at least one client device;
• transmitting said personalization image and at least one non-unique software image to said at least one client device;
• and
• establishing at least one security permission or policy within a secure element of said at least one client device, said at least one permission or policy enabling provision of said requested service.

Network apparatus for use in providing secure content and software downloads to a plurality of client devices within a cable television network, the apparatus comprising:

• secure download infrastructure adapted for data communication with a trusted authority (TA);
• a media provisioning system in data communication with said infrastructure;
• a billing system in data communication with said provisioning system;
• and
• a media security system in data communication with said provisioning system;
• wherein said media provisioning system is configured to provide said secure content and software downloads to those ones of said plurality of client devices which have provided identifying information to said billing system and received from said media security system at least one device-specific software image and at least one software image common to those ones of said plurality of devices having a common configuration, said device-specific software image comprising a replicated version of at least a portion of a microprocessor associated to individual ones of said plurality of client devices.

A network apparatus for provisioning a client device having a security device substantially unique to said client device, said apparatus comprising:

• a first interface to acquire a network address for said client device;
• an authentication apparatus configured to authenticate said substantially unique security device;
• and
• an apparatus to provide a secure software image and a device agnostic software image to said client device, said secure software image comprising an identical recreation of at least a portion of a microprocessor of said client device and enabling said client device to access secure programming content from said network;
• wherein said secure software image may be further utilized to enable said network apparatus to modify at least one security feature of said client device.

Apparatus to deliver secure software over a network to a client device, comprising:

• a first interface to a billing system of said network, said interface to enable entry of information associated with said client device, said entry of said information causing said client device to be coupled to said network;
• a media provisioning system configured to maintain said information associated with said client device;
• an authentication proxy configured to maintain a network address, credentials, and a cryptographic element for said client device;
• a personalization server configured to receive said credentials and said cryptographic element for said client device from said authentication proxy and return a client device-specific personalized software image and a common software image to said authentication proxy;
• and
• a second interface configured to transmit an encrypted version of said device-specific personalized software image and said common image to said client device, said encryption comprising encryption based at least in part on said stored cryptographic element for said client device;
• wherein said media provisioning system is utilized to select said authentication proxy and said personalization server via said information, said information comprising:
• information used to identify a secure microprocessor of said client device;
• information used to identify addresses corresponding to a specific authentication proxy and personalization server which will serve said client device;
• and
• information in regard to a software configuration of said client device;
• and
• wherein said client device-specific personalized software image comprises an identical version of at least a portion of a microprocessor associated to said client device.