| Patent application number | Description | Published |
|---|
| 20080219436 | METHOD AND APPARATUS FOR PROVIDING A DIGITAL RIGHTS MANAGEMENT ENGINE - A method receives a set of data. Further, the method receives a traffic key. In addition, the method determines a traffic protection group for the set of data. The method also encrypts the set of data according to the traffic key to generate an encrypted set of data. Finally, the method provides the encrypted set of data through a network to a device. | 09-11-2008 |
| 20080267398 | METHOD AND APPARATUS FOR ASSISTING WITH CONTENT KEY CHANGES - A process may be utilized by the DVR. The process receives a plurality of segments of a set of content and a plurality of corresponding content rule sets. Further, the process provides one or more instructions to record and encrypt the plurality of segments of the set of content on a storage medium. In addition, the process provides the plurality of content rule sets to the DRM component to be inserted into a locally generated and secured content license associated with the encryption of the set of content. The secured content license includes a master key and a list of the plurality of corresponding content rule sets that have been received in order of reception. The process receives a plurality of marker tokens from the DRM component in order to facilitate trick mode playback. | 10-30-2008 |
| 20080267399 | Method and Apparatus for Secure Content Recording - A method is provided that establishes a secure tunnel with a content acquisition processor that acquires encrypted content from a content source and decrypts the encrypted content to obtain content. The content acquisition processor is not trusted for providing digital rights management. Further, the method transmits a request through the secure tunnel to the content acquisition processor to re-encrypt the content with a content encryption key so that re-encrypted content is generated and stores the re-encrypted content on a storage medium. The request includes the content encryption key. | 10-30-2008 |
| 20080267411 | Method and Apparatus for Enhancing Security of a Device - A method is provided that authenticates a data transfer module. Further, the method establishes a secure tunnel between a first processor, which receives a copy protection key from the data transfer module, and a second processor, which receives the copy protection key from the first processor through the secure tunnel. In addition, the method receives, at the second processor, encrypted content from the data transfer module. The method also decrypts, at the second processor, the encrypted content with the copy protection key to generate decrypted content. | 10-30-2008 |
| 20080270308 | Method and Apparatus for Providing a Secure Trick Play - A process may be utilized by a DVR. The process characterizes a set of content as a plurality of segments as the set of content is received. Each of the segments has a segment length according to a predetermined time interval. Further, the process encrypts each of the segments with a corresponding content encryption key to generate a plurality of encrypted segments. The corresponding content encryption key for each of the segments is generated by the DRM component. In addition, the process stores each of the encrypted segments for playback with trick play features in accordance with an expiration content rule having a time limit on the temporary playability of the set of content. | 10-30-2008 |
| 20080270311 | Method and Apparatus for Composing a Digital Rights Management License Format - A process composes a content license for a set of content. The content license has a static portion and a dynamic portion. Further, the process inserts a master key into the static portion. In addition, the process inserts a plurality of content rule sets of values into the dynamic portion and composes a unique content encryption key for each segment of content associated with one of the content rule sets of values as each of the content rule sets of values is sequentially received during recording of the content. The unique content encryption key is based on the master key and at least a subset of the content rule set of values for a corresponding segment of the content. The unique content encryption key is utilized for encryption of each segment of the content to generate a plurality of encrypted content segments for storage on the storage medium. | 10-30-2008 |
| 20080271153 | Method and Apparatus for Handling of Content that includes a Mix of CCI Segments - A process is provided. The process stores, on a first device, each segment of a set of content having corresponding copy control information. Further, the process receives, from a second device, a request for a copy of the set of content. In addition, the process analyzes a list of the copy control information associated with each segment of the set of content. The process also establishes a restriction indicator, based on the request for the copy of the set of content, for one or more segments of the set of content having a corresponding copy control information value. Finally, the process provides to the second device, the content, the list of copy control information, and the restriction indicator for the one or more segments. | 10-30-2008 |
| 20090165111 | METHOD AND APPARATUS FOR SECURE MANAGEMENT OF DEBUGGING PROCESSES WITHIN COMMUNICATION DEVICES - A method, device and system for securely managing debugging processes within a communication device, such as a set top box or other multimedia processing device. For example, a security processor (SP) within the communication device manages the lifetime (LT) of any access token issued for use in activating debugging privileges within the communication device. The security processor authenticates an issued access token and securely delivers appropriate debug authorization information to the device controller. The security processor uses its secure, internal timer to count down the lifetime and update the remaining lifetime of the issued access token during the processing of each command by the security processor. In addition to securely managing the issuance of the access token and it's remaining lifetime, the updating process reduces any impact on the normal communications within the device. The method overcomes the issue of the communication device not having a secure internal clock. | 06-25-2009 |
| 20090249080 | METHODS, APPARATUS AND SYSTEM FOR AUTHENTICATING A PROGRAMMABLE HARDWARE DEVICE AND FOR AUTHENTICATING COMMANDS RECEIVED IN THE PROGRAMMABLE HARDWARE DEVICE FROM A SECURE PROCESSOR - A method, device and system for authenticating a programmable hardware device, such as a programmable hardware chip, and a command received by the programmable hardware device. A secure processor or other trusted source authenticates the programmable hardware chip by verifying, with the secure processor's own verification key, a random number sent to the programmable hardware chip and encrypted using a verification key embedded within the programmable hardware chip, since the nature of the encryption is such that only the original logic function that includes the verification key can encrypt the data correctly. A command received by the programmable hardware chip is authenticated by verifying that a command authentication token received by the programmable hardware chip is generated using the correct command authentication key and consequently verifying that the command is received from the secure processor, as only the party who has the command authentication key can encrypt the data correctly. | 10-01-2009 |
| 20090323954 | INTERNET PROTOCOL TELEPHONY SECURITY ARCHITECTURE - A secure Internet Protocol (IP) telephony system, apparatus, and methods are disclosed. Communications over an IP telephony system can be secured by securing communications to and from a Cable Telephony Adapter (CTA). The system can include one or more CTAs, network servers, servers configured as signaling controllers, key distribution centers (KDC), and can include gateways that couple the IP telephony system to a Public Switched Telephone Network (PSTN). Each CTA can be configured as secure hardware and can be configured with multiple encryption keys that are used to communicate signaling or bearer channel communications. The KDC can be configured to periodically distribute symmetric encryption keys to secure communications between devices that have been provisioned to operate in the system and signaling controllers. The secure devices, such as the CTA, can communicate with other secure devices by establishing signaling and bearer channels that are encrypted with session specific symmetric keys derived from a symmetric key distributed by a signaling controller. | 12-31-2009 |
| 20100058047 | ENCRYPTING A UNIQUE CRYPTOGRAPHIC ENTITY - A method of encrypting a unique cryptographic entity (UCE), where a client device receives a global-key (GK-) encrypted UKD comprising a GK-encrypted UCE and a GK-encrypted unit key number (UKN). The client device verifies that the GK-encrypted UKN is the same as a pre-provisioned value and then decrypts the GK-encrypted UKD using a global key (GK). The client device then re-encrypts the decrypted UKD using a device user key (DUK) to determine a DUK-encrypted UCE and a DUK-encrypted UKN. The DUK-encrypted UKN is verified as not equal to the GK-encrypted UKN. The DUK-encrypted UKN is then appended to the DUK-encrypted UCE to form a DUK-encrypted UKD and stored in a memory. | 03-04-2010 |
| 20100071040 | SECURE SERVER CERTIFICATE TRUST LIST UPDATE FOR CLIENT DEVICES - A method, a network element, and a client device for creating a trusted connection with a network are disclosed. A client device | 03-18-2010 |
| 20100083386 | Tokenized Resource Access - A method and system for unlocking diagnostic functions in a hardware device for a user. The method obtains a signed permission object for the hardware device, and validates the signed permission object. A memory of the hardware device stores a device identifier and a last recorded sequence number. The signed permission object includes a sequence number and is associated with an expiration counter having an initial value that indicates a lifetime for the signed permission object. When the signed permission object is valid, the method updates the expiration counter to decrease the lifetime of the signed permission object, stores the sequence number associated with the signed permission object as the last recorded sequence number in the hardware device, and unlocks the diagnostic functions for the user based on the signed permission object. | 04-01-2010 |
| 20100138903 | Ticket-Based Implementation of Content Leasing - The present invention is a method and system for accessing digital content stored on a computing device. An agreement between a subscriber and a content provider allows the subscriber to lease the digital content from the content provider, and download the digital content from a content server operated by the content provider. The method retrieves a service ticket for the computing device, and retrieves content rights for the digital content. The service ticket includes authorization data, and a session key, where the authorization data include authorized subscription services for the computing device. The content rights include required subscription services for the digital content and are delivered authenticated with the session key. The method allows access to the digital content when the authorized subscription services included with the authorization data match the required subscription services included with the content rights. | 06-03-2010 |
| 20100162414 | Digital Rights Management for Differing Domain-Size Restrictions - A digital rights management system includes a domain authority controller that manages different domain-size restrictions for different content sources. A subdomain is created for each content source and has a corresponding domain-size restriction. Different domain-size restrictions for the content sources are stored along with the number of devices registered for each subdomain. A domain authority controller is operable to register a device with a subdomain if the corresponding domain-size restriction is not violated. A device is allowed to use content from a content source if it is registered with the subdomain for the content source. | 06-24-2010 |
| 20100169646 | SECURE AND EFFICIENT DOMAIN KEY DISTRIBUTION FOR DEVICE REGISTRATION - A domain key is securely distributed from a device in an existing network to a device outside the network. Each device generates the session key on its own using the first random number, the second random number, the Personal Identification Number, and the same key generation function. The device in the existing network sends the domain key encrypted with the session key to the other device. | 07-01-2010 |
| 20100215171 | TRANSPORT PACKET DECRYPTION TESTING IN A CLIENT DEVICE - In a method for testing a transport packet decrypting module of a client device, a first decryption operation of the transport packet decrypting module is implemented on a test encrypted control word using a content decryption key ladder to derive a test control word, a second decryption operation of the transport packet decrypting module is implemented on one or more test transport packets using the test control word via a predetermined content decryption algorithm, the KIV is derived from the decrypted transport packets, and the derived KIV is compared with a value stored in the client device to verify whether the transport packet decrypting module of the client device is functioning properly. | 08-26-2010 |
| 20100217964 | METHOD AND APPARATUS FOR CONTROLLING ENABLEMENT OF JTAG INTERFACE - A method, device and system for controlling JTAG interface enablement within a communication device. The JTAG interface can be selectively enabled based on the receipt of an encrypted access token generated by an access token server. The access token server generates the access token in response to an end user providing appropriate device-specific information. The access token includes appropriate information that, upon appropriate authentication and decryption, can temporarily device bind the boot code image of the device in a manner that enables the JTAG interface. Alternatively, the access token includes appropriate information that instructs the general purpose processor to choose between JTAG interface enablement information and JTAG interface disablement information for use with the boot code image of the device. The access token can include expiration information that causes an enabled JTAG interface to revert back to its disabled status upon expiration of the access token. | 08-26-2010 |
| 20100313014 | DOWNLOADABLE SECURITY BASED ON CERTIFICATE STATUS - A conditional access system (CAS) computer in a downloadable CAS receives a downloadable management certificate (DMC) and determines, using the DMC, security information including a DMC key size and an expiration time of a DMC subordinate certificate authority (sub-CA) certificate, for the client device. The CAS computer then determines whether the DMC is valid based on the expiration time of the DMC sub-CA certificate. If the DMC is determined to be valid, the CAS server sends a cryptographic identity for the client device and a CAS client to the client device protected using the DMC. At a later time, if the DMC key size is considered to be still sufficiently secure, the validity of the DMC is extended by issuing a new DMC sub-CA certificate with the same public key as the original DMC sub-CA certificate. | 12-09-2010 |
| 20100318791 | CERTIFICATE STATUS INFORMATION PROTOCOL (CSIP) PROXY AND RESPONDER - Systems and methods are disclosed for providing certificate status information about a certificate includes receiving, at a Certificate Status Information Protocol (CSIP) proxy device the certificate identity information about the certificate of the second device. Then determining, using the CSIP proxy device, whether the certificate status information is stored in a CSIP proxy device memory. If the certificate status information is not stored in the CSIP proxy device memory, creating a CSIP request based on the certificate identity information and sending the CSIP request, including the certificate identity information, to a CSIP responder computer outside the local network domain. If the certificate status information is stored in the CSIP proxy device memory, sending the certificate status information to the first device. Also, a system and method are disclosed for using a CSIP responder computer. | 12-16-2010 |
| 20110119739 | SECURE CONSUMER PROGRAMMING DEVICE - A method is provided for operating a consumer programming device that provisions consumer electronic devices. The method includes receiving over a communication link a first enable message that authorizes the consumer programming device to make available one or more resources which enable it to provide services to consumer electronic devices. Services are provided to consumer electronic devices up until all the resources have been exhausted. Additional consumer electronic devices are provided with services only if a second enable message is received over the communication link. | 05-19-2011 |
| 20110138177 | ONLINE PUBLIC KEY INFRASTRUCTURE (PKI) SYSTEM - A method is provided for updating network-enabled devices with new identity data. The method includes requesting new identity data for a plurality of network-enabled devices and receiving notification that the new identity data is ready to be delivered to the plurality of network-enabled devices. A software object is delivered to the plurality of network-enabled devices over a first communications network. Each of the software objects is configured to cause the network-enabled devices to download the new identity data to the respective network-enabled device over a second communications network and install the new identity data at a time based at least in part on information included with the software object. | 06-09-2011 |
| 20110158411 | REGISTERING CLIENT DEVICES WITH A REGISTRATION SERVER - In a method of registering a plurality of client devices with a device registration server for secure data communications, a unique symmetric key is generated for each of the client devices using a cryptographic function on a private key of the device registration server and a respective public key of each of the client devices, and a broadcast message containing the public key of the device registration server is sent to the client devices, in which the client devices are configured to generate a respective unique symmetric key from the public key of the device registration server and its own private key using a cryptographic function, and in which the unique symmetric key generated by each client device matches the respective unique symmetric key generated by the device registration server for the respective client device. | 06-30-2011 |
| 20110161645 | CONTENT SECURING SYSTEM - In a method for securing content in a system containing a security processor configured to control access to the content by a main processor, in which main processor being configured to send heartbeats to the security processor, a determination as to whether at least one heartbeat was received within a predicted time interval is made and in response to a determination that at least one heartbeat was not received with the predicted time interval, access to the content by the main processor is ceased. | 06-30-2011 |
| 20110161660 | TEMPORARY REGISTRATION OF DEVICES - In a method of temporarily registering a second device with a first device, in which the first device includes a temporary registration mode, the temporary registration mode in the first device is activated, a temporary registration operation in the first device is initiated from the second device, a determination as to whether the second device is authorized to register with the first device is made, and the second device is temporarily registered with the first device in response to a determination that the second device is authorized to register with the first device, in which the temporary registration requires that at least one of the second device and the first device delete information required for the temporary registration following at least one of a determination of a network connection between the first device and the second device and a powering off of at least one of the first device and the second device. | 06-30-2011 |
| 20110161661 | ENHANCED AUTHORIZATION PROCESS USING DIGITAL SIGNATURES - A method is provided for enhancing security of a communication session between first and second endpoints which employs a key management protocol. The method includes sending a first message to a first end point over a communications network requesting a secure communication session therewith. The message includes an identity of a second end point requesting the authenticated communication session. A digital certificate is received from the first endpoint over the communications network. The digital certificate is issued by a certifying source verifying information contained in the digital certificate. The digital certificate includes a plurality of fields, one or more of which are transformed in accordance with a transformation algorithm. A reverse transform is applied to the one or more transformed fields to obtain the one or more fields. The digital certificate is validated and a second message is sent to the first endpoint indicating that validation is complete. | 06-30-2011 |
