Source authentication of download information in a conditional access system

Claim 3

The method of claim 1 , further comprising the steps of: storing, at a receiver included in the cable television system, a public key of a public-private key pair; and storing, at a transmitter included in the cable television system, a private key of a public-private key pair.

Claim 4

The method set forth in claim 2 , wherein authentication further comprises the step of: transmitting said source authentication token and said source information.

Claim 5

The method of claim 3 , further comprising the step of: encrypting said source authentication token prior to its transmission.

Claim 6

The method set forth in claim 4 , wherein said authentication further comprises, at said receiver, the steps of: receiving said source authentication token and said source information wherein said logic segment of said source information is configured for execution in said receiver; decrypting said source authentication token using a public key of the public-private key pair, wherein said public key is stored by said receiver; providing said source information as an input into said secure hash function for producing an output; using at least a portion of said output from said secure hash function at said receiver as a receiver authentication token; and comparing said source authentication token with said receiver authentication token, the information being authentic when said source authentication token and said receiver authentication are the same.

Claim 7

The method set forth in claim 5 , wherein said public key comprises a certified public key provided by a certification authority.

Claim 10

A head end for providing verifiable download information, the head end comprising: a data port for receiving a private key provided by a certification authority, wherein said private key is included in a public-private key pair; a memory for storing the private key; a processor for performing a secure hash function having as inputs said download information and a control word, said hash function producing an output; a device for creating a source authentication token from at least a portion of said output of said secure hash function; an encryptor for encrypting said control word; and a transmission device for transmitting said source authentication token, said encrypted control word, and said download information.

Claim 11

A head end for providing verifiable download information, the head end comprising: a data port for receiving a private key provided by a certification authority, wherein said private key is included in a public-private key pair; a memory for storing the private key; a processor for performing a secure hash function having as inputs said download information and a control word, said hash function producing an output; a device for creating a source authentication token from at least a portion of said output of said secure hash function; an encryptor for encrypting said control word; and a transmission device for transmitting said source authentication token, said encrypted control word, and said download information.

Claim 12

A set top terminal for verifying an information source, said set top terminal comprising: a port for receiving a message comprising download information, a source authentication token, and a control word from said information source; a memory for storing a public key that is included in a public-private key pair; a decryptor coupled to said port for decrypting said control word using said public key; a processor coupled to said decryptor for performing a secure hash function having as inputs said decrypted control word and said download information wherein said secure hash function produces an output, and for creating a receiver authentication token from at least a portion of said output from said secure hash function; and a comparator for comparing said source authentication token with said receiver authentication token, wherein the processor accepts the download information as authentic when said source authentication token and said receiver authentication token are the same.

Claim 13

A set top terminal for verifying an information source, said set top terminal comprising: a port for receiving a message comprising download information, a source authentication token, and a control word from said information source; a memory for storing a public key that is included in a public-private key pair; a decryptor coupled to said port for decrypting said control word using said public key; a processor coupled to said decryptor for performing a secure hash function having as inputs said decrypted control word and said download information wherein said secure hash function produces an output, and for creating a receiver authentication token from at least a portion of said output from said secure hash function; and a comparator for comparing said source authentication token with said receiver authentication token, wherein the processor accepts the download information as authentic when said source authentication token and said receiver authentication token are the same.

Claim 14

A cable television system for verifying the source of download information, the cable television system comprising: a certification authority for generating and providing public and private keys within the cable television system; an entitlement agent for providing verifiable download information, the entitlement agent comprising: a data port for receiving a private key provided by the certification authority, wherein said private key is included in a public-private key pair generated by the certification authority; a memory for storing the private key; a processor for performing a secure hash function having as inputs said download information and a control word, said secure hash function producing an output; a device for creating a source authentication token from at least a portion of said output of said secure hash function; an encryptor for encrypting said control word; and a transmission device for transmitting said source authentication token, said encrypted control word, and said download information; a set top terminal for verifying an information source, said set top terminal comprising: a port for receiving a message comprising said download information, said source authentication token, and said encrypted control word from said entitlement agent; a memory for storing a public key that is included in said public-private key pair; a decryptor coupled to said port for decrypting said encrypted control word using said public key; a processor coupled to said decryptor for performing a secure hash function having as inputs said control word and said download information, said secure hash function producing an output, and for creating a receiver authentication token from at least a portion of said output from said secure hash function; and a comparator for comparing said source authentication token with said receiver authentication token, wherein the processor accepts the download information as authentic when said source authentication token and said receiver authentication token are the same; and a communication medium for coupling said certification authority, said set top terminal, and said entitlement agent.

Claim 15

A cable television system for verifying the source of download information, the cable television system comprising: a certification authority for generating and providing public and private keys within the cable television system; an entitlement agent for providing verifiable download information, the entitlement agent comprising: a data port for receiving a private key provided by the certification authority, wherein said private key is included in a public-private key pair generated by the certification authority; a memory for storing the private key; a processor for performing a secure hash function having as inputs said download information and a control word, said secure hash function producing an output; a device for creating a source authentication token from at least a portion of said output of said secure hash function; an encryptor for encrypting said control word; and a transmission device for transmitting said source authentication token, said encrypted control word, and said download information; a set top terminal for verifying an information source, said set top terminal comprising: a port for receiving a message comprising said download information, said source authentication token, and said encrypted control word from said entitlement agent; a memory for storing a public key that is included in said public-private key pair; a decryptor coupled to said port for decrypting said encrypted control word using said public key; a processor coupled to said decryptor for performing a secure hash function having as inputs said control word and said download information, said secure hash function producing an output, and for creating a receiver authentication token from at least a portion of said output from said secure hash function; and a comparator for comparing said source authentication token with said receiver authentication token, wherein the processor accepts the download information as authentic when said source authentication token and said receiver authentication token are the same; and a communication medium for coupling said certification authority, said set top terminal, and said entitlement agent.

Claim 16

The cable television system of claim 10 , wherein said entitlement agent can authenticate different types of download information.

Claim 17

The cable television system of claim 10 , wherein said certification authority can authenticate different types of download information.

Claim 18

The method of claim 3 , further comprising the step of: encrypting said source authentication token prior to its transmission.

Claim 19

The method set forth in claim 13 , wherein said authentication further comprises, at the receiver, the steps of: receiving said source authentication token and said source information; decrypting said source authentication token using a public key of the public-private key pair, wherein said public key is stored by the receiver; providing said source information as an input into said secure hash function for producing an output; using at least a portion of said output from said secure hash function at the receiver as a receiver authentication token; and comparing said source authentication token with said receiver authentication token, the information being authentic when said source authentication token and said receiver authentication are the same.

Claim 20

The method set forth in claim 14 , wherein said public key comprises a certified public key provided by a certification authority.

Claim 21

The method set forth in claim 7 , wherein said download information includes a logic segment configured for execution in said set top terminal.

Claim 22

The method set forth in claim 16 , further comprising the step of: executing said logic segment at said receiver after said download information has been authenticated.

Claim 23

The method set forth in claim 7 , wherein said download information includes a data segment for an application configured for execution at said set top terminal.

Claim 24

The head end equipment as claimed in claim 8 , wherein said download information includes a data segment for an application.

Claim 25

The head end as claimed in claim 8 , wherein said download information includes a logic segment.

Claim 26

The set top terminal as claimed in claim 9 , wherein said download information includes a data segment for an application configured for execution at the set top terminal.

Claim 27

The set top terminal as claimed in claim 9 , wherein said download information includes a logic segment.

Claim 28

The set top terminal as claimed in claim 22 , wherein said logic segment is configured for execution in said set top terminal.

Claim 29

The set top terminal as claimed in claim 23 , wherein said logic segment is configured to be executed in said set top terminal after said processor accepts said download information as authentic.

Claim 30

The cable television system of claim 10 , wherein said download information includes a logic segment.

Claim 31

The cable television system of claim 25 , wherein said logic segment is configured for execution by said processor after said processor accepts said download information as authentic.

Claim 34

The method of claim 27 , further comprising the step of: storing, at said receiver, a public key of the public-private key pair; and storing, at a transmitter included in the cable television system a private key of the public-private key pair.

Claim 35

The method set forth in claim 28 , wherein authentication further comprises the step of: transmitting said source authentication token and said logic segment.

Claim 36

The method of claim 29 , further comprising the step of: encrypting said source authentication token prior to its transmission.

Claim 37

The method set forth in claim 30 , wherein said verification further comprises, at said receiver, the steps of: receiving said source authentication token and said source information, wherein said logic segment of said source information is configured for execution in said receiver; decrypting said source authentication token using a public key of the public-private key pair, wherein said public key is stored by said receiver; including said logic segment as an input into said secure hash function for producing an output; using at least a portion of said output from said secure hash function at said receiver as a receiver authentication token; and comparing said source authentication token with said receiver authentication token, the information being authentic when said source authentication token and said receiver authentication token are the same.

Claim 38

The method set forth in claim 31 , wherein said public key comprises a certified public key provided by a certification authority.

Claim 39

The method set forth in claim 31 , further comprising the step: executing said logic segment at said receiver after said download information has been authenticated.

Claim 42

The method of claim 34 , further comprising the steps of: storing a public key of a public-private key pair at the receiver; and storing a private key of the public-private key pair at a transmitter included in the cable television system.

Claim 43

The method set forth in claim 35 , wherein authentication further comprises the steps of: transmitting said source authentication token and said source information.