US 9,313,458 B2 · Downloadable security and protection methods and apparatus

Abstract

Methods and apparatus for control of data and content protection mechanisms across a network using a download delivery paradigm. In one embodiment, conditional access (CA), digital rights management (DRM), and trusted domain (TD) security policies are delivered, configured and enforced with respect to consumer premises equipment (CPE) within a cable television network. A trusted domain is established within the user's premises within which content access, distribution, and reproduction can be controlled remotely by the network operator. The content may be distributed to secure or non-secure “output” domains consistent with the security policies enforced by secure CA, DRM, and TD clients running within the trusted domain. Legacy and retail CPE models are also supported. A network security architecture comprising an authentication proxy (AP), provisioning system (MPS), and conditional access system (CAS) is also disclosed, which can interface with a trusted authority (TA) for cryptographic element management and CPE/user device authentication.

Claims21

Dependent claims

Network apparatus disposed substantially at a first node of a content distribution network and configured to deliver security information to a second node of said network, said network apparatus comprising:

a content provisioning apparatus;
a security management apparatus in communication with said content provisioning apparatus;
and
an authentication apparatus in communication with at least said security management apparatus;
wherein at least said authentication apparatus and security management apparatus are configured to cooperate to transmit to said second node an encrypted management message and an encrypted session key;
wherein said encrypted management message is configured to be decrypted only by certain ones of a plurality of client devices at said second node, said decrypted management message being configured to enable said certain ones of said plurality of client devices to decrypt said encrypted session key;
and
wherein said encrypted session key is configured to enable said certain ones of said plurality of client devices to decrypt encrypted content in order to manage at least one of (i) a trusted domain (TD) policy or configuration, and (ii) a digital rights management (DRM) policy or configuration, within a secure element of said certain ones of said plurality of client devices.

5 more elements

Security apparatus for use with a content distribution network, comprising:

client-side security management apparatus in operative communication with said content distribution network and configured to maintain at least a portion of a trusted domain within a client device using at least a secure element;
and
network security management apparatus in operative communication with said content distribution network and said client-side security management apparatus, said network security management apparatus being configured to control at least one of a configuration and an operation of said client-side security management apparatus in order to protect content delivered to said client device against unauthorized distribution or reproduction;
wherein said secure element is authenticated to said network security management apparatus prior to delivery of said content to said client device.

1 more element

Dependencies are inferred from the claim text.

Downloadable security and protection methods and apparatus

Life of this patent

Downloadable security and protection methods and apparatus

Life of this patent

Abstract

Claims21