Abstract: A method for authenticating a string of data stored remotely from the processor. A bifurcated hash routine can be utilized to provide a check root along with a putative new root for a revised string of data. The check root can be compared with the previously determined initial root. If the check root matches the initial root, the new root is accepted in view of the fact that it was computed concurrently with the check root.

Abstract: A secure Internet Protocol (IP) telephony system, apparatus, and methods are disclosed. Communications over an IP telephony system can be secured by securing communications to and from a Cable Telephony Adapter (CTA). The system can include one or more CTAs, network servers, servers configured as signaling controllers, key distribution centers (KDC), and can include gateways that couple the IP telephony system to a Public Switched Telephone Network (PSTN). Each CTA can be configured as secure hardware and can be configured with multiple encryption keys that are used to communicate signaling or bearer channel communications. The KDC can be configured to periodically distribute symmetric encryption keys to secure communications between devices that have been provisioned to operate in the system and signaling controllers.

Abstract: According to the invention, a content processing unit for protecting interchip content pathways transporting digital content objects is disclosed. The content processing unit includes a first chip package, a second chip package and a content pathway. The first chip package includes a first body, a first plurality of interconnects, an encryption engine, and a first key storage register capable of storing a first key, and the second chip package includes a second body, a second plurality of interconnects, an encryption engine, and a second key storage register capable of storing a second key. The first key is used by the encryption engine to produce ciphertext content and cannot be overwritten after a programmability period. The first and second key storage registers are non-readable from outside the first body. The second key is used by the decryption engine to produce plaintext content from the ciphertext content.

Abstract: Methods and an apparatus for storing information in a processing device with flexible security are disclosed. In one embodiment, a method stores information within the processing device. The method receives a download via a first input path which includes a first breakable link and stores the download within the processing device. At some point, a key is also stored within the processing device. A ciphertext download is received via a second input path which includes a second breakable link. The ciphertext download is decrypted utilizing the key and the resulting plaintext download is stored within the processing device.

Abstract: A system and method for secure delivery and playback of content at a theater complex domain. The domain receives encrypted and compressed content from a studio domain. The theater complex domain comprises at least a projection unit operable to render decompressed digital video content, and a security module removably coupled to the projection unit. The security module includes at least a decompression unit operable to produce decompressed digital video content. The security module further includes a decryption unit coupled to the decompression unit that is operable to produce unencrypted compressed digital video content that is then processed by the decompression unit. The security module further includes a watermark unit coupled to the decompression unit operable to produce the decompressed digital video content rendered by the projection unit that includes a watermark embedded therein.

Abstract: Two or more set-top boxes are installed in a household. A communications link, preferably a physical link, is provided between or among the set-top boxes. One of the boxes is designated as a “master” box while the other box or boxes are “slaves.” The slave box will use the communications link to communicate in a secured and encrypted manner with the master box. If that communication is severed, e.g., if an attempt is made to move the slave box to another household to provide unauthorized service in that household, the slave box will stop working when it can no longer communicate with the master box.

Abstract: A digital rights management architecture for securely delivering content to authorized consumers. The architecture includes a content provider and a consumer system for requesting content from the content provider. The content provider generates a session rights object having purchase options selected by the consumer. A KDC thereafter provides authorization data to the consumer system. Also, a caching server is provided for comparing the purchase options with the authorization data. The caching server forwards the requested content to the consumer system if the purchase options match the authorization data. Note that the caching server employs real time streaming for securely forwarding the encrypted content, and the requested content is encrypted for forwarding to the consumer system. Further, the caching server and the consumer system exchange encrypted control messages (and authenticated) for supporting transfer of the requested content.

Abstract: A session rights object and authorization data are used for defining a consumer's access right to a media content stream. The access rights are determined at a caching server remotely located from the consumer rather than locally at the end user site. In a first aspect, in a computing network having a content provider, a key distribution center, a caching server and a client, a method for controlling client access to a real-time data stream from the caching server, is disclosed.

Abstract: A provisioning system that secures delivery of a client's public key to a KDC (Key Distribution Center). The provisioning system comprises a client, uniquely identifiable by one or more parameters including a user ID (identification); a provisioning server for registering the client; a key distribution center for generating a provisioning key associated with the user ID, the provisioning key being forwarded to the provisioning server; the provisioning server generating configuration parameters for initializing the client, the provisioning key being included in the configuration parameters; and upon initialization, the client provides its public key, authenticated with the provisioning key for forwarding to the key distribution center.

Abstract: A consumer set-top terminal and method that receives and stores digital programming services such as television programs for subsequent playback by the user in a manner analogous to a conventional video cassette recorder (VCR). An interface allows the terminal's user to control a transcoding proces based on the desired quality level for the transcoded data, e.g., high, medium or low. The transcoding is provided without the expense and complexity of a full encoder. By performing transcoding at the terminal, the bit rate of the data can be reduced sufficiently to allow economical storage at the terminal. Moreover, the user can set the quality level to be different for different programs, different parts of the same program, or for different channels. The user input can be received via an interface, such as an on-screen display, which is optionally integrated with electronic program guide data. The user input can be established beforehand as well.

Abstract: According to one embodiment of the invention, a free preview of a program can be provided to client computers in a multicasting system. This can allow viewers in the multicasting system to view a first portion of the program before deciding whether to order the program content. According to another embodiment, various distribution methods can be accomplished using encyrption keys to distribute program content. According to yet another embodiment, an initial viewing period can be provided to allow negotiation of the encryption keys. According to another embodiment, rules and conditions for providing content in a multicasting environment can be utilized.

Abstract: According to one embodiment of the invention, a free preview of a program can be provided to client computers in a multicasting system. This can allow viewers in the multicasting system to view a first portion of the program before deciding whether to order the program content. According to another embodiment, various distribution methods can be accomplished using encryption keys to distribute program content. According to yet another embodiment, an initial viewing period can be provided to allow negotiation of the encryption keys. According to another embodiment, rules and conditions for providing content in a multicasting environment can be utilized.

Abstract: According to one embodiment of the invention, a free preview of a program can be provided to client computers in a multicasting system. This can allow viewers in the multicasting system to view a first portion of the program before deciding whether to order the program content. According to another embodiment, various distribution methods can be accomplished using encryption keys to distribute program content. According to yet another embodiment, an initial viewing period can be provided to allow negotiation of the encryption keys. According to another embodiment, rules and conditions for providing content in a multicasting environment can be utilized.

Abstract: A system is described for allowing “pay by time” purchasing of digital video programming. The system provides for a variable or metered approach. A user can purchase a fraction of a program for a price different from that required for purchasing the entire program. Records of the user's viewing can be created to record, e.g., when a user started receiving a program, how long the user received a program, and when the user stopped receiving a program.

Abstract: The present invention provides a transcoding architecture and a consumer set-top box with storage capability that is based on the transcoding architecture and capable of operating efficiently in an all-digital environment. In a preferred embodiment, a digital-VIDEO DEVICE employs an MPEG-2 compliant transcoder that includes a simplified cascaded decoder and encoder, and is capable of performing determinable bitrate re-encoding without conducting motion estimation. During recording, the decoder receives and processes a compressed source bitstream, producing a decoded bitstream that includes reconstructed video and preserved motion vectors. The encoder “re-encodes” the decoded bitstream using the preserved motion vectors and performs any applicable bitrate modifications. The re-encoded bitstream is then stored.

Abstract: Data overflow in a buffer of a set-top decoder for receiving asynchronous data, such as digital television signals, is prevented while also maintaining compliance with an interface timing standard such as the RS404-A standard. A fullness level of the buffer is monitored to determine whether the fullness falls within a first, nominal range, or into second or third higher ranges. A clocking signal is derived from a ratio of a fixed reference clock signal and a divisor for outputting asynchronous data from the buffer at a desired rate. A direct digital synthesis (DDS) circuit may be used to provide a fractional divisor. The divisor is selected to provide the clocking signal at a rate so that a difference between a target output rate and the actual output rate falls within a data performance standard such as the RS404-A standard.

Abstract: An MPEG transport packet stream or the like is modified to provide concatenated synchronization bytes at an output of an interleaver receiving the modified packet stream. A conventional sync byte located in a first transport packet is replaced with a first substitute sync byte. A conventional sync byte located in a conventional sync byte position of a second transport packet is deleted. Another byte from the second transport packet is moved to the position of the deleted sync byte to open a desired byte position in the second transport packet. A second substitute sync byte is inserted into the desired byte position. The first and second transport packets and the desired byte position are selected to provide the first and second substitute sync bytes at locations in the modified packet stream where the first substitute sync byte will be concatenated with the second substitute sync byte at the output of the interleaver.

Abstract: A method and apparatus are provided for generating a digital signature that authenticates information of a plurality of different information groups. Information from each group is hashed to produce a separate hash key for each group authenticating the information in that group. Particular combinations of the hash keys are hashed together to produce at least one combined hash key. Each of the hash keys is ultimately combined in a predetermined order with all other hash keys via the combined hash keys to produce the digital signature in a manner that authenticates the information of all of the information groups. The digital signature is reproducible without access to all of the information groups authenticated thereby. Instead, information from a first information group is provided together with a set of hash keys and combined hash keys embodying authenticated information from the other groups.

Abstract: Error recovery is provided for isochronous data ("isodata") obtained from a data stream. Isodata transport packets are monitored to locate isodata presentation time stamps (PTSs). The presentation of isodata from a buffer is synchronized to a system time clock (STC) using timing information derived from the PTSs. Discontinuity errors between said isodata transport packets are identified and, if a discontinuity of no more than one packet is identified, a write pointer of the buffer is advanced by a suitable number of bits to compensate for the discontinuity, while maintaining the synchronization of the presentation with respect to the STC.

Abstract: A method and apparatus are provided for communicating VBI user information for digital television. A syntax is provided which allows the transport of closed captions, non-realtime video, sampled video and AMOL. Non-realtime video can be used to transport various types of data, such as a vertical interval test signal (VITS) through the system at full resolution. The provision in the syntax of a count for each type of VBI user information enables the adjustment of a digital television data stream to accommodate variable amounts and types of such information without space being reserved in advance. The provision of a priority number in the syntax enables decoders to discard VBI user information priorities which are not supported by the particular decoder.